Legal

Privacy Policy

Last updated: 2026-10-27

FoodPlanAI is now OnMacros. Same service, same company.

OnMacros (“we”, “us”) operates the OnMacros application at app.foodplanai.app. This policy explains what personal data we collect, why, and your rights under the General Data Protection Regulation (GDPR).

The data controller is INNOSD LABS SRL, CUI 36529160, Str. Valea Chintaului nr. 48A ap. 1, 400647 Cluj-Napoca, Romania.

What we collect

We collect and process the following categories of personal data:

  • Account data — email address, name (optional), and the timestamp of account creation.
  • Health data (Article 9 special-category) — dietary intake (foods logged, meal entries, macro totals), body weight logs, macro targets, and allergen data you provide. These are considered special-category health data under GDPR Article 9 and are processed only on the basis of your explicit consent.
  • Chat and meal plan data — the conversation threads and AI-generated meal plans you create within the app.
  • Subscription and billing data — subscription status and purchase history (processed via RevenueCat and, for web payments, Stripe). We do not store raw card numbers.
  • Technical data — IP address, user agent, and session tokens used to operate and secure your account.

Legal basis for processing

We rely on two legal bases under the GDPR:

  • Explicit consent (Article 9(2)(a)) — for all special-category health data (dietary intake, body weight, allergen data). You provide this consent by checking the consent box at sign-up. You may withdraw your consent at any time by deleting your account.
  • Performance of contract (Article 6(1)(b)) — for account data and subscription data required to provide the service you requested.

You have the right to withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. To withdraw, delete your account (see “Account deletion” below).

Who processes your data

We use the following third-party data processors. Each receives only the data necessary for its function and is contractually bound to GDPR-compliant data handling:

  • Neon — database hosting. All user data (health data, account data, chat data) is stored in a Neon-managed Postgres instance.
  • RevenueCat — subscription management and billing events. RevenueCat receives your app user ID and subscription status to determine entitlement. See RevenueCat Privacy Policy.
  • Stripe — web payment processing. When you subscribe via the web, Stripe processes your card details. Stripe is PCI DSS Level 1 certified. See Stripe Privacy Policy.
  • Apple — Apple Sign-In (if used) and iOS App Store subscriptions. Apple processes your Apple ID and, where applicable, your subscription through the App Store. See Apple Privacy Policy.
  • Vercel AI Gateway— AI inference routing. Your chat messages and food queries are routed through Vercel's AI Gateway to AI model providers (which may include Google, OpenAI, and Anthropic) solely for the purpose of generating responses. No chat data is used to train external models. See Vercel Privacy Policy.
  • Resend — transactional email and magic-link delivery. Resend receives your email address to deliver authentication emails. See Resend Privacy Policy.
  • PostHog is our analytics and session recording processor, hosted in the EU. It receives product events, page views, performance timings, and error reports. A recording captures what is shown on the screen and what is typed into it, including chat text and food photos, except password fields which are never captured, and recordings are used to debug problems and answer support questions. EU visitors are asked to accept or decline before any recording starts, and anyone can opt out at any time by writing to hello@onmacros.com. Analytics data and recordings are never sold and never used for advertising. See PostHog Privacy Policy.

We do not sell your personal data to third parties.

Data retention

We retain your personal data for as long as your account is active. When you delete your account, all associated data is deleted immediately and irreversibly. We do not operate a soft-delete or recovery window.

Account deletion (Article 17 right to erasure)

You can delete your account and all associated data at any time:

  1. Tap your avatar in the top-left of the chat screen.
  2. Open the Advanced section.
  3. Tap Delete account and confirm.

Deletion is immediate and irreversible. It removes your account, all health data, chat history, meal plans, and weight logs from our database. If you signed in with Apple, your Apple Sign-In token is revoked at Apple's servers at the time of deletion.

Note: your email address may remain in our free-seat allowlist if you were granted a beta seat — this contains no health data and is used only to restore access if you create a new account.

Your rights

Under the GDPR you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Erase your data (exercised via account deletion above).
  • Restrict or object to processing.
  • Data portability.
  • Withdraw consent at any time (exercised via account deletion).
  • Lodge a complaint with your national supervisory authority.

To exercise any right other than erasure, contact us at the address below.

Data sources

The food catalog draws on public food composition databases. See Data sources for the full list and their licences.

Contact

For privacy questions or to exercise your rights, contact hello@onmacros.com.