Privacy Policy

Account Information

• •Email address
• •Name and profile information
• •Height, weight, age, gender (for nutrition calculations)
• •Dietary preferences and restrictions

Usage Data

• •Meal logs and nutrition tracking data
• •Receipt images and barcode scans
• •Food items in your pantry
• •Nutrition tracking history
• •Exercise logs and activity data
• •Body composition measurements (body fat percentage, lean mass)
• •Accuracy calibration data
• •Device information and app usage patterns

Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers. Stripe's privacy policy applies to payment data.

• •
  Household Members: Other members in your household can see shared meals and household statistics
• •
  Service Providers: We work with trusted third-party service providers who help us operate the Service:

  • • Stripe - Payment processing
  • • Vercel - Website hosting and CDN
  • • Railway - Backend infrastructure and database hosting
  • • Mistral - Receipt OCR processing and upload parsing
  • • AWS S3 - Storage for receipt scans and pantry data (EU region)
  • • Google Analytics - Usage analytics (with your consent)
  • • Microsoft Clarity - Behavior analytics (with your consent)
  • • Meta (Facebook) - Advertising analytics (with your consent)
  • • Intercom - Customer support chat (with your consent)
• •
  Legal Requirements: When required by law or to protect our rights
• •
  Business Transfer: If we merge or sell the company, your data may transfer to the new entity

How We Use Anonymized Data

Eatomate generates anonymized aggregate statistics from the data you provide through normal use of the Service. Under GDPR, truly anonymized data is not personal data — it cannot be linked back to any individual. This section explains what anonymized data we produce and how it may be used.

5.1 Receipt Processing

When you upload a receipt image, our AI systems extract: product names, quantities, prices, store name, and store location information (which may include street address, locality, city, county, postcode, and country as printed on the receipt). Individual receipt images are automatically deleted after 30 days.

The extracted data follows two separate processing flows:

• •
  Your Account (personal data): Product names, quantities, and store locality/borough only are stored against your account for pantry management, nutrition tracking, and reconciliation. Street address, postcode, and raw address lines are immediately discarded from your record after processing. We do not collect your home address — your user profile contains only city and country.
• •
  Pricing Intelligence (de-identified): Individual SKU-level price observations (store name, store location, product, price, date) are stored in a separate de-identified dataset with no user ID, no receipt ID, and no item combinations. Each product is recorded as an independent price observation. These records cannot be traced to any individual user — they are equivalent to a price observation anyone could make by visiting the store.

5.2 Health, Nutrition, and Economic Aggregates

Anonymized aggregate statistics may be derived from nutrition patterns (meal logs), purchasing patterns (receipt data), exercise data, body composition trends, and combinations thereof — for example, aggregate nutritional economics such as average cost per gram of protein by demographic group. These aggregates contain only population-level statistics (e.g., averages, medians, percentages) — never individual records. Individual per-person metrics are computed at query time from your account data and are never stored separately; only the aggregate result (across 5 or more users) is produced. The aggregate dimensions include:

• –Geography: Locality/borough level (derived from receipt store locations, not user home addresses)
• –Age: 5-year age bands (e.g., 25–29, 30–34) — exact age is never included
• –Gender, dietary pattern, activity level, time period

Your exact weight, height, age, and body composition measurements are never exported into aggregate datasets. Only banded categories and population-level statistics are used.

5.3 Privacy Protections

• •
  K-Anonymity Protection: No aggregate statistic derived from user data is ever based on fewer than 5 users. This threshold applies across all dimensions — geographic, demographic, temporal, or any combination. If a query would produce results from fewer than 5 users, that result is suppressed entirely. De-identified pricing intelligence (Section 5.1) is not subject to this threshold as it contains no user identifiers.
• •
  No Personal Information: Aggregated outputs and de-identified pricing data contain no personally identifiable information — no names, email addresses, individual transactions, payment details, or individual-level records.
• •
  Commercial Use: De-identified pricing intelligence and anonymized aggregate statistics may be used for commercial research, public health intelligence, academic research partnerships, and data licensing. These outputs cannot be traced to any individual user.
• •
  Legal Basis: The processing of your personal data to produce anonymized aggregates is carried out under our legitimate interest (GDPR Article 6(1)(f)) in generating population-level insights. We have conducted a Legitimate Interest Assessment confirming that this processing does not override your rights and freedoms, given that only aggregate statistics are produced, no individual data is ever exposed, and k-anonymity protections are enforced. You retain the right to object to this processing under Article 21 by contacting support@eatomate.co.uk; however, we may continue processing where we demonstrate compelling legitimate grounds.
• •
  Indefinite Retention: While individual receipt images are deleted after 30 days and raw store addresses are immediately discarded from user records, de-identified pricing data and anonymized aggregate statistics are retained indefinitely.

Cookie Categories