Eat & Lift Privacy Policy

Last updated: 18 June 2026

Thank you for choosing Eat & Lift. Protecting your privacy is at the core of how we build our services. This Privacy Policy explains what Personal Data we collect, how we use it, the limited circumstances in which we share it, and the choices and rights you have.

1. Scope of this Policy

This Policy applies when you:

• Use the Eat & Lift mobile application (the "App"),
• Visit eatnlift.com or any sub‑domain (the "Website"), or
• Communicate with Nedeveon EOOD for support, feedback, or other reasons.

It does not cover third‑party sites or services that link to or from our products.

2. Who We Are

Nedeveon EOOD (reg. no. 207677715) is a company established under Bulgarian law with its registered office at ul. „Bitolya 5", fl. 1, apt. 3, 9002 Varna, Bulgaria. For the purposes of the EU/UK General Data Protection Regulation (GDPR/UK GDPR) and comparable laws, we act as the Data Controller for the processing described here.

Email: [email protected]
Data‑Protection Officer (DPO): [email protected]
Supervisory authority: Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria.

3. Key Terms

• "Personal Data" - any information that relates to an identifiable individual.
• "Processing" - any operation performed on Personal Data, e.g. collection, storage, use, disclosure or deletion.
• "EEA" - European Economic Area.
• "You" / "User" - anyone who downloads or uses the App, visits the Website, or contacts us.

4. Personal Data We Collect

† Disabled by default; you can enable them in Settings → Analytics (for analytics) or Settings → Crash Reports (for crash reporting).

We never deliberately collect data about persons under 18.

5. Why We Process Your Data & Legal Bases

Where we rely on legitimate interests, we balance our need to process the data against your rights and expectations.

6. Health Connect & Apple Health

Eat & Lift can connect to your device's health platform — Health Connect on Android and Apple Health on iOS. This integration is optional and off by default; it works only after you enable it in Settings → Health and grant permission on the platform itself.

With your permission, we read and/or write only the following data types, each for a specific in-app feature:

• Steps (read) — show your daily activity and include it in your energy-balance calculations.
• Active energy burned (read) — factor movement into your daily calorie budget.
• Total calories burned (read & write) — read for your energy balance; written for workouts you log in the App.
• Body weight (read & write) — read to populate your weight history; written when you log your weight in the App.
• Workouts / exercise (read & write) — read to complete your training history; written for workouts you log in the App.
• Distance (read & write) — read and written for distance-based activities you record.
• Nutrition (read & write) — read to complete your intake; written for meals you log in the App.

How we handle it. Health platform data is used solely to provide these tracking features for you. We never use it for advertising or marketing, never sell it, and never share or transfer it to third parties for those purposes. It is stored locally on your device by default and is included in encrypted server backups only if you turn on Backup & Sync. We write back only records that you created in the App, and health data is never sent to any AI feature without your separate, explicit action.

Your control. You can disable the integration at any time in App → Settings → Health, and you can review or revoke individual permissions directly in Health Connect (Android) or the Apple Health app (iOS). Revoking stops all further reading and writing.

Our use of Health Connect complies with Google Play's Health Apps requirements and the Health Connect permissions (limited use) policy; our use of Apple Health (HealthKit) data complies with Apple's requirements. In both cases this data is never used for advertising, marketing, or data-mining.

7. Who Receives Your Data

We do not sell Personal Data. We only share it with:

Each processor is contractually obliged to act only on our instructions and to implement adequate technical and organisational security measures.

8. International Transfers

Your primary data (and all backups) are stored in the EU. Where we must transfer Personal Data outside the EEA/UK, we rely on:

• Adequacy decisions (e.g. EU‑US Data Privacy Framework), or
• Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented where necessary by additional safeguards.

9. Data Retention

We irreversibly destroy or anonymise data after the retention period expires.

10. Security Measures

• Encryption‑in‑transit & at‑rest (TLS, LUKS).
• Least‑privilege access controls and MFA for staff.
• Regular security patches.
• Continuous monitoring for suspicious activity.

While no system is 100% secure, we follow industry best practices to reduce risk.

11. Your Privacy Choices & Rights

Depending on where you live, you may have the right to:

• Access the Personal Data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase data ("right to be forgotten");
• Restrict or object to certain processing;
• Port your data to another service;
• Withdraw consent at any time (e.g. disable Backup & Sync or analytics);
• Opt‑out of "sale" or "sharing" of Personal Data (California CCPA/CPRA - we already refrain from these activities);
• Lodge a complaint with a supervisory authority.

We will never discriminate against you for exercising your rights.

12. How to Exercise Your Rights

In-App Actions

• Delete account & synced data: App → Settings → My Profile → Delete Account
• Enable / Disable Backup & Sync: App → Settings → Backup & Sync
• Enable / Disable Analytics: App → Settings → Analytics
• Enable / Disable Crash Reports: App → Settings → Crash Reports
• Export your data: App → Settings → Export Data

Email Requests

For other requests (access, portability, objection, etc.), email [email protected] from your registered address.

We may verify your identity before responding. We respond within 30 days (or faster where required).

13. Cookies & Similar Technologies

We do not use cookies or any similar tracking technologies on our Website.

14. Children's Privacy

We do not knowingly collect Personal Data from persons under 18. If we learn that such data has been collected without verifiable parental consent, we will delete it promptly.

15. Changes to this Policy

We will post any material changes here and, where appropriate, notify you via the App or email. The "Last updated" date at the top reflects the latest revision.

16. Contact Us

If you have questions about this Policy or our data practices, please contact our DPO:

You also have the right to lodge a complaint with your local data‑protection authority; in Bulgaria, that is the CPDP (www.cpdp.bg).