Privacy Policy

This Privacy Policy explains how personal data is handled when you use the LazyMeals app, visit lazymeals.app or join the LazyMeals early-access list. It also explains your rights under the EU General Data Protection Regulation (GDPR) and how to use them.

LazyMeals is provided from Sweden, so the GDPR applies to how we handle your personal data wherever you live. If the law where you live gives you additional privacy rights, those rights also apply.

The same Privacy Policy applies in the app and on the website. If a translation differs from the English version, the English version applies, unless the law where you live requires otherwise.

Contents

1. Who is responsible for your data
2. Summary
3. Personal data we collect
4. Allergies, diets and other sensitive information
5. Household members, including children
6. How we use AI
7. Personalisation and memory
8. Why we use your data and our legal bases
9. Who can see your data inside LazyMeals
10. Service providers and other recipients
11. Transfers outside the EU/EEA
12. How long we keep your data
13. Subscriptions, downgrades and locked content
14. Deleting your account
15. Your rights under the GDPR
16. Children
17. Notifications and marketing
18. Cookies and similar technologies
19. Security
20. Changes to this policy
21. Contact and complaints

1. Who is responsible for your data

LazyMeals is provided by Bergie Consulting AB, a company registered in Sweden (organisation number 5593666141), Skeppsgatan 2A, 211 09 Malmö, Sweden. Bergie Consulting AB is the data controller for the personal data described in this policy, which means we decide why and how it is processed.

You can contact us about privacy and data protection at lazymeals-privacy@bergie.se.

2. Summary

• We use your data to provide LazyMeals: to create meal plans, recipes and grocery lists that fit you and your household.
• Some of the information you give us, such as allergies, intolerances and health or nutrition goals, can be sensitive. We only process it with your explicit consent, and you can remove it at any time.
• We use AI to create and adjust meal plans and recipes. Our AI service provider is OpenAI. AI only receives the information needed for the request you make.
• We do not sell your personal data, and we do not use it for third-party advertising.
• Downgrading or cancelling a subscription never deletes your data. Content above your plan’s limits is locked, not deleted.
• You can access, correct and delete your data, get a copy of it, and object to how we use it. See Your rights under the GDPR.

3. Personal data we collect

3.1 Data you give us in the app

• Account information: your name, email address, password (stored only in hashed form by our authentication provider, never in plain text) and your chosen app language.
• Preferences: dietary style, foods you like and dislike, foods you avoid, allergies and intolerances, cooking ability, cooking style, available cooking time, which meals you want planned, leftover preferences and health or nutrition goals.
• Meal planning content: meal plans, plan names and descriptions, portions, schedules, recipes you save, create, edit or share, notes, ratings and feedback, grocery lists and items, and what you tell us you already have at home.
• Cooking activity: cooking sessions, progress through recipe steps and timers, and your cooking history.
• AI conversations: requests and messages you send to the AI assistant in LazyMeals, and the responses.
• Household information: your household, its members and their roles, invitations, and information about household members without their own account (see section 5).
• Invitations and referrals: the email addresses of people you invite to your household or refer to LazyMeals, and the status of those invitations and referrals.
• Support and feedback: messages you send us, bug reports and anything you choose to include in them.

3.2 Data created when you use LazyMeals

• Memory and inferred preferences: information LazyMeals keeps to personalise future suggestions, including preferences learned from repeated choices (see section 7).
• Subscription and usage information: your plan, subscription status, billing period, scheduled plan changes, referral rewards and how much of your AI allowance you have used.
• Technical and diagnostic information: device type, operating system, app version, language settings, error and crash information, and logs needed to run and secure the service. If we use error-monitoring or usage-analytics tools in the app, they also record errors and which features are used (see section 10). We avoid including the content of your meal plans, preferences or conversations in diagnostic data unless it is needed to fix a specific problem.
• Notification information: a push notification token for your device and your notification settings.

3.3 Payment information

Payments are processed by Stripe. We do not receive or store your full card details. We store the identifiers we need to connect your LazyMeals account to Stripe (such as a customer ID and subscription ID), your plan, subscription status and billing dates. Stripe provides us with information about payments, invoices, refunds and failed payments.

3.4 Data we collect on the website and the early-access list

• Early-access list: your email address, the language you used, the page you signed up on, the referring website or campaign (if any), the version of the signup text you saw, and when you signed up and confirmed your email.
• Spam protection: a one-way hashed version of your IP address, used to limit repeated signup attempts. We cannot see your IP address from the hash. The form also uses Cloudflare Turnstile to check that a person, not a bot, is submitting it.
• Website statistics: we use Plausible Analytics, which counts visits without cookies and without collecting personal data or tracking you across websites.
• Hosting: our website host, Cloudflare, processes technical data such as IP addresses and request information to deliver and protect the website.

4. Allergies, diets and other sensitive information

Information about allergies, intolerances and health or nutrition goals can be health data. Dietary choices can sometimes reveal religious or philosophical beliefs. The GDPR treats this as special category data.

• Explicit consent: we only process this information when you choose to give it to us, based on your explicit consent. You can use LazyMeals without providing it, although your plans will then not take it into account.
• Purpose: we use it only to plan meals and suggest recipes that respect your restrictions, and to check suggestions against them.
• Never guessed: LazyMeals never infers allergies or intolerances from your behaviour. They are only stored when you or your household explicitly enter them.
• Withdrawing consent: you can edit or remove this information at any time in your preferences. Removing it withdraws your consent for future processing. It does not affect processing that happened before.

5. Household members, including children

LazyMeals lets a household owner add people who do not have their own LazyMeals account, such as children. For these people, the household can store a name, their relationship or type (for example “child”), dietary preferences, foods they like or avoid, and allergies and intolerances.

• Your responsibility: if you add information about another person, you confirm that you are allowed to do so, for example as a parent or guardian, and that the person (or their guardian) knows that you use LazyMeals to plan their meals. Only add what is needed to plan meals.
• Who can see it: this information belongs to the household. The household owner can edit it, and household members with their own account can view it.
• Removing it: the household owner can remove a person without an account at any time, which removes their household profile and the information stored about them.
• Joining later: if a person without an account is invited and creates their own LazyMeals account, the preferences stored for them by the household move into their own private account, where only they control them.
• Requests from that person: a person whose information has been added by a household can contact us to use their rights under the GDPR.

6. How we use AI

LazyMeals uses AI models to understand what you ask for, create and adjust meal plans and recipes, interpret free-text input such as what you already have at home, and answer questions in the AI assistant.

• Only what is needed: for each request, LazyMeals sends the AI model only the information needed to fulfil it. Depending on the request, this can include your request, the relevant meal plan and recipes, relevant dietary preferences and restrictions (including allergies and intolerances) of the people the plan is for, household context such as who is eating and how many portions are needed, relevant memories, saved recipes, grocery items and ratings. AI does not automatically receive all of your data.
• Allergies and restrictions: where relevant, explicit allergies, intolerances and dietary restrictions are included so that suggestions respect them. LazyMeals also checks results against these restrictions itself, rather than relying on the AI alone.
• OpenAI: AI requests are processed by OpenAI, our AI service provider, acting on our behalf as a processor. OpenAI may only use the information to provide its service to us. Under OpenAI’s terms for business customers, information sent through its API is not used to train its models. Our requests are set up so that OpenAI does not save them for later retrieval, although OpenAI may keep request data for a limited period to detect and prevent abuse, as described in its terms. See section 11 about where data may be processed.
• Recipe library: recipes that AI generates may, after review, be added to the LazyMeals recipe library and suggested to other users. They are shown to other users without any information that identifies you or your household.
• No decisions with legal effects: AI is used to make suggestions. It does not make decisions that have legal or similarly significant effects on you.
• Mistakes are possible: AI-generated content can contain mistakes. Always check ingredients, quantities and allergens before cooking. See our Terms & Conditions.

7. Personalisation and memory

LazyMeals personalises meal plans and suggestions using your preferences, memory and the way you use the app.

• Memory: LazyMeals can remember useful information for future plans, such as recurring preferences or something you explicitly ask it to remember. Not every conversation becomes memory.
• Learned preferences: LazyMeals may treat a soft preference as learned when it sees consistent signals over time, for example when you repeatedly replace a certain ingredient. Explicit preferences always take priority over learned ones, and learned signals never create allergies, intolerances or other safety restrictions.
• Your control: you can view, edit and delete memories and correct learned preferences in the app. You can also object to this kind of personalisation (see section 15).
• Aggregated recipe signals: ratings and recipe use can be combined across many users, in aggregated form, to improve which recipes LazyMeals suggests. Aggregated signals do not reveal what an individual user rated or chose.

8. Why we use your data and our legal bases

Where we rely on legitimate interests, we have balanced them against your interests and rights. You can object at any time (see section 15). If you do not provide the information needed to create an account, we cannot provide LazyMeals to you.

9. Who can see your data inside LazyMeals

Your personal data is private unless it is part of something you share.

• Private to you: your account information, personal preferences, memories, saved recipes, ratings, notes and cooking sessions. The household owner cannot access your private account information.
• Shared with your household: household membership, profiles of household members without an account, household preferences, shared household meal plans, the recipes inside those plans and shared grocery items.
• Used without being shown: when you are included in a household meal plan, your relevant preferences and restrictions are used to create it. Other members do not see your private preferences or memories, although they may notice their effect, for example that a plan avoids a certain ingredient.
• Recipes you share: if you share a recipe with another user, they can see it and save their own copy. Your private notes are not included unless you add them to the shared recipe.
• Notifications: notifications are written to show only what is needed, so that one person’s private information is not revealed to others.

10. Service providers and other recipients

We use service providers (processors) who process personal data on our behalf, under contracts that require them to protect it and only use it on our instructions:

• Supabase: hosting of our database, authentication (sign-in), file storage and server functions for the app and the early-access list.
• OpenAI: processing AI requests, as described in section 6.
• Expo, and Apple or Google: delivering push notifications to your device.
• Email delivery providers: sending account, service and early-access emails. Early-access emails are sent with Resend.
• Cloudflare: website hosting, security and spam protection (Cloudflare Turnstile).
• Plausible Analytics: cookieless website statistics.
• Error monitoring and usage analytics: if we use such providers in the app, they help us find and fix errors and understand how features are used, with as little personal data as possible. We will name them in this policy before we start using them.

Stripe processes payments. For some purposes, such as preventing fraud and meeting its legal obligations, Stripe acts as an independent controller under its own privacy policy.

We may also share personal data:

• with other users, as described in section 9;
• with authorities, courts or advisers when the law requires it or when needed to establish, exercise or defend legal claims;
• with a buyer or successor if all or part of our business is sold, merged or transferred. We would tell you in advance and the recipient would be bound by this policy.

We do not sell your personal data, and we do not share it with third parties for their own advertising.

11. Transfers outside the EU/EEA

Several of our service providers, including OpenAI, Supabase, Stripe, Cloudflare, Resend and Expo, are based in the United States or use sub-processors outside the EU/EEA. Your personal data may therefore be transferred to, or accessed from, countries outside the EU/EEA. When that happens, we make sure the transfer is protected by an adequacy decision from the European Commission (for example the EU-US Data Privacy Framework, for certified companies), or by the European Commission’s Standard Contractual Clauses together with additional safeguards where needed. Where a provider offers processing within the EU/EEA, we aim to use it where practical. You can contact us at lazymeals-privacy@bergie.se for more information or a copy of the relevant safeguards.

If you use LazyMeals from outside the EU/EEA, your personal data is transferred to us in Sweden and to our service providers as described in this policy.

12. How long we keep your data

We keep personal data only as long as it is needed for the purposes described in this policy:

• Account and app content: for as long as you have an account. This includes meal plans that are locked because of your plan, so that they can be unlocked if you upgrade.
• Content you delete: when you delete a meal plan, recipe, memory or other item, it is removed from your account. Copies that other users have saved, and plan-specific copies inside shared household plans, are not affected.
• After account deletion: we delete or anonymise your personal data, except where we must keep it by law. Residual copies in backups are deleted as the backups are replaced in the normal backup cycle.
• Accounting records: records of payments and invoices are kept for as long as Swedish accounting law requires, currently seven years after the end of the financial year.
• AI conversations: kept as long as needed to provide the feature and to understand follow-up requests, unless saved as memory or deleted earlier.
• Diagnostic data and logs: kept for a limited period, only as long as needed to run, secure and improve the service, and not kept indefinitely.
• Support requests: kept as long as needed to handle your request and for a reasonable period afterwards in case of follow-up questions or legal claims.
• Early-access list: until you unsubscribe, or until the early-access offer has ended if you do not become a LazyMeals user.
• Hashed IP addresses from the signup form: deleted once they are more than 24 hours old, whenever the signup form is used.

13. Subscriptions, downgrades and locked content

Changing your plan changes what you can access, not what we store.

• When you upgrade, your new plan applies once the payment is confirmed, and previously locked meal plans become available again within the new plan’s limits.
• When you downgrade, your current plan and all its features stay active until the end of the current billing period. The new plan applies from the start of the next billing period.
• When a downgrade takes effect, or a cancelled subscription ends, meal plans above the new plan’s limit are locked, not deleted. For example, when moving from Unlimited to Premium, your five most recent meal plans stay active and older plans are locked.
• Saved recipes, preferences, memories, ratings, cooking history and household membership are kept when you change plans.

14. Deleting your account

You can delete your account in the app. Account deletion is permanent, and the app tells you what will happen before you confirm.

• Active subscription: if you have an active paid subscription, it is cancelled through Stripe before your account is deleted, so that no future payments are taken. If the cancellation cannot be confirmed, your account is not deleted and nothing is partially deleted. You can then try again or contact us.
• Household owner: if you own a household, deleting your account closes the household. Other members keep their own accounts and personal data, but lose access to the household’s shared meal plans, shared grocery list and other shared content. Pending invitations are cancelled.
• Household member: if you are a member of someone else’s household, you are removed from it. Shared household plans may keep the information needed to remain valid, without exposing your deleted personal data.
• Shared recipes: recipes that other users have already saved remain available to them as their own copies.

Deleting the app from your device does not delete your account.

15. Your rights under the GDPR

You have the following rights. Some of them can be used directly in the app. You can always use them by contacting us at lazymeals-privacy@bergie.se.

• Access: you can ask for confirmation of whether we process your data and for a copy of it.
• Rectification: you can correct inaccurate data, and complete incomplete data. Most information can be edited directly in the app.
• Erasure: you can ask us to delete your data, or delete your account in the app.
• Restriction: you can ask us to limit how we use your data, for example while we check a request.
• Data portability: you can ask us to provide the data you have given us in a structured, commonly used and machine-readable format, and to have it sent to another provider where technically feasible. An export will never include another household member’s private data.
• Objection: you can object to processing based on our legitimate interests, including personalisation through learned preferences. You can always object to direct marketing.
• Withdrawing consent: where we rely on your consent, you can withdraw it at any time, for example by removing allergy information, turning off marketing notifications or unsubscribing from emails. This does not affect processing before the withdrawal.
• Complaints: you can complain to a data protection authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se). In Denmark it is Datatilsynet (datatilsynet.dk). You can also complain to the authority where you live or work. We would appreciate the chance to help first.

Wherever you live, you can use these rights in the same way. Any additional rights you have under the law where you live are not affected.

We respond within one month. If a request is complex, we may extend this by up to two further months and will tell you why. We may need to verify your identity before acting on a request. Requests are free of charge unless they are manifestly unfounded or excessive.

16. Children

You must be at least 18 years old to create a LazyMeals account. LazyMeals is not directed at children, and we do not knowingly allow children to create accounts.

A household owner can add children as household members without an account, as described in section 5. This is done by the parent or guardian, who is responsible for the information entered and can remove it at any time. If you believe a child has created an account, please contact us and we will delete it.

17. Notifications and marketing

• Service messages: we send messages that are needed to provide LazyMeals, such as email verification, security messages, billing and payment messages, and notices about changes to our terms. Some of these cannot be turned off while you have an account, because they are needed for the service or required by law.
• Functional notifications: notifications such as cooking timers, completed meal plans and household invitations can be turned on or off in the app and in your device settings.
• Product news and marketing: we only send these if you have agreed to receive them. You can turn them off at any time in the app or with the unsubscribe link in our emails.
• Early-access emails: we only email you about the launch and your offer after you confirm your signup. Every email has an unsubscribe link.

18. Cookies and similar technologies

Our website does not use cookies for analytics or advertising. The app stores some information on your device that is needed for it to work, such as your sign-in session and settings. Read more in our Cookie Policy.

19. Security

We protect personal data with technical and organisational measures, including:

• encryption in transit (HTTPS/TLS);
• database access rules that stop users from reading or changing other users’ data;
• keeping secret keys and payment credentials on the server, never in the app;
• sending service providers only the information they need;
• keeping private household information out of notifications, logs, analytics and error reports wherever possible;
• limiting access to personal data to people who need it for their work.

No system is completely secure. If a personal data breach is likely to result in a risk to your rights, we will notify the relevant authority and, where required, you.

20. Changes to this policy

We may update this policy when LazyMeals or the law changes. The date and version at the top show when it was last updated. If we make significant changes, we will tell you in the app or by email before they take effect. If a change requires your consent, we will ask for it.

21. Contact and complaints

Bergie Consulting AB
Skeppsgatan 2A
211 09 Malmö
Sweden
Organisation number: 5593666141
Privacy and data protection: lazymeals-privacy@bergie.se
Other questions: lazymeals@bergie.se

If you are not satisfied with how we handle your personal data, you can complain to IMY in Sweden, Datatilsynet in Denmark, or the data protection authority where you live.