Privacy Policy

1. Introduction

This Privacy Policy explains how Mella, a DBA of Peak Potential LLC, a limited liability company registered in the State of Utah ("Mella," "we," "us," or "our"), collects, uses, stores, and protects your personal information when you use the Mella application and related services (the "Service"). We are committed to protecting your privacy and handling your data responsibly.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name and email address through our OAuth authentication provider. We use this information to identify your account and provide the Service.

2.2 Dietary and Nutritional Data

To generate personalized meal plans, we collect dietary information you provide, including:

• Dietary restrictions and allergies (e.g., gluten-free, nut-free, vegetarian)
• Food preferences and dislikes
• Nutritional goals and calorie targets
• Cooking skill level and available cooking time
• Cuisine preferences
• Snack preferences and frequency
• Weekly grocery budget
• Pantry inventory and ingredient expiration tracking, cooking completion history

2.3 Family Member Data

You may choose to add family member profiles to customize meal plans for your household. This data may include:

• Family member names and ages (including children)
• Individual dietary restrictions and allergies
• Food preferences and dislikes for each family member
• Children's specific food preferences and sensitivities

Children's Data: We take the protection of children's data seriously. Family member data, including information about children's food preferences, is collected solely for the purpose of generating appropriate meal plans. We do not use children's data for marketing, advertising, or any purpose other than providing the meal planning Service. If you are a parent or guardian and believe we have collected information about your child without your consent, please contact us immediately.

2.4 Usage Data

We collect information about how you interact with the Service, including meal plans generated, recipes viewed, favorites saved, grocery lists created, pantry items tracked, meal ratings provided, and cooking sessions completed via Guided Cooking. This data helps us improve the Service and provide better recommendations.

2.5 Payment Data

Payment processing is handled entirely by Stripe, our third-party payment processor. We do not store, process, or have access to your full credit card numbers, CVV codes, or other sensitive payment credentials. We may store a Stripe customer identifier and subscription identifier to manage your subscription status. For information about how Stripe handles your payment data, please review Stripe's Privacy Policy.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Generate personalized meal plans, recipes, and grocery lists using AI
• Customize content based on your dietary preferences and family needs
• Process subscription payments and manage your account
• Send service-related communications (e.g., account verification, subscription updates)
• Analyze usage patterns to improve the Service and user experience
• Detect, prevent, and address technical issues or security threats
• Comply with legal obligations

We may send you promotional emails including weekly meal tips, recipes, and product updates, but only if you have explicitly opted in during onboarding or in your profile settings. You can withdraw marketing consent at any time from your profile settings. Transactional emails such as account verification, payment confirmations, and deletion confirmations are sent regardless of marketing preference.

We do not sell your personal information to third parties. We do not use your dietary or family data for targeted advertising.

4. AI Data Processing

Your dietary preferences, family member data, and other profile information are processed by AI systems to generate personalized meal plans and recipes. This processing occurs on our servers and through our AI service providers. AI-generated content is based on the information you provide and general nutritional knowledge — it does not constitute medical or dietary advice. Your personal data is not used to train general-purpose AI models.

5. Data Sharing and Third Parties

We may share your information with the following categories of third parties:

• Payment Processor (Stripe): To process subscription payments securely.
• AI Service Providers: To generate personalized meal plans and recipes. Data shared is limited to what is necessary for meal plan generation.
• Hosting and Infrastructure Providers: To host and deliver the Service.
• Legal Requirements: We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will permanently delete all associated data — including your profile, family member data, meal plans, recipes, pantry items, grocery lists, and favorites — immediately upon confirmation, with encrypted backups purged within 30 days. Some data may be retained in encrypted backups for a limited period as required for legal compliance or legitimate business purposes, after which it will be permanently deleted.

7. Data Security

We implement industry-standard security measures to protect your personal information, including encryption in transit (TLS/SSL), secure authentication, and access controls. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

8. Your Rights Under GDPR (European Economic Area)

If you are located in the European Economic Area (EEA), you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request that we correct inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data. You can exercise this right by using the "Delete Account" feature in your Profile settings, which permanently removes all your data.
• Right to Restriction of Processing: You may request that we restrict the processing of your personal data under certain circumstances.
• Right to Data Portability: You may request a copy of your data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to the processing of your personal data for certain purposes.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time.

The legal basis for processing your data includes: performance of a contract (providing the Service), legitimate interests (improving the Service), and consent (where applicable). To exercise any of these rights, please contact us using the information below.

9. Your Rights Under CCPA (California)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share your data.
• Right to Delete: You may request that we delete your personal information. You can exercise this right by using the "Delete Account" feature in your Profile settings.
• Right to Correct: You may request that we correct inaccurate personal information.
• Right to Opt-Out of Sale: We do not sell your personal information. As such, there is no need to opt out of the sale of personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us using the information below. We will respond to verifiable consumer requests within 45 days.

10. Right to Data Deletion

You have the right to request the permanent deletion of your account and all associated data at any time. To delete your account:

1. Navigate to your Profile page in the app.
2. Scroll to the Danger Zone section.
3. Click "Delete Account" and confirm the deletion.

Upon confirmation, the following data will be permanently and irreversibly deleted: your user profile, dietary preferences, family member profiles (including children's data), all meal plans and meals, custom recipes, favorites, pantry items, grocery lists, meal ratings, and taste preferences. This action cannot be undone.

11. Cookies and Tracking

We use essential cookies to maintain your authentication session and provide the Service. We may use analytics tools to understand how the Service is used. We do not use cookies for advertising or cross-site tracking purposes.

12. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including the United States. We ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on the Service and updating the "Effective Date" above. Your continued use of the Service after such changes constitutes your acceptance of the revised Privacy Policy.

14. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your data is handled, please contact us at: