Legal
Privacy Policy
Last updated: 13 October 2026
1. Who we are (data controller)
The controller responsible for your personal data is the individual sole trader operating M3Hungry:
- Operator: Nikolaos Galerakis
- Address: Kalonykti, Greece
- Contact: nikolisgal@gmail.com
For some features we act jointly with, or on behalf of, other parties — most notably nutritionists who keep client records on the platform (see section 4).
2. What data we collect
Depending on how you use M3Hungry, we may process:
| Account data | Email, password (hashed), display name, and — if you sign in with Facebook, Google or Instagram — the basic profile fields that provider returns. |
| Profile & preferences | Dietary preferences, diet type, survey answers, daily calorie target, and any health-condition badges you choose to opt into. |
| Content you create | Recipes, comments, votes, posts, meal plans, shopping baskets, images and media you upload. |
| Nutritionist client records | If you are (or are a client of) a nutritionist: intake data such as height, weight, BMI/BMR/TDEE, goals, free-text notes and consultation notes. |
| Payment data | Subscription tier and billing status. Card details are handled directly by Stripe — we do not store full card numbers. |
| Usage & device data | If you accept analytics cookies, Google Analytics processes usage data (pages visited, referrer, approximate location, device/browser type). We ourselves keep only an anonymous daily session counter that stores no IP, cookie or identifier. |
3. Why we use it & legal bases
We only process personal data where we have a legal basis under GDPR Art. 6:
| Provide the service | Performance of our contract with you (Art. 6(1)(b)) — accounts, recipes, meal plans, baskets, subscriptions. |
| Keep the service secure | Legitimate interests (Art. 6(1)(f)) — fraud/abuse prevention, request-forgery protection, rate limiting. |
| Analytics & improvement | Your consent (Art. 6(1)(a)) — collected via the cookie banner; you can withdraw it at any time. |
| Health-condition features & nutritionist records | Your explicit consent (Art. 9(2)(a)) and/or provision of health care (Art. 9(2)(h)) — see section 4. |
| Marketing / beta invitations | Your consent (Art. 6(1)(a)) — e.g. the trial/beta signup; you can unsubscribe from every email. |
| Legal obligations | Compliance with law (Art. 6(1)(c)) — e.g. tax and accounting records for paid subscriptions. |
4. Health data (special category)
Health-condition badges and nutritionist client records are "data concerning health" — a special category under GDPR Art. 9, which is protected more strictly.
- We process it only with your explicit consent, or where it is necessary for the provision of care by a nutritionist you have engaged.
- You can withdraw that consent at any time; doing so stops future processing and you can delete the associated data (see section 8).
- Condition-related information on M3Hungry is general nutritional information, not medical advice, diagnosis or treatment. See the health disclaimer in our Terms of Service.
6. International transfers
Several of the providers above (Stripe, Anthropic, OpenAI, Google, Meta, AWS) are established in, or process data in, the United States. Where personal data leaves the European Economic Area, we rely on an appropriate GDPR Chapter V safeguard — the EU–US Data Privacy Framework where the provider is certified, or EU Standard Contractual Clauses together with a transfer risk assessment.
7. How long we keep data
- Account and content data: for as long as your account is active.
- Analytics: handled by Google Analytics under its own retention; we keep only an anonymous, non-identifying daily session counter.
- Billing and tax records: as required by applicable accounting/tax law.
- When you delete your account, we delete or anonymise the personal data associated with it, except where we must retain certain records by law.
8. Your rights
Under GDPR you have the right to:
- Access — a copy of the data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — delete your account and associated data.
- Portability — receive your data in a portable format.
- Restriction / objection — limit or object to certain processing.
- Withdraw consent — at any time, without affecting prior lawful processing.
You can manage your profile and delete your account from your account settings, or contact us (section 13) to exercise any right. We respond within one month.
9. Automated processing & AI
M3Hungry uses AI to generate recipes, meal plans, images and assistant responses, and to power nutrition features. Content that is AI-generated is produced by automated systems and may contain errors; it is informational and is not a substitute for professional advice. We do not use your personal data to make decisions that produce legal or similarly significant effects about you without a lawful basis and appropriate safeguards.
11. Children
M3Hungry is not directed at children. You must be at least 16 (or the minimum digital-consent age in your country) to create an account. We do not knowingly collect data from children below that age.
12. Changes to this notice
We may update this notice as the service evolves or the law changes. We will update the "last updated" date above and, for material changes, notify you through the app or by email.
13. How to contact us / complain
For any privacy question or to exercise your rights, contact nikolisgal@gmail.com. You also have the right to lodge a complaint with your national data-protection authority — in our case the Hellenic Data Protection Authority (HDPA, www.dpa.gr) — if you believe we have not handled your data lawfully.