Privacy Policy

1. Who we are

Tova is operated by M28 Ventures BV, a company registered in Belgium. Our contact address for privacy matters is hello@tovameals.com. General enquiries: hello@tovameals.com.

M28 Ventures BV is the data controller for personal data processed through the Tova application and website.

2. What data we collect and why

Account data (email address, display name): collected when you register, used to authenticate you and send account notifications. Legal basis: performance of a contract.

Family & household data (family size, dietary preferences, allergies): collected during onboarding and settings, used to personalise meal plans and shopping lists. Legal basis: performance of a contract; where data concerns health (allergies), explicit consent.

Health data (weight, calories, protein, water, workout logs): collected only when you actively log it via the Health section. Legal basis: explicit consent. You may delete this data at any time.

Meal and shopping data: generated by the app and stored on your behalf so you can access plans across devices. Legal basis: performance of a contract.

Payment data: processed entirely by Stripe. We store only your Stripe customer ID and subscription status — never raw card numbers.

Usage analytics (page views, feature interactions, session duration): collected only with your consent (via the consent banner or Settings > Privacy). We use PostHog for analytics. No personal identifiers are included in analytics events.

Support communications: if you contact us by email, we retain the correspondence for up to 3 years to provide support and meet legal obligations.

3. Data storage and security

Your data is stored on servers located in the European Union. All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). We never sell, rent, or share your personal data with third parties for marketing purposes.

Access to production data is restricted to authorised personnel and AI agents acting under human governance. All access is logged.

4. Third-party services

• Stripe — payment processing. Stripe's privacy policy: stripe.com/privacy.
• PostHog — analytics (only with your consent). PostHog's privacy policy: posthog.com/privacy.
• Base44 — application hosting and database infrastructure, EU-hosted.
• Google Fonts — web fonts served from Google's CDN. No personal data is transmitted beyond standard browser request headers.

5. Cookies

We use strictly necessary cookies for authentication. Optional analytics cookies are only set after you give consent. See our Cookie Policy for full details.

6. Your rights under GDPR / UK GDPR

If you are located in the EU or UK you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate data via Settings, or by emailing us.
• Right to erasure ("right to be forgotten") — delete your account and all associated data via Settings > Delete Account, or by emailing hello@tovameals.com.
• Right to data portability — request an export of your data in a machine-readable format.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — withdraw analytics consent at any time via Settings > Privacy.
• Right to lodge a complaint — with your national supervisory authority. For Belgium: dataprotectionauthority.be.

We respond to all rights requests within 30 days. To exercise any right, email hello@tovameals.com with the subject "Data Rights Request".

7. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days. Anonymised aggregate analytics data may be retained indefinitely.

Financial records (subscription and billing history) are retained for 7 years to comply with Belgian tax law, even after account deletion.

8. Children

Tova is intended for users aged 16 and over. We do not knowingly collect data from children under 16. If you believe we have inadvertently collected data from a child, please contact us immediately.

9. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email and by displaying a notice in the app at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact

Data controller: M28 Ventures BV, Belgium
Privacy contact: hello@tovameals.com
General contact: hello@tovameals.com