Legal

Privacy Policy

Last updated: 15 May 2025

EatoBiotics(“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have over it. It applies to all users of the EatoBiotics website and application (“the Service”).

We are based in the Republic of Ireland and this policy is written in compliance with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988–2018.

1. Who we are

The data controller for your personal data is EatoBiotics, operating the website and application at eatobiotics.com. If you have any questions about how we handle your data, you can contact us at hello@eatobiotics.com.

2. What data we collect

We collect the following categories of personal data:

Account dataYour name, email address, and age bracket, provided when you create an account or complete the gut health assessment.

Dietary dataMeal descriptions and food photographs you submit for analysis. This is used to generate your Biotics scores and weekly reports.

Health & lifestyle dataYour gut health assessment responses including scores for diversity, feeding, consistency, and general wellbeing. We treat this as sensitive personal data and handle it with additional care.

Payment dataSubscription and payment information processed by Stripe. We do not store your card details — Stripe handles payment processing and is PCI-DSS compliant.

Usage dataHow you interact with the Service — pages visited, features used, and session information — collected through analytics tools.

CommunicationsAny messages you send us directly, including support requests or feedback.

3. Why we collect it (legal basis)

We process your data on the following legal bases:

Contract performanceTo provide the Service you sign up for — including meal analysis, Biotics scoring, weekly reports, and AI consultation.

Legitimate interestsTo improve the Service, prevent fraud, maintain security, and send you service-related communications.

ConsentFor marketing emails and non-essential cookies. You can withdraw consent at any time.

Legal obligationTo comply with financial regulations and respond to lawful requests from authorities.

4. How we use your data

Specifically, we use your data to:

Create and manage your account
Analyse your meals and calculate your Biotics scores (Prebiotic, Probiotic, Postbiotic)
Generate personalised weekly food system reports
Power AI consultation features that answer questions about your food data
Send you weekly report notifications and account-related emails
Process your subscription payments
Improve and develop the Service based on usage patterns
Comply with legal and regulatory requirements

5. Third parties we share data with

We do not sell your personal data. We share it only with the following trusted service providers, under strict data processing agreements:

SupabaseOur database and authentication provider. Your account data, scores, and meal records are stored on Supabase servers hosted in the EU.

Anthropic (Claude AI)We send meal descriptions and report context to Anthropic's Claude API to generate analysis and personalised recommendations. Data sent is limited to what is necessary for the analysis. Anthropic's data usage policy applies.

StripeOur payment processor. Handles all subscription billing. Subject to Stripe's own Privacy Policy.

ResendOur email delivery provider. Used to send account, report, and notification emails.

VercelOur hosting provider. The application runs on Vercel's infrastructure.

6. How long we keep your data

We retain your data for as long as your account is active or as needed to provide the Service. Specifically:

Account & health dataRetained while your account is active. Deleted within 30 days of a verified account deletion request.

Payment recordsRetained for 7 years to comply with financial and tax regulations, even after account deletion.

Usage/analytics dataRetained in anonymised or aggregated form for up to 2 years.

BackupsDatabase backups are retained for up to 30 days, after which deleted records are fully purged.

7. Your rights under GDPR

As a user in the EU/EEA, you have the following rights:

AccessRequest a copy of all personal data we hold about you. You can also download this directly from your account dashboard.

RectificationAsk us to correct inaccurate or incomplete data.

ErasureAsk us to delete your data. You can do this directly in your account under My Account → Delete Account.

PortabilityReceive your data in a machine-readable format (JSON). Available directly from your account dashboard.

RestrictionAsk us to stop processing your data in certain circumstances.

ObjectObject to processing based on legitimate interests.

Withdraw consentWhere we rely on consent, you can withdraw it at any time without affecting prior processing.

To exercise any of these rights, email us at hello@eatobiotics.com. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie.

8. Cookies

We use the following types of cookies:

Essential cookiesRequired for authentication and to keep you logged in. Cannot be disabled.

Analytics cookiesUsed to understand how the Service is used. Only placed with your consent.

You can manage cookie preferences in your browser settings at any time.

9. Data security

We take security seriously. Your data is stored in encrypted databases, transmitted over HTTPS, and access is restricted to authorised systems only. We use row-level security in our database so that your data is only accessible to you and to the service processes acting on your behalf. In the event of a data breach, we will notify affected users and the relevant supervisory authority as required by GDPR.

10. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “last updated” date at the top of this page and, where the changes are material, notify you by email. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

12. Contact us

For any privacy-related questions or requests, contact us at: hello@eatobiotics.com