EatoBiotics(“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have over it. It applies to all users of the EatoBiotics website and application (“the Service”).
We are based in the Republic of Ireland and this policy is written in compliance with the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988–2018.
1. Who we are
The data controller for your personal data is EatoBiotics, operating the website and application at eatobiotics.com. If you have any questions about how we handle your data, you can contact us at hello@eatobiotics.com.
2. What data we collect
We collect the following categories of personal data:
Account dataYour name, email address, and age bracket, provided when you create an account or complete the gut health assessment.
Dietary dataMeal descriptions and food photographs you submit for analysis. This is used to generate your Biotics scores and weekly reports.
Health & lifestyle dataYour gut health assessment responses including scores for diversity, feeding, consistency, and general wellbeing. We treat this as sensitive personal data and handle it with additional care.
Payment dataPayment information for the one-time €49 Food System Report, and for an optional membership if you take one, processed by Stripe. We do not store your card details — Stripe handles payment processing and is PCI-DSS compliant.
Usage dataHow you interact with the Service — pages visited, features used, and session information — collected through analytics tools.
CommunicationsAny messages you send us directly, including support requests or feedback.
3. Why we collect it (legal basis)
We process your data on the following legal bases:
Contract performanceTo provide the Service you sign up for — including meal analysis, Biotics scoring, weekly reports, and AI consultation.
Legitimate interestsTo improve the Service, prevent fraud, maintain security, and send you service-related communications.
ConsentFor processing your health and lifestyle answers, for marketing emails, and for non-essential cookies. We ask before any assessment and record what you agreed to and when. You can withdraw consent at any time — for cookies from the footer, and for everything else by deleting your data from your account or emailing us.
Legal obligationTo comply with financial regulations and respond to lawful requests from authorities.
4. How we use your data
Specifically, we use your data to:
- Create and manage your account
- Analyse your meals and calculate your Biotics scores (Prebiotic, Probiotic, Postbiotic)
- Generate personalised weekly food system reports
- Power AI consultation features that answer questions about your food data
- Send you weekly report notifications and account-related emails
- Take payment for your Food System Report, and for an optional membership if you take one
- Improve and develop the Service based on usage patterns
- Comply with legal and regulatory requirements
5. Third parties we share data with
We do not sell your personal data. We share it only with the following trusted service providers, under strict data processing agreements:
SupabaseOur database and authentication provider. Your account data, scores, and meal records are stored on Supabase servers hosted in the EU.
Anthropic (Claude AI)We send meal descriptions and report context to Anthropic's Claude API to generate analysis and personalised recommendations. Data sent is limited to what is necessary for the analysis. Anthropic's data usage policy applies.
OpenAIUsed only by the Plate Builder, to generate recipes and recipe images from the ingredients you choose. Your assessment answers and reports are not sent to OpenAI.
StripeOur payment processor, for the one-time report purchase and for any membership billing. We never receive your card details. Your assessment answers, scores and profile are not sent to Stripe: the checkout session carries only a random reference to the results we hold ourselves, the product you bought, and the time you asked us to start. Earlier versions did send your score, sub-scores, profile and email to Stripe; that has been removed.
ResendOur email delivery provider. Used to send account, report, and notification emails.
VercelOur hosting provider. The application runs on Vercel's infrastructure, and Vercel Analytics records anonymous page-view statistics when you accept analytics cookies.
PostHogProduct analytics, hosted in the EU. Records how the Service is used. Only loaded if you accept analytics cookies; form inputs are masked.
StatsigFeature flags and product analytics. Only loaded if you accept analytics cookies; when loaded while you are signed in it receives your user ID and email address.
6. How long we keep your data
We retain your data for as long as your account is active or as needed to provide the Service. Specifically:
Account & health dataRetained while your account is active. Deleted within 30 days of a verified account deletion request.
Payment recordsRetained for 7 years to comply with financial and tax regulations, even after account deletion.
Usage/analytics dataRetained in anonymised or aggregated form for up to 2 years.
BackupsDatabase backups are retained for up to 30 days, after which deleted records are fully purged.
7. Your rights under GDPR
As a user in the EU/EEA, you have the following rights:
AccessRequest a copy of all personal data we hold about you. You can also download this directly from your account dashboard.
RectificationAsk us to correct inaccurate or incomplete data.
ErasureAsk us to delete your data. You can do this directly in your account under My Account → Delete Account. This removes your profile, your assessments and leads, your paid reports and their PDF files, your meal, journal, plate, stability and GLP-1 records, and your entry in our email log. If any part of it fails, we stop and keep your account open rather than leaving data behind with no owner. Payment records are kept — see section 6.
PortabilityReceive your data in a machine-readable format (JSON), including your paid reports. Available directly from your account dashboard.
RestrictionAsk us to stop processing your data in certain circumstances.
ObjectObject to processing based on legitimate interests.
Withdraw consentWhere we rely on consent, you can withdraw it at any time without affecting prior processing.
To exercise any of these rights, email us at hello@eatobiotics.com. We will respond within 30 days. You also have the right to lodge a complaint with the Data Protection Commission (Ireland) at dataprotection.ie.
8. Cookies
We use the following types of cookies:
Essential cookiesRequired for authentication and to keep you logged in. Cannot be disabled.
Analytics cookiesUsed to understand how the Service is used. Only placed with your consent.
You can change your choice at any time using the Cookie preferences link in the footer of every page. Choosing “Essential only” reloads the page so that anything already running stops. Analytics tools are not loaded at all until you accept.
9. Data security
We take security seriously. Your data is stored in encrypted databases, transmitted over HTTPS, and access is restricted to authorised systems only. We use row-level security in our database so that your data is only accessible to you and to the service processes acting on your behalf. In the event of a data breach, we will notify affected users and the relevant supervisory authority as required by GDPR.
10. Children
The Service is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will update the “last updated” date at the top of this page and, where the changes are material, notify you by email. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.