Privacy Policy

1. Who We Are

MacroSculpt (“MacroSculpt”, “we”, “our”, or “us”) is a health and fitness application operated by Nixvara Ltd, a company registered in England and Wales. We are the Data Controller for all personal data you provide when using macrosculpt.fit or any MacroSculpt application.

Contact: [email protected]

2. What Data We Collect

We collect the following categories of data:

• Account data — email address, hashed password, email-verification status, account creation timestamp.
• Profile data — display name, date of birth, gender, nationality.
• Health & body data (special-category)— height, weight, body fat percentage, activity level, training frequency, dietary preferences (likes, dislikes, tolerated foods), cooking skill level, calorie and macro targets, generated meal plans, workout logs. See Section 3.
• Personal food library — foods you save via the Open Food Facts integration, including nutritional values per 100g.
• Food log entries (free-tier tracker)— foods, quantities and meal labels you log through the daily calorie & macro tracker. These entries are associated with your account and stored per logged date.
• Usage & technical data — server access logs (IP address, browser/user-agent, page visited, timestamp), error logs. We do not use third-party analytics or advertising trackers.
• Payment data — subscription and payment processing is handled by our payment provider (Stripe). MacroSculpt does not store full card numbers or payment instrument details.

4. Legal Basis for Processing

• Contract (Article 6(1)(b)) — processing your account data and profile to provide the service you signed up for.
• Explicit consent (Article 9(2)(a)) — processing special-category health and dietary data.
• Legitimate interests (Article 6(1)(f)) — server security logging, fraud prevention, and system uptime monitoring.
• Legal obligation (Article 6(1)(c)) — retaining billing records as required by UK tax and financial regulations.

5. How We Use Your Data

• Authenticate you and keep your account secure.
• Calculate personalised calorie and macro targets based on your body stats, activity level, and goals.
• Generate AI-powered recipe suggestions and weekly meal plans tailored to your preferences and targets.
• Track your workout sessions and estimate calorie expenditure.
• Aggregate your weekly meal plan into a shopping list.
• Log and display daily food intake and macro progress for free-tier users via the calorie & macro tracker.
• Send transactional emails (email verification, password reset).
• Diagnose errors and maintain service reliability.
• Process subscription payments and maintain billing records (via Stripe, our payment processor).

We do not sell your data, use it for advertising, or share it with data brokers.

6. AI Processing & Third-Party Processors

MacroSculpt uses large language models (LLMs) to generate meal recipes and, optionally, custom exercises. When you trigger AI generation, limited context is sent to an AI processor. No names or email addresses are sent.

No special-category health data (raw body metrics) is transmitted to AI providers — only the derived numerical targets (e.g., “2,400 kcal / 180g protein”).

Other sub-processors:

• Stripe Inc. — payment processing. Stripe is PCI-DSS Level 1 certified.

7. Cookies & Session Tokens

MacroSculpt uses a single httpOnly, Secure, SameSite=Lax cookie named access_token to maintain your authenticated session. This cookie:

• Is strictly necessary for the app to function.
• Contains a signed JWT — no personal data is stored inside the cookie itself.
• Is not accessible to JavaScript (httpOnly flag).
• Is only sent over HTTPS (Secure flag).
• Is not shared with any third party.

We do not use advertising cookies, analytics cookies (e.g. Google Analytics), or any cross-site tracking cookies. No cookie consent banner is shown because no non-essential cookies are in use.

8. Data Retention

• Active account — data is retained for as long as your account remains open.
• Account deletion — when you delete your account, all personal data and health data are permanently deleted within 30 days. Anonymised aggregate statistics may be retained indefinitely.
• Billing records — invoices and payment records are retained for 7 years to comply with UK HMRC requirements.
• Server logs — retained for up to 90 days for security monitoring, then automatically deleted.

9. Data Security

• All data in transit is encrypted via TLS 1.2+.
• Passwords are hashed using bcrypt with a cost factor of 12.
• The application database is not publicly accessible; it is reachable only from within our private cluster network.
• Health data is stored in a separate table with purpose-limited access (see Section 3).
• We conduct regular dependency audits and apply security patches promptly.
• Email verification is required before accessing any personal data or health features.

10. International Transfers

MacroSculpt's servers are located in the European Economic Area (EEA). When data is processed by OpenRouter or Google (AI providers), it may be transferred to the United States. Such transfers are made under Standard Contractual Clauses (SCCs) approved by the European Commission, providing an equivalent level of protection.

12. Children

MacroSculpt is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact [email protected] and we will delete the data promptly.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in law or our practices. When we make material changes, we will notify you by email and display a notice in the application at least 14 days before the changes take effect. The “Last updated” date at the top of this page will always reflect the most recent revision.

14. Contact & Data Controller