SmartEat
Start freeSign in

Privacy policy

Effective Date: September 16, 2026

This Privacy Policy describes how SmartEat Inc., doing business as MealsPortal, ("SmartEat," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with your use of the SmartEat platform, including the websites getsmarteat.com and mealsportal.com, and related products and services (collectively, the "Service").

Capitalized terms used but not defined in this Privacy Policy, such as "Business User," "Client," "Intake Form," and "Meal Plan," have the meanings given in our Terms of Service.

This Privacy Policy is a binding part of our agreement with you. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

Table of Contents

  1. Who We Are
  2. Information We Collect
  3. How We Use Information
  4. How We Share Information
  5. Cookies and Similar Technologies
  6. Children's Privacy
  7. California Privacy Rights (CCPA / CPRA)
  8. Rights of Users in the European Economic Area (GDPR)
  9. Information Security
  10. Data Breach Notification
  11. Third-Party Links
  12. Do Not Track Signals
  13. Email Marketing
  14. Changes to This Privacy Policy
  15. Contact Us

1. Who We Are

SmartEat Inc., doing business as MealsPortal, is a Delaware corporation with its principal place of business at 447 Sutter St, Ste 405 PMB 77, San Francisco, CA 94108. SmartEat operates the Service. For privacy-related questions, contact us at support@getsmarteat.com.

2. Information We Collect

2.1. Information You Provide Directly

When you use the Service, you may provide us with the following categories of information:

  • Client contact details: name, email address, and phone number, which Clients give in the Intake Form. The phone number is optional and requested only on some pages. A Business User can send a Client a link that already has these details filled in. Clients do not set a password: they open their Meal Plan through a link sent to their email address and can ask for the link to be sent again.
  • Business User sign-up details: the Business User's name (which they can change later in their account settings), email address, and password, or, if they sign up with Google, the name and email address from their Google account, and a link to its profile photo, which our sign-in provider saves automatically (we do not display or use it). Business Users who try the Intake Form themselves also give the answers described below about themselves.
  • Body metrics: height, weight, age, biological sex.
  • Fitness self-assessment: fitness goal (such as fat loss, maintenance, or muscle gain), number of workouts per week, fitness level, and daily activity level.
  • Health-related sensitive information: pregnancy and breastfeeding status (none, pregnant, breastfeeding 1-6 months, breastfeeding 7-12 months). This category is treated as sensitive personal information under the California Privacy Rights Act and as special category data under the EU General Data Protection Regulation. This question is asked only of those who select female as their biological sex. We use this information to generate an appropriate meal plan and, through our product analytics provider, to understand how the Intake Form is used and to improve the Service (see Section 4.2). We do not use it for advertising or for any other purpose.
  • Food preferences: vegetarian, pescatarian, dairy-free, or gluten-free, if any of these apply; the foods chosen in categories such as grains, bread, meat, fish, plant proteins, dairy, eggs, nuts, dried fruits, vegetables, fruits, sauces, oils, seeds and spices, sweet add-ons, treats, and protein supplements; the number of main meals and snacks per day and snack times; and cooking preference (cooking every day or cooking once for several days).
  • Meal Plan activity: the chosen start day, meals swapped or marked as made, items checked off on the grocery list, preferred units of measurement, and ratings and notes about the plan.
  • Payment information: payment card information is collected and processed directly by our payment processor, Stripe. SmartEat does not store full card details on its own systems. We keep records of subscriptions and purchases (such as the plan or credit pack, price, dates, status, and refunds, and, for Business Users, earnings and payouts) and the payment details Stripe shares with us, such as the name, email address, and billing address on the payment and the card brand and last four digits.
  • Business User account and page information: business name and type, logo or profile photo, welcome text, page address, brand color, reply-to email address, page settings (such as foods to hide from Clients, who pays, the subscription price, and limits on who can join), and Stripe Connect account details.
  • Information Business Users provide about their Clients: a Business User may approve or decline their Client, edit their Client's Intake Form answers and Meal Plan settings (such as nutrition targets, the number of meals and snacks per day, cooking frequency, and units of measurement), and change meals in their Client's Meal Plan.
  • Communications you send to us: support requests, feedback, messages sent through our contact form (name, email address, and message), live chat messages, and the details given when booking a call with us (such as name and email address).

2.2. Information Collected Automatically

When you use the Service, we automatically collect certain information about your device and your interactions, including IP address, browser type and version, operating system, language preferences, the pages of the Service you visit, the time spent on those pages, the content you interact with, access times and dates, similar usage statistics, recordings of how you use pages of the Service (session replay), whether the emails we send you are delivered, opened, or clicked, and how you arrived at the Service (such as the website or advertising campaign that referred you). For signed-in Business Users, this information is linked to their account. For Clients, it can be linked to them through the link to their Meal Plan and through the emails we send them. This information is collected through cookies, similar technologies, and server logs.

3. How We Use Information

We use the information we collect for the following purposes:

  • To create and manage your account.
  • To generate and deliver Meal Plans based on your Intake Form responses.
  • To process payments, payouts, and refunds through Stripe.
  • To send transactional and service-related communications (such as confirmation that an Intake Form was received, that a plan is ready, billing notifications, and security messages).
  • To respond to your inquiries and provide customer support.
  • To monitor, secure, and improve the Service, including diagnosing technical problems and preventing fraud or abuse.
  • To send marketing and product communications, including but not limited to promotional offers, product updates, re-engagement messages, win-back communications, and similar outreach. You may opt out of marketing communications at any time, but transactional and service-related communications will continue.
  • To analyze usage of the Service, understand user behavior, improve product features and content, and conduct session replay analysis. We use product analytics, web analytics, and session replay tools (described in Section 4.2) for these purposes.
  • To enforce our Terms of Service, comply with legal obligations, and protect our rights and the rights of others.
  • For other purposes consistent with the Service we provide and your reasonable expectations as a user.

We use sensitive personal information (pregnancy and breastfeeding status) only to generate the Meal Plan and to improve the Service, including through analytics of how the Intake Form is used (see Section 4.2). We do not use it for advertising or for any other purpose.

4. How We Share Information

4.1. Sharing with Business Users

If you are a Client, the information you provide in the Intake Form is shared with the Business User you have selected, for the purpose of preparing your Meal Plan. Specifically, the Business User can see your name, email address, phone number (if you gave it), and full Intake Form responses, including body metrics, fitness self-assessment, food preferences, and pregnancy or breastfeeding status. The Business User can also see your Meal Plan and your activity in it (such as meals swapped or marked as made, and whether you liked the free first day, with any comment you left). They also see which part of the Meal Plan is open to you and until when (the free first day; a free trial and when it ends; or the full week, with the date it renews or ends), and, if you pay yourself, whether your last payment failed. They also see how you reached the Intake Form: which of their pages you used and, if the link was marked, whether it came from their QR code, poster, or another of their materials.

The Business User cannot see your full payment card details, which are handled directly by Stripe. The trainer, coach, or business whose link you used to fill out the Intake Form runs their own business, so how they use your information and keep in touch with you outside the Service is up to them and is their responsibility rather than SmartEat's. If you have any questions about it, they are the best people to ask.

Clients, in turn, see the Business User's business name, logo or photo, and welcome text on the Business User's page. Our emails to Clients also show the Business User's reply-to email address, which is their sign-in email address unless they set a different one in their account.

4.2. Sharing with Service Providers

We share information with third-party service providers who help us operate the Service. We share only the information necessary for them to perform their function, and only for the purposes described in Section 3. Most of these providers act on our behalf: under their agreements with us, they may use the information only to provide their services to us and must keep it secure. Advertising platforms, Google (when you sign in with Google), and Calendly also use the information they receive for their own purposes, under their own privacy policies, which govern how they use and protect it. The categories of service providers include:

  • Hosting and file storage: Vercel Inc., for hosting our websites and running the application. Vercel processes all traffic to our websites, including information you submit through forms, and retains technical logs of that traffic (such as IP addresses, browser types, and pages requested) for a limited period. Vercel also stores images that Business Users upload, such as logos and profile photos, which are displayed publicly on their pages.
  • Database and account sign-in: Neon, LLC (a Databricks company), for our database and for Business User sign-in (sign-up, sign-in, and password storage). The database stores Business User account and profile information, and the IP address and browser of each sign-in session; Clients' contact details and Intake Form responses; Meal Plans and how Clients use them (such as meals swapped or marked as made, and plan ratings and notes); payment, credit, and payout records, including the records we receive from Stripe (which may contain names, email addresses, billing details, the card brand, last four digits, and expiry date, and, for Business Users, payout bank details such as the bank name and the last four digits of the account number, but never full card or bank account numbers); a record of the emails we send; and how Clients, Business Users, and people who start to sign up first found us (such as the page or advertising campaign they came from).
  • Sign in with Google: Google LLC, if you are a Business User and choose to sign in with a Google account. Google confirms your identity and shares your basic profile information, such as your name and email address, with us.
  • Payment processing: Stripe, Inc., for all payments on the Service: Clients' subscription payments, including the automatic monthly renewal charges, and the billing portal where Clients update their card, see past payments, or cancel their subscription; Business Users' purchases of credits, with the invoices and receipts for them, and, if a Business User turns on automatic top-up, saving their card and charging it automatically when their credits run short; refunds; and payouts to Business Users through Stripe Connect, including the identity verification Stripe performs for payouts. Stripe receives the payer's name, email address, and card details, and stores the card details; we never receive full card numbers.
  • Email delivery: Sendinblue SAS (Brevo), for sending emails to Business Users and Clients: account and sign-in emails, emails about Meal Plans and payments, messages sent through our contact form, internal alerts to our team, and marketing emails when we send them. Emails to Clients are sent in their Business User's name. Brevo receives names, email addresses, and the content of these emails, which may include a Client's name and stated goal, a link to their Meal Plan, payment details such as amounts and dates, and plan ratings and notes. Brevo also records whether each email was delivered, opened, and clicked. Brevo does not receive body metrics or pregnancy or breastfeeding status.
  • Product analytics and session replay: PostHog, Inc., on all pages of the Service, for understanding how people use the Service, improving it, and detecting and fixing errors. PostHog receives device and usage information, such as IP address, browser, pages viewed, including the full page address (for Clients, this can include the link to their Meal Plan and, if their Business User's link fills in the form in advance, their name, email address, and phone number), and the buttons and links you click, including their text (which can include answers you select in the Intake Form); for signed-in Business Users, it also receives their account identifier, email address, and page address, and records of their credit purchases and use and of their Clients' subscription payments, including the Business User's share. When something goes wrong in the Service, PostHog also receives an error report, such as the page where the error happened, your browser, and technical details of the error. PostHog's session replay records how pages of the Service are used, including the Intake Form and the Business User account area (such as mouse movements, clicks, scrolling, the content shown on screen, and technical messages from the browser); text typed into form fields is masked and not recorded. Session recordings are kept for 30 days and then deleted.
  • Web analytics: Google LLC (Google Analytics), through the Google tag on every page of our business-facing website getsmarteat.com, including its advertising landing pages, sign-in pages, and the Business User account area. Google Analytics receives information such as the pages you visit, the actions you take, your IP address, and cookie identifiers. The Google tag is not placed on the Client-facing website mealsportal.com.
  • Advertising platforms: Google LLC (Google Ads, which can use data from the same Google tag) and Meta Platforms, Inc. (Facebook and Instagram, via Meta Pixel on our website getsmarteat.com, including our advertising landing pages), for audience targeting and remarketing, suppression of existing customers from acquisition campaigns, lookalike audience building, and measurement of advertising effectiveness. These tags receive information such as the pages you visit, the actions you take, your IP address, and browser identifiers. They are not placed on the Client-facing website mealsportal.com.
  • Web fonts: Google LLC (Google Fonts), which receives your IP address and browser information when our advertising landing pages or our emails load their fonts.
  • Scheduling: Calendly LLC. If you book a call with our team, you enter your name, email address, and any other details the booking form asks for on Calendly's scheduling page; Calendly receives them and shares them with us to arrange the call.
  • Domain and email routing: Cloudflare, Inc., for domain name system (DNS) services for our websites and for routing email sent to addresses at our domains, such as our support addresses. Cloudflare processes these emails, including their content, and forwards them to our support mailbox.
  • Support mailbox: Google LLC (Google Workspace), which hosts the mailbox that receives the emails you send to our support addresses, including their content.
  • Live chat: Crisp IM SAS (Crisp), for live chat on our website getsmarteat.com and in the Business User account area. Crisp receives the messages you send in the chat and any contact details you choose to share there, such as your name or email address, together with your IP address, browser information, and an identifier stored in your browser. The chat is not shown on Client-facing pages. In the Business User account area, Crisp also receives the signed-in Business User's name and email address, so that we know who is writing.
  • Wallet cards: WalletWallet (walletwallet.dev), for the Apple Wallet and Google Wallet card of a Business User's page, made when the Business User opens the Promote section of their account area. WalletWallet receives the Business User's business name and the page's name and address, and signs and hosts the card.

4.3. Sharing with Advertising Platforms

We may share certain identifiers (such as hashed email addresses) with third-party advertising platforms (such as Meta, Google, and similar) for purposes including but not limited to: building custom audiences, suppressing existing customers from acquisition campaigns, building lookalike audiences for prospecting, and measuring advertising effectiveness.

4.4. Other Sharing

We may also disclose information when we believe in good faith that disclosure is necessary to:

  • Comply with a subpoena, court order, or other legal process;
  • Enforce our Terms or investigate potential violations;
  • Protect the safety, rights, or property of SmartEat, our users, or the public;
  • Investigate fraud or security issues.

If SmartEat is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

4.5. Information We Do Not Sell

SmartEat does not sell personal information for monetary consideration.

5. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, analyze usage, and support advertising. When you visit our website getsmarteat.com, our advertising partners (Google and Meta) may collect information about your online activities over time and across different websites. You can opt out of interest-based advertising from Google in Google's My Ad Center (myadcenter.google.com), from Meta in the ad preferences of your Facebook or Instagram account, and from many other advertising companies at optout.aboutads.info. You can learn how Google uses information from websites that use its services at policies.google.com/technologies/partner-sites. You can control cookies through your browser settings; however, disabling cookies may affect your ability to use certain features of the Service.

Our live chat provider (Crisp) stores an identifier in your browser so that a conversation can continue across visits. It is set only on our website getsmarteat.com and in the Business User account area, not on Client-facing pages. If you do not use the chat, you can clear it through your browser settings along with any other site data.

6. Children's Privacy

The Service is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has provided personal information to us, please contact us at support@getsmarteat.com.

For users between 13 and 17 years of age, we recommend parental supervision when using the Service. If you are a parent or guardian and become aware that your child has provided us with personal information without your consent, please contact us so that we can take appropriate action.

7. California Privacy Rights (CCPA / CPRA)

This section provides additional disclosures and rights for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"). This section applies to all California residents and is provided in accordance with our obligations as a California-based business; the rights described here are specific to California residents.

7.1. Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information, as defined under the CCPA:

  • Identifiers: name, email address, phone number, IP address, and online identifiers (such as cookie and device identifiers, the link to a Client's Meal Plan, and a Business User's account identifier and page address).
  • Customer records: name, email address, and phone number; and, for Clients and Business Users who pay through the Service, billing address and payment details (the card brand and last four digits; full card numbers are handled by Stripe and not stored by us).
  • Characteristics of protected classifications: age and biological sex.
  • Commercial information: records of subscriptions and credit pack purchases; food preferences from the Intake Form, as listed in Section 2.1; and Meal Plan activity (such as meals swapped or marked as made and items checked off on the grocery list).
  • Internet or other electronic network activity: pages visited and interactions with the Service (including session recordings), device and browser information, whether the emails we send are delivered, opened, or clicked, and how a visitor arrived at the Service.
  • Geolocation data: approximate location derived from IP address (not precise geolocation).
  • Audio, electronic, visual, or similar information: the logo or profile photo a Business User uploads, and a link to the profile photo of a Google account used to sign in (saved automatically by our sign-in provider; we do not display or use it).
  • Professional information: for Business Users, their business name and type and their Stripe Connect account details.
  • Inferences: nutrition targets (such as daily calories and macronutrients) calculated from Intake Form answers.
  • Sensitive personal information: pregnancy and breastfeeding status; health-related information from the Intake Form (body metrics and fitness self-assessment); and a Business User's login credentials (email address with a password).

7.2. Sources of Personal Information

We collect personal information from the following sources:

  • Directly from the people who use the Service: from Business Users when they sign up, set up their page, and use their account area; from Clients when they fill in the Intake Form and use their Meal Plan; and from anyone who contacts us by email, through our contact form, in live chat, or by booking a call.
  • Automatically from the device and browser of anyone who visits or uses the Service (through cookies, server logs, and similar technologies).
  • From Business Users, about their Clients: a Business User can send a Client a link with the Client's name, email address, and phone number already filled in, approve or decline the Client, and change the Client's Intake Form answers, Meal Plan settings, and meals.
  • From Google, when a Business User signs in with Google (name, email address, and a link to the profile photo).
  • From service providers acting on our behalf: Stripe (payment details and, for Business Users, their Stripe Connect account details) and Brevo, our email service (whether the emails we send are delivered, opened, or clicked).

7.3. Business Purposes for Collection

We collect and use personal information for the business purposes described in Section 3 above, including providing the Service, processing payments, supporting users, communicating with users, marketing, analytics, security, and legal compliance.

7.4. Categories of Third Parties

We disclose personal information to the categories of third parties described in Section 4 above, including Business Users (for their Clients' information), hosting and database providers, sign-in providers, payment processors, email delivery providers, analytics, session replay, and error tracking providers, advertising platforms, font, scheduling, domain, email routing, and email hosting services, live chat providers, and wallet card services.

7.5. Sale and Sharing of Personal Information

"Sale" under the CCPA means disclosing personal information to a third party for monetary or other valuable consideration. "Sharing" under the CCPA means disclosing personal information to a third party for cross-context behavioral advertising.

SmartEat does not sell personal information for monetary consideration. SmartEat may share certain identifiers (such as hashed email addresses) with advertising platforms for cross-context behavioral advertising, as described in Section 4.3.

7.6. Use of Sensitive Personal Information

California residents have the right to limit the use of sensitive personal information to that which is necessary to provide the Service requested. SmartEat collects sensitive personal information (pregnancy and breastfeeding status, and health-related information from the Intake Form) only to provide and improve the Service, including through analytics services performed on our behalf, and does not use it for purposes that would be subject to the right to limit (such as inferring characteristics or for advertising). Therefore, no additional limitation request is necessary; however, you may contact us at any time to confirm or object.

7.7. Your California Privacy Rights

As a California resident, you have the following rights:

  • Right to know: request information about the categories and specific pieces of personal information we have collected, the sources, the purposes for collection, and the categories of third parties to whom we disclose it.
  • Right to delete: request deletion of personal information we have collected, subject to certain exceptions (such as information needed to complete a transaction, comply with a legal obligation, or detect security incidents).
  • Right to correct: request correction of inaccurate personal information.
  • Right to opt out of sale or sharing: request that we not share your personal information for cross-context behavioral advertising.
  • Right to limit use of sensitive personal information: as described in Section 7.6.
  • Right to non-discrimination: we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact us at support@getsmarteat.com. We may need to verify your identity before responding to your request. We will respond within the time period required by law.

7.8. Retention of Personal Information

We retain personal information for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specifically:

  • Business User account information: retained while the account exists. When a Business User asks us to delete their account, we delete it, except records we must keep for tax, accounting, or legal purposes.
  • Client information (contact details, Intake Form answers, and the Meal Plan): retained until the Client asks us to delete it (see Section 7.7), except records we must keep for tax, accounting, or legal purposes.
  • Payment information: records of payments, credit packs, earnings, and payouts, and the payment details Stripe shares with us, are retained as long as needed for tax, accounting, and legal purposes. Full card numbers are held only by Stripe.
  • Communications: retained for a reasonable period to support continuity of customer service.
  • Server logs and analytics data: retained for a limited period for security, debugging, and product improvement, then aggregated or deleted.

After deletion, we may keep information from the categories above in de-identified form for product analytics, and we do not try to re-identify it.

8. Rights of Users in the European Economic Area (GDPR)

The Service is directed to users in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and similar laws.

8.1. Legal Bases for Processing

We process personal information on the following legal bases:

  • Performance of a contract: to provide the Service you have requested.
  • Consent: for processing of sensitive personal information (pregnancy and breastfeeding status) and for marketing communications.
  • Legitimate interests: for analytics, security, fraud prevention, and improving the Service, where these interests are not overridden by your rights.
  • Legal obligation: where processing is necessary to comply with applicable law.

8.2. Your Rights

You have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate or incomplete information.
  • Request deletion (the "right to be forgotten").
  • Restrict processing of your personal information.
  • Object to processing based on legitimate interests, including direct marketing.
  • Receive your personal information in a portable format.
  • Withdraw consent at any time, where processing is based on consent.
  • Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at support@getsmarteat.com.

8.3. International Data Transfers

Your personal information may be transferred to and processed in the United States, where SmartEat is established. The United States may have data protection laws different from those in your country. Where required by law, we rely on appropriate safeguards for international transfers, such as the Standard Contractual Clauses approved by the European Commission.

9. Information Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, and destruction. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

10. Data Breach Notification

In the event of a data breach affecting your personal information, we will take reasonable steps to investigate and address the breach. Where required by law, we will notify affected users and applicable regulators within the time periods required by applicable law.

11. Third-Party Links

The Service may contain links to third-party websites or services that we do not own or control. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.

12. Do Not Track Signals

Some browsers offer a "Do Not Track" signal. Currently, there is no industry-standard interpretation of this signal, and the Service does not currently respond to Do Not Track signals. As described elsewhere in this Privacy Policy, you may exercise specific privacy rights through the means we provide.

13. Email Marketing

If you receive marketing emails from us, you may unsubscribe at any time using the unsubscribe link included in each email or by contacting us at support@getsmarteat.com. Even if you unsubscribe from marketing emails, we will continue to send you transactional and service-related emails (such as confirmations, billing notices, and security alerts), as these are necessary for the operation of the Service.

In compliance with the CAN-SPAM Act, every marketing email we send identifies the sender, provides a clear way to opt out, and includes our physical mailing address.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this document. Material changes will apply only to your future use of the Service after the change takes effect. Your continued use of the Service after the Effective Date constitutes your acceptance of the revised Privacy Policy. We will make reasonable efforts to notify you of material changes.

15. Contact Us

If you have any questions about this Privacy Policy or our practices, or if you would like to exercise any of your privacy rights, please contact us:

SmartEat Inc., doing business as MealsPortal
447 Sutter St, Ste 405 PMB 77
San Francisco, CA 94108
Email: support@getsmarteat.com