Gourmang SASU is the data controller. Our address and email are on our Contact page.
1. Data and purposes
We use account and age information to manage access. Nutrition profiles, goals, logs and photos support tracking and planning. We use sharing, support, subscription and notification data to provide those features.
Required information is needed to use the account or feature concerned.
App stores handle payments. Optional dictation may process audio remotely; we receive the text.
Device, network, usage and account data, diagnostics and session recordings help secure, troubleshoot and improve Gourmang. Recordings can show screens, with selected sensitive fields masked. We share usage data with advertising measurement providers to measure the effectiveness of our campaigns.
2. Legal bases
We process data to provide the service under our contract with you. We rely on legitimate interests for security, abuse prevention, moderation and necessary diagnostics, and on legal obligations for required records and rights requests.
Non-essential tracking requires consent where applicable; health data normally requires explicit consent. Accepting this policy or the terms is not consent to either.
3. Recipients and transfers
Authorised staff and hosting, AI, communications, diagnostics, analytics and subscription providers receive relevant data. AI providers and intermediaries receive submitted text or images and relevant nutrition and goal information. Shared content reaches your chosen recipients; approved food contributions are public.
Main storage and product analytics are hosted in the EU. Providers may process data outside the EEA; contact us for transfer locations and safeguards.
4. Retention and deletion
Account data and nutrition summaries remain until account deletion.
We keep diary entries for 10 days, detailed coaching meals for 180 days and AI usage records for 90 days. Internal records of analytics sent to our provider are kept for 90 days after delivery.
Completed support conversations are removed after 90 days without activity. Unused AI recipes expire after 90 days without activity, unless favourited or still in use.
Images no longer in use are deleted during routine cleanup after a 14-day waiting period. Deleted files remain recoverable for 7 days.
Account deletion removes its data and requests deletion of linked analytics. Our analytics provider processes these deletion requests separately. Backups, public contributions, shared copies, store records and advertising measurement data may remain.
5. Rights and changes
Subject to applicable law, you may request access, correction, deletion, restriction or portability, object to legitimate-interest processing, and withdraw consent without affecting earlier lawful processing. Please contact us to exercise these rights. We respond within one month; permitted extensions are explained within that period. You may complain to the CNIL or your local supervisory authority.
We update this policy when practices change, notify you of material changes and obtain any required consent before new processing starts.