Privacy notice

Effective: 4 September 2026

This notice explains how Wotaso GmbH processes personal data when you use the VegPlan app, vegplan.app, and related services. VegPlan can generally be used without a name or email account by means of a random, pseudonymous installation identifier.

1. Controller

Wotaso GmbH
Bostonring 5
71686 Remseck am Neckar
Germany
Email: [email protected]

No data protection officer has currently been appointed. You can send any privacy request directly to the email address above.

2. Data categories

• Technical identifiers: random installation and user IDs, hashed session tokens, app version, language, security and connection data.
• Planning data: diet, household size, meal times, budget, cooking time, appliances, likes, dislikes, shopping region and selected shops.
• Optional health-related data: allergies, intolerances, health-related goals and locally calculated daily energy and protein targets. Age, height, weight and activity level remain on your device and are not sent to our servers.
• Content: meal plans, recipes, shopping lists, pantry data, ratings, recipe feedback and plan-assistant requests.
• Optional media: private food photos, voluntarily submitted community content and push tokens.
• Purchase data: pseudonymous store customer ID, product, transaction and entitlement status. We do not receive full payment details.

3. Purposes and legal bases

• Providing, personalising and synchronising requested plans and handling support under Article 6(1)(b) GDPR.
• Managing subscriptions under Article 6(1)(b), and statutory records under Article 6(1)(c) GDPR where applicable.
• Security, abuse prevention, diagnostics and enforcement under our legitimate interests in a safe, reliable service, Article 6(1)(f) GDPR.
• Optional product analytics, attribution and push messages only with consent under Article 6(1)(a) GDPR. These choices are separate, off by default and withdrawable.

4. Health data and explicit consent

Allergy, intolerance, derived nutrition targets and certain goal information may constitute or reveal special-category data. We process it only when you provide it voluntarily and explicitly consent to its use for safe personalisation under Article 9(2)(a) GDPR. Age, height, weight and activity level are used only on your device to calculate the targets and are never sent to our servers or AI provider. Consent is not required for general use and can be withdrawn for the future in Privacy settings. Without consent, VegPlan removes health-related fields and derived targets and creates a more general plan.

5. AI features

We use the API of OpenAI Ireland Ltd. for requested plan and recipe suggestions, short assistant replies, image generation and review. Only data needed for the selected feature is sent. Contact and payment data, precise location, and raw height or weight are excluded. Assistant requests may be kept for up to 30 days.

Under the applicable API settings, API inputs and outputs are not used to train OpenAI models unless we explicitly opt in. Standard abuse monitoring retention may be up to 30 days. See OpenAI Enterprise Privacy. AI output can be wrong and is not used for decisions with legal or similarly significant effects under Article 22 GDPR.

6. Photos, subscriptions, analytics and push

Photos are processed only when you select or capture them. Private photos remain in non-public storage; community publication requires a separate active submission. Apple processes App Store purchases, while RevenueCat, Inc. receives a pseudonymous customer ID and entitlement data. Deleting VegPlan does not cancel an Apple subscription.

Product analytics and AppsFlyer attribution start only after their respective consent. Before consent, no analytics funnel events are sent. These services never receive free text, photos, allergies, body measurements, derived nutrition targets or precise location. If enabled, push delivery uses Expo and Apple and requires the operating-system permission. Results remain available in the app without push.

For TikTok app campaigns, AppsFlyer may send installs and the consented coarse funnel events to TikTok Technology Limited after attribution consent. If you also allow iOS app tracking, campaign attribution may use pseudonymous user and device identifiers. If you decline the iOS request, VegPlan uses no replacement identifier or fingerprinting; AppsFlyer runs only in anonymized mode and Apple's privacy-preserving SKAdNetwork/AdAttributionKit measurement remains available. The legal basis is consent under Article 6(1)(a) GDPR and, where terminal-device access applies, section 25(1) TDDDG.

Website analytics through AnalyticsCLI starts only after you expressly opt in. We then measure pseudonymous page views, visible content sections, coarse scroll depth and engagement time, FAQ opens, and clicks on internal, external and App Store links. Language, device type, referring domain and campaign UTM parameters in the URL may be included. Form values, free text, advertising profiles and fingerprinting are excluded. The legal basis is consent under Article 6(1)(a) GDPR and, where terminal-device access applies, section 25(1) TDDDG.

7. Website and hosting

The website sets no analytics or advertising cookies. We store your consent choice locally so that we do not ask again on every visit. Only after consent may AnalyticsCLI store a pseudonymous device and session identifier in local storage. You can withdraw for the future through “Analytics settings” in the footer; the local analytics identifiers are then removed. Global Privacy Control and Do Not Track are treated as an opt-out. Necessary connection data, including IP address, time, resource, status code and user agent, is processed briefly for delivery and security under Article 6(1)(f) GDPR. Cloudflare, Inc. provides proxy, security and object-storage services. User files are stored in an EU-jurisdiction-restricted Cloudflare R2 bucket.

8. Recipients and international transfers

Relevant recipients may include our managed hosting and diagnostics services, Cloudflare, OpenAI Ireland, RevenueCat, Apple, AnalyticsCLI only after analytics consent, AppsFlyer and TikTok Technology Limited only after attribution consent, and Expo/Apple after push activation. Processor agreements are concluded where required. We do not sell personal data. Disclosure for campaign measurement or advertising optimization occurs only after the consent described above.

Where a provider processes data outside the EEA, we rely as applicable on an adequacy decision, including a valid EU-US Data Privacy Framework certification, or EU Standard Contractual Clauses and supplementary safeguards. You may request information about the applicable safeguards.

9. Retention

• profiles, active plans, private recipes and photos: until individual or profile deletion;
• inactive anonymous sessions: normally 30 days;
• assistant requests: up to 30 days;
• raw technical logs: normally 14 days; diagnostic events: normally 30 days;
• consented event analytics: normally 90 days; anonymous aggregates: up to 13 months;
• purchase/audit and AI cost metadata without prompt content: normally up to 24 months, subject to statutory needs;
• encrypted backups: 30 daily and 12 monthly generations, with erased identities prevented from reactivation after restore.

10. Your rights

Subject to legal requirements, you may request access, correction, erasure, restriction, portability and object to processing. You can withdraw consent for the future. In-app export and permanent deletion are available, or contact [email protected]. You may lodge a complaint with a supervisory authority, in particular the Baden-Württemberg data protection authority.

11. Children and updates

VegPlan is not directed at children under 16. Consent-based features may be used by anyone under 16 only with parental authorisation. We will update this notice when material functions, providers or legal requirements change and communicate material changes in the app or here.