Privacy Policy for LeanBowl

This Privacy Policy explains how Gladiolus Limited, using LeanBowl as an app brand/trading name ("LeanBowl", "we", "us", or "our"), collects, uses, stores, and shares personal data when you use the LeanBowl app, website pages, and related services (together, the "Service").

LeanBowl is not a separate legal entity. For UK GDPR and Data Protection Act 2018 purposes, Gladiolus Limited is the data controller for the personal data described in this Policy, except where a third party acts as an independent controller for its own services, such as Apple, Google, or app stores.

1. What LeanBowl Does

LeanBowl helps users generate and organise high-protein recipes, edit recipes, save recipes, add meals to a planner, and build grocery lists. LeanBowl uses AI to help generate recipe content from user-selected inputs and optional text context.

2. Personal Data We Collect

Depending on how you use the Service, we may collect or process the following categories of personal data:

• Name and profile data: first name, last name, display name, username, avatar choice, locale, and unit preferences you choose to set.
• Email address: email address and related authentication metadata used for account sign-in.
• User ID and account identifiers: Supabase user ID, RevenueCat app user ID or customer ID, authentication provider identifiers, and related account metadata.
• Device or app identifiers: device, session, SDK, or anonymous identifiers used by app services for authentication, subscription management, security, reliability, or abuse prevention.
• Purchase history: subscription product ID, entitlement ID, purchase or restore events, trial status, subscription status, renewal status, expiry date, cancellation state, store environment, and related App Store or RevenueCat metadata.
• Other user content: selected cuisine, protein, carb, vegetable, cooking-method, appliance, and meal-theme preferences; optional free-text recipe context you choose to submit for recipe creation; generated or edited recipes; cookbook data; planner entries; grocery items; and support messages you choose to submit.
• Product interaction data: feature interactions, onboarding completion, recipe creation attempts, recipe generation counts, planner actions, grocery actions, subscription events, and similar app usage information where enabled.
• Diagnostics and technical data: technical logs, error reports, device and platform information, app version, and similar data needed for reliability, abuse prevention, and troubleshooting.

LeanBowl may also process user-submitted recipe content or recipe-related inputs when a user asks the app to generate or edit a recipe.

3. Data LeanBowl Does Not Intentionally Collect

LeanBowl is intended to operate as a meal-planning and recipe organisation product, not as a medical or dietetic service. We do not intentionally ask for medical conditions, diagnoses, treatment history, body weight, BMI, allergy status, health goals, weight-loss goals, or calorie targets.

Please do not include health, medical, allergy, pregnancy, medication, body, or other sensitive personal information in free-text recipe fields.

4. How We Use Personal Data

We use personal data for the following purposes:

• Providing the Service
  We use personal data to create accounts, authenticate users, generate recipes, save recipes, maintain cookbooks, planners and grocery lists, sync account data, manage subscriptions, and enforce daily generation limits.
  Lawful basis: Contract.
• Personalising the Service
  We use profile, preference, recipe, and planning data to customise profile, recipe, and meal-planning experiences.
  Lawful basis: Contract and legitimate interests.
• Maintaining and improving the Service
  We use personal data to monitor reliability, debug issues, analyse product usage, and improve features where product analytics are enabled.
  Lawful basis: Legitimate interests.
• Keeping the Service secure
  We use personal data to prevent abuse, fraud, unauthorised access, and misuse of AI or backend systems.
  Lawful basis: Legitimate interests.
• Processing subscriptions
  We use personal data to maintain purchase, restore, entitlement, trial, renewal, cancellation, and subscription state.
  Lawful basis: Contract.
• Complying with legal obligations
  We use personal data to respond to lawful requests, enforce terms, and maintain records where required.
  Lawful basis: Legal obligation and legitimate interests.

LeanBowl does not use personal data for third-party advertising or cross-app advertising tracking.

5. Marketing and Consent

We do not send standalone marketing communications for LeanBowl. If we start sending direct marketing, we will ask for a clear opt-in where required by law.

You can withdraw marketing consent at any time by using the unsubscribe link in the message or contacting us at leanbowl-privacy@gladiolus.dev. Withdrawal of consent does not affect processing carried out before withdrawal.

We will still send non-marketing service messages when necessary, for example account, billing, security, or important legal updates.

6. What We Do Not Do

We do not currently:

• sell personal data;
• use personal data for cross-app advertising tracking or targeted advertising;
• intentionally collect special-category health data through free-text recipe fields;
• intentionally send recipe text or sensitive health information to analytics or diagnostics tools, except where necessary for support, security, or legal compliance; or
• use personal data from recipe prompts or user content to train LeanBowl-owned AI models.

If any of these practices change, we will update this Policy and provide any required notices, consents, or opt-out mechanisms under applicable law.

7. AI Processing

When you ask LeanBowl to generate a high-protein recipe, selected inputs and optional user text may be sent to backend services and AI model providers to produce a result. LeanBowl may use DeepSeek, OpenAI, or both for AI recipe generation and related processing.

AI providers may process prompts, inputs, generated outputs, and technical metadata under their own terms and privacy practices. DeepSeek's privacy policy states that information such as text inputs, prompts, uploaded files, feedback, and chat history may be used to improve and train its technology, and that personal information may be stored in the People's Republic of China. You can read DeepSeek's privacy policy at cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html.

AI outputs may be inaccurate, incomplete, or unsuitable for your needs.

Do not enter medical conditions, allergy details, pregnancy or breastfeeding information, diagnoses, treatment information, or other sensitive health information into AI prompts or free-text fields.

You must review ingredients, allergens, cooking safety, and nutrition estimates yourself before cooking or eating a recipe.

8. Nutrition and Allergy Information

LeanBowl is not a medical, dietetic, allergy, or exact nutrition service. Nutrition values are estimates only. LeanBowl does not guarantee exact nutrition accuracy or allergen safety.

9. Sharing of Personal Data

We may share personal data with service providers that process data on our behalf, and with professional advisers, regulators, law enforcement, or authorities where legally required.

We do not sell your personal data and do not use your personal data for cross-app advertising tracking.

Current provider table

This table gives more specific transparency about material providers that LeanBowl may use for account access, subscriptions, analytics, diagnostics, AI processing, storage, and app-store services. Providers may change as the Service develops, but we aim to keep this table current where a provider is material to how personal data is processed.

Processor contracts and data processing terms

Where a provider acts as our processor, we aim to use provider data processing terms, data processing agreements, or equivalent contractual terms that address processing instructions, confidentiality, security, subprocessors, assistance with user rights, retention, deletion, and breach support. Some providers, such as Apple or Google for app-store billing and account services, may also act as independent controllers for their own services.

10. Business Transfers

If Gladiolus Limited or LeanBowl is involved in a merger, acquisition, financing, reorganisation, insolvency process, sale of assets, assignment, change of control, or similar transaction, personal data may be transferred to the acquiring or successor entity as part of that transaction.

The successor entity will continue to process personal data in accordance with this Policy, applicable law, and any required notices, consents, and opt-out rights. If personal data is used, shared, sold, licensed, or processed in a materially different way after a transfer, we or the successor entity will provide notice and obtain consent or apply any required mechanism under applicable law.

11. International Transfers

We are based in the United Kingdom. Some providers we use may process personal data outside your country of residence, including in the United Kingdom, European Economic Area, United States, People's Republic of China, or other countries where their systems, support teams, or subprocessors operate. The provider table above identifies material providers that may involve overseas processing.

Where recipe inputs or optional user text are sent to an AI model provider, that provider may process the data in countries outside the UK depending on its infrastructure and subprocessors. DeepSeek's privacy policy states that personal information may be stored in the People's Republic of China. We aim to send only the recipe data needed to generate or improve the requested recipe output.

Where UK GDPR, Australian, New Zealand, or other applicable privacy laws require safeguards for international transfers, we use appropriate measures such as adequacy decisions, approved contractual terms, data processing agreements, provider data processing terms, or other lawful transfer mechanisms.

12. Retention

We keep personal data only for as long as reasonably necessary to provide the Service, support legitimate operations, comply with legal obligations, resolve disputes, and enforce agreements.

We maintain this retention schedule and review it as the Service, provider settings, and legal requirements change.

13. Your Rights and Request Handling

Subject to applicable law, you may have the right to:

• request access to your personal data;
• request correction of inaccurate data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent where processing relies on consent; and
• request portability of certain data.

You can request account deletion or exercise privacy rights by contacting leanbowl-privacy@gladiolus.dev. You can also read our LeanBowl Data Deletion page for the deletion request process.

We may verify your identity before processing a request and may ask for clarification if a request is broad or unclear. We will respond to verified requests within the time required by applicable law.

You also have the right to complain to the UK Information Commissioner's Office if you believe your data protection rights have been infringed.

14. Regional Privacy Rights

This Policy is intended to apply globally. The sections above explain the main facts about LeanBowl's collection, use, sharing, AI processing, retention, security, and international transfers. The regional notes below explain additional rights or complaint routes that may apply depending on where you live or which privacy law applies.

United Kingdom

If UK data protection law applies, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent where processing relies on consent, and request portability of certain personal data. You may complain to the UK Information Commissioner's Office.

Australia

If Australian privacy law applies, you may request access to or correction of your personal information and contact us with privacy complaints. We explain how LeanBowl collects, uses, discloses, stores, secures, and sends personal information overseas in the sections above, including the Sharing of Personal Data, International Transfers, Retention, Security, and Contact sections.

New Zealand

If New Zealand privacy law applies, you may request access to or correction of your personal information and contact us with privacy complaints. We explain how LeanBowl collects, uses, discloses, stores, secures, and sends personal information overseas in the sections above, including the Sharing of Personal Data, International Transfers, Retention, Security, and Contact sections.

15. Children

LeanBowl is intended for users aged 18 and over and is not directed at children. If you are under 18, you should not use LeanBowl unless a parent or legal guardian has reviewed these terms and is responsible for your use of the Service.

We do not knowingly use children's personal data for marketing, advertising profiling, or cross-app tracking. If we learn that we have collected personal data from a child in a manner that requires parental consent and did not obtain it, we will take appropriate steps to delete the data or obtain appropriate consent.

16. Security and Breach Response

We use reasonable technical and organisational measures intended to protect personal data. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We maintain an incident response process for security events involving personal data. If we become aware of a personal data breach, we will assess the likely risk to users, keep an internal record, work with relevant providers where needed, and notify the Information Commissioner's Office and affected users where required by applicable data protection law.

17. App Store and Platform Privacy Disclosures

Our App Store and Play Store privacy disclosures describe the data we collect and how we use it and should be read together with this Policy.

Our app store privacy disclosures may identify data types such as name, email address, user ID, device ID, purchase history, product interaction, and other user content where applicable. These data types are linked to the user's identity where they are associated with an account, subscription customer, or device/session identifier.

18. Cookies and Tracking Technologies

Our website pages may use essential cookies and similar technologies for security, session management, authentication, and basic analytics. We do not use cookies for cross-site behavioural advertising.

You can control cookies through your browser settings. If we add additional cookie or tracking technologies requiring consent, we will update this Policy and provide required consent mechanisms. See our Cookies Policy for more detail.

19. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on our website and update the "Last updated" date above. Where required by law, we will take additional steps to notify you.

20. Contact

If you have privacy questions or want to exercise your rights, contact us using the details below.

Gladiolus Limited
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, England
ICO registration reference: ZC112773
Privacy: leanbowl-privacy@gladiolus.dev
Support: leanbowl-support@gladiolus.dev