MealumLegal
Privacy Policy
Last updated: 26 October 2026
№01
About this privacy policy
This Privacy Policy explains how Mealum collects, uses, stores, shares and protects personal data when you use the Mealum mobile application, website and related services (collectively, the “Services”).
Mealum provides personalized meal planning, recipe discovery and management, grocery shopping lists, budget planning, and calorie and nutrition tracking.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Polish data protection laws and other relevant legislation.
№02
Data controller
The data controller responsible for processing your personal data is:
Oleksandr Yashchuk, sole proprietor; NIP: 6793258161; REGON: 524238339; ul. Na Zjeździe 11/5, 30-527 Kraków, Poland.
Email: contact@mealum.app
You may contact us at this address for privacy-related questions or to exercise your data protection rights.
№03
Information we collect and why
We process personal data for the following purposes and on the corresponding legal bases:
– Account creation and management: email address, user ID, authentication identifiers and account settings (performance of a contract — Art. 6(1)(b) GDPR);
– Personalized meal planning: household size, food preferences, dietary restrictions, meal selections, kitchen equipment and budget settings (performance of a contract — Art. 6(1)(b), with an additional Art. 9 condition where special-category data is processed);
– Recipe management: user-created and imported recipes, source URLs, ingredients, instructions and saved recipes (performance of a contract — Art. 6(1)(b));
– Shopping lists and budgeting: selected recipes, ingredient quantities, shopping lists, preferred stores and grocery budgets (performance of a contract — Art. 6(1)(b));
– Nutrition tracking: food photographs, meal descriptions, estimated calories and macronutrients, and saved nutrition diary entries (performance of a contract — Art. 6(1)(b), with an additional Art. 9 condition where applicable);
– Subscription management: subscription identifiers, purchase status, product identifiers and transaction information (performance of a contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c), where applicable);
– Customer support: email address, correspondence and information included in support requests (performance of a contract — Art. 6(1)(b), or legitimate interests — Art. 6(1)(f), depending on the request);
– Security and troubleshooting: IP address, operating system, technical identifiers, error reports and security logs (legitimate interests — Art. 6(1)(f));
– Analytics and attribution: usage events, session information, device identifiers and interaction data (consent — Art. 6(1)(a), where required; otherwise an applicable lawful basis);
– Marketing emails and launch notifications: email address and communication preferences (consent — Art. 6(1)(a), where required);
– Legal compliance: accounting, transaction and other legally required records (legal obligation — Art. 6(1)(c)).
We may also collect technical information about application screens visited, session duration, application performance and interactions with available features.
Information required for account creation or essential functionality must be provided to use the relevant feature. Optional marketing communications and non-essential tracking are not required to use the core Services.
№04
Dietary preferences and health-related data
Mealum allows users to personalize meal plans using information such as:
– food preferences and restrictions;
– allergies and food intolerances;
– excluded ingredients;
– dietary choices and requirements;
– calorie and nutrition goals;
– household composition and meal preferences.
Certain information, particularly allergies, medical dietary restrictions and health-related goals, may constitute special-category personal data under Article 9 GDPR.
Where such information qualifies as special-category data, we rely on an applicable Article 6 legal basis and explicit consent under Article 9(2)(a) GDPR.
Explicit consent is requested separately during onboarding before the relevant health-related information is processed. Consent is provided through a clear affirmative action and is not assumed from general acceptance of the Terms & Conditions.
You may withdraw consent at any time by contacting contact@mealum.app or through available privacy controls within the application.
Withdrawal does not affect processing lawfully carried out before consent was withdrawn. Features requiring the relevant information may become unavailable following withdrawal.
Mealum provides meal-planning and nutrition-related tools and does not provide medical diagnosis, treatment or professional medical advice.
№05
Food photographs and AI nutrition analysis
Mealum allows users to take or upload food photographs and enter meal descriptions to receive AI-assisted estimates of nutritional content.
Information processed: depending on the feature, we may process food photographs submitted by users, written descriptions of meals, ingredient and portion information, estimated calories, protein, fat and carbohydrates, and nutrition diary entries saved to the user's account.
AI processing: when you request nutritional analysis, the submitted photograph or meal description, together with information necessary to process the request, may be transmitted to an external AI provider. The information is processed to generate the requested nutritional estimate and return the result to Mealum. AI-generated nutritional information is approximate and may differ from actual nutritional values.
Use of photographs: food photographs are submitted for the purpose of providing the requested nutrition-analysis functionality. Any use of submitted photographs or related information by an external AI provider for model training, service improvement or independent purposes is governed by the applicable provider arrangements and data-processing terms. Mealum applies appropriate contractual and data protection safeguards to processing performed on its behalf.
Photo storage and deletion: food photographs and associated information are retained only where necessary to provide the requested functionality, maintain saved nutrition diary entries or comply with applicable legal obligations. Users may request deletion of their personal data, including food photographs and associated nutrition records, by contacting contact@mealum.app or using available application controls. Where photographs are processed by external providers, their handling and deletion are subject to the applicable contractual arrangements.
Photo metadata: uploaded photographs may contain metadata, including device information or location information. Mealum does not use embedded photo-location metadata for advertising or profiling. Metadata that is not necessary for the requested functionality should be excluded from processing or removed where supported by the application's technical implementation.
№06
User recipes, imported recipes and AI-generated meal plans
Mealum allows users to create recipes manually, import recipes from supported websites and social media links, save recipes and use them in personalized meal plans.
Recipe-related information may include: recipe names and descriptions; ingredients and quantities; cooking instructions; recipe source URLs; recipe images or image references; nutritional information; and saved meal plans and selected dishes.
This information is processed to provide recipe management, meal planning, recipe replacement, shopping-list generation and related functionality.
Account-related recipes and meal plans are intended for use within the user's account and are not made publicly available merely because they are saved in Mealum.
Authorized service providers may process relevant information where necessary to operate the Services, subject to applicable data protection requirements.
Saved recipes and meal plans are retained as necessary for account functionality and in accordance with the retention provisions of this Policy.
Users may delete content through available application controls or request deletion of their personal data by contacting contact@mealum.app.
№07
Spoonacular recipe and nutrition data
Mealum uses the Spoonacular Food API to support recipe discovery and provide recipe-related information.
Spoonacular may supply information including: recipe titles and descriptions; ingredients and quantities; cooking instructions; recipe images or image references; nutritional estimates; and dietary classifications and recipe-related metadata.
When Mealum requests recipe information from Spoonacular, relevant search parameters may include selected ingredients, dietary preferences, exclusions and other information necessary to retrieve suitable recipes.
We seek to limit the information shared with Spoonacular to what is necessary for the requested functionality.
Recipe and nutritional information provided by Spoonacular may be subject to its terms, licensing restrictions and data-processing practices.
Spoonacular Food API: https://spoonacular.com/food-api
№08
Location and regional personalization
Mealum may use country or region information to provide appropriate language options, local grocery-store selections and region-specific functionality.
Regional information may be derived from account preferences, device settings, network information or location services where enabled.
Where precise device location is requested, the relevant permission is managed through the operating system.
Location-related information is processed only for disclosed purposes and under an applicable legal basis.
№09
Subscriptions and payments
Mealum offers subscription-based functionality through supported app stores. Subscription payments are processed by the relevant app-store payment systems.
We may receive information necessary to verify and manage subscriptions, including: subscription status; product identifiers; purchase and transaction identifiers; renewal and expiration dates; and cancellation information.
We use Adapty to support subscription management and entitlement verification.
Mealum does not receive complete payment-card details from purchases processed through Apple or Google.
Apple, Google and Adapty may process relevant information under their applicable privacy policies and contractual arrangements.
№11
Third-party services and data recipients
Mealum uses third-party services to provide and support its functionality. These include:
– Google Play Services (Android application services and platform functionality);
– Amplitude (product analytics and usage analysis);
– Adjust (mobile attribution and marketing measurement);
– Adapty (subscription management and purchase verification);
– AppsFlyer (mobile attribution and marketing analytics);
– Spoonacular (recipe discovery, ingredients and nutritional information);
– AI service providers (AI-assisted food analysis and related functionality);
– hosting and infrastructure providers (application operation and data storage);
– authentication providers (user registration and account access);
– email providers (customer support, notifications and marketing communications).
These providers may receive personal data necessary to perform their services, including technical identifiers, usage information, account-related information or feature-specific inputs.
Some providers act as processors on our behalf, while others may act as independent controllers for particular processing activities.
Where required, we enter into appropriate data-processing agreements and apply relevant data protection safeguards.
We may disclose personal data where necessary to comply with legal obligations, respond to lawful requests, investigate fraud, protect the security of the Services or establish, exercise or defend legal claims.
№12
International data transfers
Mealum is operated from Poland, within the European Union.
Some third-party providers may process personal data outside the European Economic Area (EEA), including in the United States.
Where personal data is transferred outside the EEA, we rely on appropriate safeguards as required by GDPR. These may include: adequacy decisions adopted by the European Commission; the EU–US Data Privacy Framework, where the recipient is eligible and certified; and Standard Contractual Clauses approved by the European Commission, together with supplementary measures where necessary.
The applicable transfer mechanism depends on the provider, destination and processing arrangement.
You may contact contact@mealum.app for information about relevant international transfer safeguards.
№13
Data retention
We retain personal data only for as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by applicable law. Our general retention framework is:
– account information and user-provided data: during use of the Services and, where necessary, for up to 12 months afterward, unless earlier deletion applies;
– dietary preferences and saved meal plans: while needed for account functionality, subject to deletion requests and applicable retention rules;
– saved and imported recipes: while retained for the user's account, subject to deletion and applicable legal requirements;
– food photographs and nutrition diary information: while needed for the requested functionality or saved diary, subject to applicable provider arrangements and deletion rules;
– automatically collected technical information: up to 24 months, unless a different period is necessary or legally required;
– analytics and attribution information: according to the applicable provider settings and retention requirements;
– marketing and waitlist information: until consent is withdrawn or the relevant purpose and retention period end;
– support correspondence: as long as necessary to handle the request and any related legal obligations;
– accounting and transaction records: for the period required by applicable law;
– anonymized information: may be retained longer where individuals can no longer be identified.
Where a user exercises a valid right to erasure, personal data will be deleted unless an applicable legal exception permits or requires continued retention.
№14
Account and data deletion
Users may request deletion of their Mealum account and associated personal data.
Account-deletion instructions are provided through the Mealum Support page and available application functionality.
You may also request deletion by contacting contact@mealum.app.
We may need to verify your identity before completing a deletion request. We will process requests within the time limits established by applicable data protection law.
Uninstalling the application does not automatically delete previously stored account information.
Deleting a Mealum account does not automatically cancel a subscription managed by Apple or Google. Subscriptions must be canceled through the relevant app store.
№15
Your rights under GDPR
Subject to applicable legal conditions, you have the following rights:
– Right of access: request information about the personal data we process and obtain a copy;
– Right to rectification: request correction of inaccurate or incomplete personal data;
– Right to erasure: request deletion of personal data where applicable;
– Right to restriction: request that processing be restricted in certain circumstances;
– Right to data portability: receive eligible personal data in a structured, commonly used and machine-readable format;
– Right to object: object to certain processing, including processing based on legitimate interests;
– Right to withdraw consent: withdraw consent at any time where processing is based on consent;
– Rights concerning automated decision-making: exercise applicable rights regarding solely automated decisions producing legal or similarly significant effects.
To exercise your rights, contact contact@mealum.app. We generally respond within one month, subject to extensions permitted by applicable law.
You also have the right to lodge a complaint with a competent data protection supervisory authority. In Poland, the supervisory authority is the Prezes Urzędu Ochrony Danych Osobowych (Prezes UODO), https://uodo.gov.pl.
You may also contact the competent supervisory authority in another EU/EEA country where you habitually reside, work or where an alleged infringement occurred.
№16
Communications and marketing
We may send service-related communications necessary for account management, subscription administration, security or important operational notices.
Where permitted by law, we may also send marketing communications and launch notifications. Where consent is required, we obtain it before sending promotional messages.
You may withdraw marketing consent at any time through an unsubscribe mechanism or by contacting contact@mealum.app.
Withdrawing marketing consent does not prevent us from sending essential service communications.
№17
Children
Mealum is not intended for children under 16 years of age.
We do not knowingly solicit personal data from children under 16 or market the Services specifically to them.
Where applicable law requires parental or guardian authorization, such authorization must be obtained before processing the relevant personal data.
If we discover that personal data has been collected from a child in violation of applicable law, we will take appropriate steps to delete the information or otherwise address the situation.
Parents or guardians may contact contact@mealum.app regarding privacy concerns.
№18
Data security
We use appropriate technical and organizational measures designed to protect personal data from unauthorized access, loss, alteration, disclosure or destruction.
These measures include safeguards appropriate to the nature of the information and the risks associated with processing. However, no electronic storage or transmission system can be guaranteed to be completely secure.
№19
Personal data breaches
If a personal data breach occurs, we will assess the incident and take appropriate action under applicable law.
Where required by GDPR, we will notify the relevant supervisory authority and affected individuals within the applicable legal requirements and timeframes.
Notifications will include relevant information about the nature of the incident and the measures taken or proposed to address it.
№20
Additional information for California residents
California residents may have additional privacy rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), where those laws apply.
These may include rights to: know what personal information is collected and disclosed; access personal information; request correction or deletion; opt out of qualifying sales or sharing of personal information; and exercise applicable privacy rights without unlawful discrimination.
To submit a privacy request, contact contact@mealum.app.
№21
Changes to this privacy policy
We may update this Privacy Policy to reflect changes in our Services, data-processing activities or legal requirements.
When changes are made, we will update the effective date at the beginning of this Policy. Where required by law, we will provide additional notice or obtain consent before implementing material changes.
Previous versions may be requested by contacting us.
№22
Contact us
For questions about this Privacy Policy or the processing of your personal data, contact:
Oleksandr Yashchuk, sole proprietor; NIP: 6793258161; REGON: 524238339; ul. Na Zjeździe 11/5, 30-527 Kraków, Poland.
Email: contact@mealum.app