Privacy policy
This policy covers personal data processed through the FixTheWeek website, installed PWA and any official app offered under this policy, for people in the EU/EEA and UK.
1. Controller and contact
Controller: Aleksandar Mladenov trading as FixTheWeek, a sole trader established in the United Kingdom, address 5 Brayford Square, London E1 0SG, United Kingdom. Contact, including questions about personal data: contact@fixtheweek.com. Registered with the UK Information Commissioner’s Office (ICO) under registration number ZC276257.
We apply the EU GDPR where its territorial scope is met and the UK GDPR and Data Protection Act 2018, as amended, where their scope is met. References to GDPR legal bases below cover the corresponding EU and UK provisions where applicable. The controller is established in the United Kingdom.
EU/EEA representative (Article 27 GDPR): we have appointed Data Protection Representative Limited (trading as DataRep) as our representative in the European Union and European Economic Area. If you are in the EU/EEA, you can contact us through DataRep about your personal data or your data-protection rights: by email at datarequest@datarep.com, with “FixTheWeek” in the subject line; through the web form at www.datarep.com/data-request; or by post to DataRep at the address for your country, listed below. Address letters to “DataRep”, not to FixTheWeek, or they may not reach us. For anything else, or if you are in the UK, contact us directly at contact@fixtheweek.com.
- Austria: DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
- Belgium: DataRep, Rue des Colonies 11, Brussels, 1000, Belgium
- Bulgaria: DataRep, 25 Vitosha blvd. Fl. 2, office 4, 1000, Sofia, Bulgaria
- Croatia: DataRep, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia
- Cyprus: DataRep, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus
- Czech Republic: DataRep, Platan Office, 28. Října 205/45, Floor 3&4, Ostrava, 70200, Czech Republic
- Denmark: DataRep, Lautruphøj 1-3, Ballerup, 2750, Denmark
- Estonia: DataRep, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia
- Finland: DataRep, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland
- France: DataRep, 72 rue de Lessard, Rouen, 76100, France
- Germany: DataRep, 3rd and 4th floor, Altmarkt 10 B/D, Dresden, 01067, Germany
- Greece: DataRep, Ippodamias Sq. 8, 4th floor, Piraeus, Attica, Greece
- Hungary: DataRep, 1054 Honved street, 8 1/2, Budapest, Hungary
- Iceland: DataRep, Laugavegur 13, 101 Reykjavik, Iceland
- Ireland: DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland
- Italy: DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy
- Latvia: DataRep, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia
- Liechtenstein: DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
- Lithuania: DataRep, 44A Gedimino Avenue, 01110 Vilnius, Lithuania
- Luxembourg: DataRep, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg
- Malta: DataRep, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta
- Netherlands: DataRep, De Nieuwe Erven 3 Unit – 15162, 5431 NV Cuijk, Netherlands
- Norway: DataRep, C.J. Hambros Plass 2c, Oslo, 0164, Norway
- Poland: DataRep, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland
- Portugal: DataRep, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061, Portugal
- Romania: DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857, Romania
- Slovakia: DataRep, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia
- Slovenia: DataRep, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia
- Spain: DataRep, Calle de Manzanares 4, Madrid, 28005, Spain
- Sweden: DataRep, S:t Johannesgatan 2, 4th floor, Malmo, SE - 211 46, Sweden
2. What data we collect
When you register: your name, email address, account identifier, password hash, email verification status and timestamps. For security, we process your session, IP address, browser data and temporary keys that limit login attempts.
For planning: your chosen goal, diet, calories, macro targets, recipes, meal plans, favourite and blocked recipes, ingredients to avoid, the kitchen appliances you have, your settings and your shopping list. If you choose to enter body details, we process your age, sex, height, weight, activity level and an approximate body fat category. There are no separate fields for a diagnosis, pregnancy, allergy or target weight. However, ingredients you avoid may reveal an allergy or intolerance, so they are treated as health data and stored only with your explicit consent.
To create an account, your name, email, password, acceptance of the terms and confirmation that you are at least 18 are required. Without them an account cannot be created. Planning preferences have defaults and can be changed. Body details, ingredient exclusions and marketing consent are optional: refusing health-data consent leaves manual planning available but prevents saving body details and health-related exclusions. We also store your email notification choices, schedule, time zone and last-send timestamps. Weekly plan and shopping-list reminders start enabled on account creation; you can switch them off in Notification settings or unsubscribe from a reminder email. New-recipe messages require enabling their separate setting; news and offers require marketing consent.
If you take Premium or its free trial, we store your Stripe customer and subscription identifiers, the plan, the currency and the status (trial, active, payment failed or cancelled), the date the subscription started (from which the withdrawal period runs), the end dates of the trial and of the billing period, and whether the subscription is set to end. We never receive or store your card number or full payment details; Link and Stripe collect those at checkout. If you ask to be told when Premium launches, we store that choice, its date and your language. To show prices in pounds or euros, and to check that you are in the UK or the EU/EEA, where FixTheWeek is offered, we use the country of your connection, which Cloudflare derives from your IP address for each request; we don't store it.
3. Purposes and legal bases
Account access, profile settings, meal plans, requested shopping-list emails and selected service reminders are processed to provide the service — Article 6(1)(b) GDPR. Authentication, abuse prevention and security counters rely on Article 6(1)(f): our interest in protecting accounts and the service, balanced against your rights. Recording acceptance of the terms supports the account contract. Minimal consent records support our accountability duties under Articles 5(2) and 7(1), with Article 6(1)(c) applying to that specific duty; it is not a blanket basis for all records. Optional new-recipe emails rely on your opt-in choice under Article 6(1)(a), with applicable electronic-marketing rules. News and offers require separate marketing consent under Article 6(1)(a), which can be withdrawn in the account or through the email unsubscribe link.
We treat body details and ingredient or recipe exclusions as potentially health-related data and save them only after explicit consent under Articles 6(1)(a) and 9(2)(a) GDPR. Consent is recorded separately from acceptance of the terms. Withdrawing it in “Privacy and data” removes the saved body details and health-related exclusions from the live account and the local recovery copy in the browser you are using; it does not affect earlier lawful processing. Other browsers and files you have downloaded must be cleared separately. Do not enter diagnoses in free text.
Automatic planning uses your chosen goals, calories, macro targets, diet, exclusions and recipe preferences to calculate targets and rank or select meals. This personalisation may constitute profiling. It does not make decisions that produce legal or similarly significant effects under Article 22 of the EU GDPR, and it does not diagnose a condition. You can change the inputs, choose manual targets and edit the proposed meals.
For Premium, the subscription record, the email reminding you that the trial is ending and messages about your subscription are needed to provide the subscription you asked for — Article 6(1)(b). Using the country of your connection to show prices in the currency you will pay in, and to offer FixTheWeek only in the UK and the EU/EEA, relies on Article 6(1)(f): our interest in showing you the correct price and in offering the service only where it is available. The one Premium launch email relies on your consent under Article 6(1)(a), given with a separate unticked box; you can withdraw it at any time with “Don't email me” on the Subscription tab. Customer and invoice records in our Stripe account are kept to meet tax and accounting obligations — Article 6(1)(c).
When you register, we use the country of your connection to add one to a monthly count of new accounts in the UK, the EU/EEA or elsewhere. Only the monthly totals are kept, and they are not linked to your account. We use them to know how many people use FixTheWeek in each region, including for our EU representative — Article 6(1)(f) GDPR, our legitimate interest.
4. Cookies, analytics and marketing
Session cookies are necessary for logging in and for security, and the "locale" cookie remembers the language you chose for the website. Your theme choice and cookie preferences are stored in your browser. The current version has no active analytics or advertising trackers. If any are added, optional ones will not load before appropriate consent. Marketing messages are a separate, optional choice. Details are in the Cookie policy.
For EU/EEA users, applicable national ePrivacy rules also apply; for UK users, the Privacy and Electronic Communications Regulations (PECR) apply. We use separate opt-in consent for news and offers and do not rely on a marketing soft opt-in in this version. Security and account emails and the selected service reminders described above are separate from promotional messages. We must not add promotional content to a service reminder to bypass marketing choices.
5. Recipients and international transfers
Cloudflare supplies hosting, network delivery, the Worker and the D1 database. This involves website requests and security metadata as well as account and planning data stored in D1. Resend handles outgoing account-verification and password-reset emails, shopping lists you request and enabled notifications. It receives the recipient address and message contents; a shopping-list email can reveal food preferences. The code also supports an outgoing Cloudflare email binding if configured.
Premium is sold through Link, Stripe's merchant-of-record service (“Sold through Link”): Link sells you the subscription, takes the payments, calculates and pays the VAT and sends receipts, invoices and payment emails, and a Stripe group company processes the payments. For the sale and the payment, Link and Stripe process your name, email address, billing country and address, payment method and fraud-prevention data as independent controllers under their own privacy notices: https://link.com/privacy and https://stripe.com/privacy. We give Stripe your email address and your FixTheWeek account identifier so that payments are matched to your account, and receive back the subscription details described in section 2. For the customer and subscription records in our Stripe account, Stripe acts on our behalf. Stripe may process data outside the UK and the EEA under its own transfer safeguards.
Where your data goes: Cloudflare, Inc. hosts the service under its Data Processing Addendum; our database is stored in Western Europe, while network traffic and logs may be processed in Cloudflare's worldwide network, including the US. Resend (Plus Five Five, Inc.) sends our emails from the EU (Ireland) under its Data Processing Addendum; the company and some of its sub-processors are in the US. Stripe processes the customer and subscription records in our Stripe account on our behalf under its Data Processing Agreement and may process data worldwide, including the US. Emails you send to contact@fixtheweek.com are received in our Microsoft Outlook.com mailbox, which Microsoft provides under its own terms and may store outside the UK and the EEA. Our EU/EEA representative, DataRep, is in Ireland.
Transfers to the US rely on the EU–US Data Privacy Framework, and its UK Extension for UK data, where the provider is certified, with the EU standard contractual clauses (and the UK Addendum for UK data) in the provider's agreement as the fallback. Personal data of EU/EEA users reaches us in the UK under the EU adequacy decision for the UK. You can ask us for more information about these safeguards, or a copy of them, at contact@fixtheweek.com.
6. Retention and security
The following periods apply to the live application database. Account details, planning settings, saved plans, appliance choices, notification preferences, subscription records and minimal terms/adult/consent event history remain while the account exists, unless you edit or remove them earlier. Verified account deletion removes the account and linked records from that database. Consent history is not kept in a separate post-deletion archive. Health-data withdrawal removes the specific fields described above without requiring account deletion.
Login sessions expire after 30 days and may be renewed by continued use; signing out revokes the current session. Email-verification and password-reset links expire after one hour. The hourly maintenance job deletes expired session and verification rows, and authentication rate-limit counters after 30 days from their last recorded request. Shopping-list email counters are removed after 30 days from their recorded window start. If a scheduled run fails, cleanup resumes on the next successful run; expired credentials remain invalid.
Browser storage has the periods and removal controls listed in the Cookie policy. Closing an account cannot remotely erase copies in other browsers or exported files. Cloudflare keeps request logs for up to 7 days and database backups for 30 days; Resend keeps email data for 30 days. If we ever restore the database from a backup, we first record which accounts exist, and after the restore we delete again any account that was deleted in the meantime.
For Premium, the subscription record is kept while the account exists and is erased with it, after any running subscription has been cancelled. Processed Stripe event identifiers are deleted after 30 days, and a Premium launch choice 30 days after its email has been sent. Customer and invoice records in our Stripe account are kept for as long as tax and accounting law requires, normally at least five years after the relevant tax-return deadline; Link and Stripe keep their own transaction records under their own policies.
Access is limited to your own account and to authorised operators; we use encrypted connections, hashed passwords and access controls. No system can guarantee absolute security.
7. Your rights
You have rights of access, rectification, erasure, restriction, portability where applicable, objection to legitimate-interest processing and withdrawal of consent. Use “Privacy and data” in your account or write to contact@fixtheweek.com. We must respond without undue delay and normally within one month of receiving a request. Where complexity or the number of requests justifies it, this may be extended by up to two further months; we must explain the extension within the first month. We may seek proportionate identity confirmation where there are reasonable doubts. If a request is refused or a legal exception applies, we must give reasons and information about complaint and judicial remedies.
EU/EEA users may complain to the competent data-protection authority, in particular in the country of their habitual residence, workplace or the alleged infringement. Bulgaria’s authority is the Commission for Personal Data Protection: https://cpdp.bg/. For processing subject to UK data-protection law, you may complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/. These rights are not limited to Bulgaria and do not remove access to a judicial remedy.
8. Data-protection complaints
Raise a data-protection complaint through contact@fixtheweek.com. Tell us what happened and what outcome you seek; no legal terminology is required. For complaints subject to UK law, we must acknowledge receipt within 30 days, investigate and take appropriate steps without undue delay, keep you informed and explain the outcome without undue delay. This is different from the normally one-month deadline for an individual-rights request.
UK complaints requirements: ICO: data-protection complaints
9. Changes
If the purposes or the processing change significantly, we will publish a new version and, where necessary, notify users or ask for new consent. The version and date are shown below.