Privacy notice

Effective: 22 August 2026

This notice explains how Wotaso GmbH processes personal data when you use the VegPlan app, vegplan.app, and related services. VegPlan can generally be used without a name or email account by means of a random, pseudonymous installation identifier.

1. Controller

Wotaso GmbH
Bostonring 5
71686 Remseck am Neckar
Germany
Email: [email protected]

No data protection officer has currently been appointed. You can send any privacy request directly to the email address above.

2. Data categories

• Technical identifiers: random installation and user IDs, hashed session tokens, app version, language, security and connection data.
• Planning data: diet, household size, meal times, budget, cooking time, appliances, likes, dislikes, shopping region and selected shops.
• Optional health-related data: allergies, intolerances, health-related goals and, where provided, approximate height and weight for portions.
• Content: meal plans, recipes, shopping lists, pantry data, ratings, recipe feedback and plan-assistant requests.
• Optional media: audio for transcription, private food photos, voluntarily submitted community content and push tokens.
• Purchase data: pseudonymous store customer ID, product, transaction and entitlement status. We do not receive full payment details.

3. Purposes and legal bases

• Providing, personalising and synchronising requested plans and handling support under Article 6(1)(b) GDPR.
• Managing subscriptions under Article 6(1)(b), and statutory records under Article 6(1)(c) GDPR where applicable.
• Security, abuse prevention, diagnostics and enforcement under our legitimate interests in a safe, reliable service, Article 6(1)(f) GDPR.
• Optional product analytics, attribution and push messages only with consent under Article 6(1)(a) GDPR. These choices are separate, off by default and withdrawable.

4. Health data and explicit consent

Allergy, intolerance, body-measurement and certain goal information may constitute special-category data. We process it only when you provide it voluntarily and explicitly consent to its use for safe personalisation under Article 9(2)(a) GDPR. Consent is not required for general use and can be withdrawn for the future in Privacy settings. Without consent, VegPlan removes these fields and creates a more general plan.

5. AI features

We use the API of OpenAI Ireland Ltd. for requested plan and recipe suggestions, short assistant replies, image generation and review, and optional transcription. Only data needed for the selected feature is sent. Contact and payment data, precise location, and raw height or weight are excluded. VegPlan does not persist raw audio; related transcripts or assistant requests may be kept for up to 30 days.

Under the applicable API settings, API inputs and outputs are not used to train OpenAI models unless we explicitly opt in. Standard abuse monitoring retention may be up to 30 days. See OpenAI Enterprise Privacy. AI output can be wrong and is not used for decisions with legal or similarly significant effects under Article 22 GDPR.

6. Photos, subscriptions, analytics and push

Photos are processed only when you select or capture them. Private photos remain in non-public storage; community publication requires a separate active submission. Apple processes App Store purchases, while RevenueCat, Inc. receives a pseudonymous customer ID and entitlement data. Deleting VegPlan does not cancel an Apple subscription.

Optional allowlisted product analytics and AppsFlyer attribution start only after their respective consent. They never receive free text, photos, allergies, body measurements or precise location. If enabled, push delivery uses Expo and Apple and requires the operating-system permission. Results remain available in the app without push.

7. Website and hosting

The website sets no first-party analytics or advertising cookies. Necessary connection data, including IP address, time, resource, status code and user agent, is processed briefly for delivery and security under Article 6(1)(f) GDPR. Cloudflare, Inc. provides proxy, security and object-storage services. User files are stored in an EU-jurisdiction-restricted Cloudflare R2 bucket.

8. Recipients and international transfers

Relevant recipients may include our managed hosting and diagnostics services, Cloudflare, OpenAI Ireland, RevenueCat, Apple, AppsFlyer only after attribution consent, and Expo/Apple after push activation. Processor agreements are concluded where required. We do not sell personal data or disclose it for third-party advertising.

Where a provider processes data outside the EEA, we rely as applicable on an adequacy decision, including a valid EU-US Data Privacy Framework certification, or EU Standard Contractual Clauses and supplementary safeguards. You may request information about the applicable safeguards.

9. Retention

• profiles, active plans, private recipes and photos: until individual or profile deletion;
• inactive anonymous sessions: normally 30 days;
• raw audio: only during transcription; assistant requests and transcripts: up to 30 days;
• raw technical logs: normally 14 days; diagnostic events: normally 30 days;
• consented event analytics: normally 90 days; anonymous aggregates: up to 13 months;
• purchase/audit and AI cost metadata without prompt content: normally up to 24 months, subject to statutory needs;
• encrypted backups: 30 daily and 12 monthly generations, with erased identities prevented from reactivation after restore.

10. Your rights

Subject to legal requirements, you may request access, correction, erasure, restriction, portability and object to processing. You can withdraw consent for the future. In-app export and permanent deletion are available, or contact [email protected]. You may lodge a complaint with a supervisory authority, in particular the Baden-Württemberg data protection authority.

11. Children and updates

VegPlan is not directed at children under 16. Consent-based features may be used by anyone under 16 only with parental authorisation. We will update this notice when material functions, providers or legal requirements change and communicate material changes in the app or here.