Privacy Policy
How we collect, use and protect your personal data
Last updated: October 2026
1. Who we are (Data Controller)
Love. Eat. Keep Fit. is a brand name of a meal-planning app and website. The data controller is We Make IT, a sole trader registered in Ireland, with a principal place of business at 32 Millbourne Drive, Ashbourne, Co. Meath, Ireland.
Contact us regarding your personal data at any time: loveeatkeepfitblog@gmail.com
2. What data we collect and why
Account data
When you register we collect your name, email address, and a bcrypt-hashed password. We also record when your email was verified. Legal basis: Art. 6(1)(b) GDPR, performance of a contract.
Calorie calculator
The calorie calculator asks for your age, sex, weight, height, activity level and goal. We treat this as health data under Art. 9 GDPR. The calculation runs on your own device. Your answers are not sent to us or stored when you calculate.
If you are signed in and press Save to my account, we store only the results (daily calorie target and macros), not your measurements. If you save results for someone you plan meals for, we store their first name and their results the same way; please make sure they’re happy for you to. Legal basis: your explicit consent (Art. 9(2)(a) GDPR), given by pressing that button. You can withdraw consent at any time by asking us to delete it or by deleting your account (Account and emails, in the profile menu). This does not affect earlier lawful processing. We are told by email that a named member used the calculator, but that email never contains your answers or results.
Recipe and tips emails (optional)
We only send you recipes, tips or offers by email if you tick the optional box when you create your account. It is never ticked for you, and nothing in the app depends on it. We record when you agreed. Legal basis: Art. 6(1)(a), consent, and Regulation 13 of the ePrivacy Regulations 2011 (S.I. 336/2011). You can unsubscribe at any time, in one click, from the link or your mail app’s unsubscribe button in any of these emails, from Account and emails in the app, or by contacting us. We stop straight away and record when you unsubscribed.
Your own recipes (My recipes)
The recipes you save, with any photos you add. They are kept with your account, only you can see them, and they are deleted when you delete them or your account. Photos are made smaller on your device before they are uploaded, which also removes location data. When you save from a link, we visit that page once to read the recipe’s name and ingredients.
Contact messages
Your name, email address, and message content submitted via the contact form. Legal basis: Art. 6(1)(b) (responding to your enquiry).
Analytics cookies (optional)
With your consent, we use Vercel Analytics and Google Analytics (GA4) to understand how visitors use the site. No personal identifiers are stored. Legal basis: Art. 6(1)(a), consent, given via the cookie banner. You may withdraw consent at any time via the cookie preference link in the footer.
3. Minimum age
This service is directed at adults. In line with Section 31 of the Irish Data Protection Act 2018, you must be at least 16 years old to create an account. We do not knowingly collect data from anyone under 16.
4. Data processors (third parties)
All third-party providers act as data processors on our instructions. We do not sell your data.
| Processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database hosting | EU (Frankfurt) | EEA, no transfer |
| Vercel | Web hosting & CDN | US / EU edge | Standard Contractual Clauses |
| Resend | Transactional email | US | Standard Contractual Clauses |
| Vercel Analytics | Website analytics | US / EU edge | Consent-gated; no personal IDs stored |
| Google Analytics (GA4) | Website analytics | US | Consent-gated; Standard Contractual Clauses |
5. Retention periods
- Account data: active account, or up to 3 years after last login.
- Health & nutrition data: until account deletion or consent withdrawal.
- Contact emails: up to 2 years in our email inbox.
- Your own recipes and their photos: until you delete them or your account.
- Verification tokens: 24 hours from creation, then auto-deleted.
- Server logs: deleted by Vercel after 30 days.
6. Your rights
Under GDPR and the Irish Data Protection Act 2018, you have the right to:
- Access: request a copy of the data we hold about you.
- Rectification: ask us to correct inaccurate data.
- Erasure: request deletion of your account and data (also available in settings).
- Restriction: ask us to limit processing in certain circumstances.
- Portability: receive your data in a machine-readable format.
- Object: object to processing based on legitimate interests.
- Withdraw consent: for any consent-based processing, at any time.
To exercise any right, email loveeatkeepfitblog@gmail.com. We will respond within one month.
7. Security measures
- Passwords hashed with bcrypt (work factor 12).
- All connections encrypted via TLS 1.2 / 1.3 (HTTPS enforced).
- Database hosted in the EU (Supabase, Frankfurt).
- Rate limiting, account lockout (10 failed attempts, then a 30 minute lock), and CSRF origin checks on all forms.
8. Cookies
See our Cookie Policy for full details. Strictly necessary cookies operate without consent; analytics cookies require your opt-in.
9. Complaints
If you are unhappy with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Irish supervisory authority:
Data Protection Commission (DPC)
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie
10. Changes to this policy
We may update this policy periodically. Material changes will be notified by email or a prominent in-app notice. The “Last updated” date at the top of this page reflects the most recent revision.