eatmondo

Privacy Policy

We take the protection of your personal data seriously. This policy explains what data we process when you visit this website, why we process it, and which rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

The controller responsible for data processing on this website is:

Collective Brain GmbH
Kattrepelsbrücke 1
20095 Hamburg
Germany
Email: info@collectivebrain.de
Phone: +49 40 46 89 67 68 0

Further company details can be found in our imprint.

2. Hosting and server log files

This website is hosted by Mittwald CM Service GmbH & Co. KG in Germany. All data is processed on servers located in Germany.

When you visit this website, the web server automatically collects technical information in so called server log files. This typically includes the IP address of your device, date and time of the request, the requested page, browser type and version, operating system and the referring URL. This data is technically necessary to deliver the website to you, to ensure its stability and security, and to detect and prevent misuse.

The legal basis for this processing is Art. 6 (1) (f) GDPR, our legitimate interest in providing and securing this website. Log files are deleted or anonymised after a short period unless they are needed to investigate a specific security incident.

3. Audience measurement (Umami)

To see which content people are looking for and where our pages run into technical trouble, we measure usage with Umami. The software runs on an instance we operate ourselves (analytics.collectivebrain.de). No data goes to an analytics provider such as Google, and no profiles are built across different websites.

For each page view we process: the page requested, the page you came from (referrer), screen size, browser, operating system, device type and language setting, as well as country, region and city. The location is derived from your IP address; the IP address itself is not stored. It goes into an irreversible checksum together with details from your browser and a random value that we rotate regularly, so that several requests can be roughly grouped into one visit. Once that random value changes, even that link is gone.

Umami sets no cookies and stores no identifier in your browser. Because this involves no access to information on your device beyond what is technically necessary, we do not need your consent for it under Art. 5 (3) of the ePrivacy Directive and its national implementations, and you do not see a cookie banner. The legal basis is our legitimate interest in a data minimising analysis of how our service is used (Art. 6 (1) (f) GDPR).

You can object to the measurement at any time. The switch below turns it off on this device. We only remember this one setting; no further data is created by it.

Alternatively you can enable "Do Not Track" in the privacy settings of your browser, in which case we record nothing either. Browser extensions that block scripts prevent the measurement as well.

4. Cookies and third party tracking

Beyond the first party statistics described above, we do not use any web analytics from third party providers (such as Google Analytics), no online marketing, no retargeting and no social media plugins with tracking. We do not use tracking cookies or advertising cookies. Only storage that is strictly necessary for the operation of the website is used, for example a session cookie that keeps you signed in after you log in to your account.

5. Contact by email

If you contact us by email, we process the data you provide (your email address and the content of your message) solely to handle your request. The legal basis is Art. 6 (1) (f) GDPR, or Art. 6 (1) (b) GDPR if your request relates to a contract. We delete this data once your request has been fully handled, unless statutory retention obligations apply.

6. Member account (saved recipes, meal planner, messages)

You can create a free member account to save recipes and coaches, keep a weekly meal plan with a shopping list, and message coaches directly. For this we process your email address, your password in encrypted form, optionally your first name, and the content you create (saved list, meal plan entries, messages). You confirm your registration by email (double opt-in); we send these transactional emails ourselves and do not use them for marketing. Legal basis: Art. 6 (1) (b) GDPR (providing the account).

Messages between you and a coach are visible only to the two of you; our editorial team can access them solely for moderation and to handle reports. When you receive a new message, we notify you by email at your account address. Please do not include health data in messages; such topics are best discussed directly in a consultation. You can delete your account yourself at any time in the account area; this also removes your saved list, your meal plan and your conversations.

7. Push notifications

If you enable notifications in your inbox, we send you a note via your browser's push service (for example Google, Mozilla or Apple, depending on your browser) as soon as someone writes to you. Only the sender's name is transmitted, never the content of the message; the transmission is encrypted. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time in your browser settings. The push service may process technical identifiers of your browser; we have no influence on that processing.

8. Recipe comments

You can comment on recipes and optionally upload your own photos. We store the name you provide, your comment text, your optional email address, uploaded photos and the time of your consent. Comments and photos are reviewed by our editorial team and only shown publicly on the recipe after approval; visible are then only your name, comment and photos. Your email address is never published and is used solely for possible questions about the approval. By uploading photos you confirm that you took them yourself and agree to their publication. Please do not include sensitive data in comments, in particular no health data. Legal basis: Art. 6 (1) (a) GDPR (your consent when submitting) and Art. 6 (1) (f) GDPR (operating a comment function). You can request the deletion of your comment and photos from us at any time.

9. Food diary

As a member you can voluntarily keep a food diary: you log what you have eaten (via barcode scan, from our recipes or manually) and see calories and nutrition facts as estimates. These entries can allow conclusions about your diet and may therefore be particularly sensitive. We therefore store your diary only with your explicit consent (Art. 9 (2) (a) GDPR), which you give separately when you first open the diary and whose time we document.

We store only your entries (food or recipe, amount, meal, date) and the nutrition estimates calculated from them. We do not collect your weight or calorie goals and we do not give dietary recommendations; the diary only keeps a log. Your entries are visible only to you; our team can access them solely for troubleshooting and support requests. You can export all entries as a file at any time (Art. 20 GDPR) and delete your diary completely and immediately with one click, which also withdraws your consent (Art. 17 GDPR). Deleting your account also deletes your diary.

10. Coach account and membership

If you register as a coach, we process the data you provide (name, email, password in encrypted form, address and profile data, coaching format, focus areas, qualifications, contact details) to provide your profile and to perform the contract (Art. 6 (1) (b) GDPR).

Proof of qualification: your uploaded document (certificate or diploma) is used exclusively for our internal review. It is stored confidentially, never shown publicly and never passed on to third parties.

11. Payment processing (Stripe)

We use Stripe to process membership payments. The provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you purchase a membership, you are redirected to Stripe's secure payment form; your payment details (such as card data) are processed directly by Stripe. We ourselves never receive full payment details, only the confirmation of the payment and billing information. Legal basis: Art. 6 (1) (b) GDPR (performance of the contract). Where Stripe transfers data to the USA, this is based on the EU-U.S. Data Privacy Framework adequacy decision and EU standard contractual clauses. Details: stripe.com/privacy. You can manage and cancel your membership yourself via the Stripe customer portal.

12. Coach directory (public listing)

We operate a public directory of nutrition coaches and registered dietitians. It may contain entries we have compiled from publicly available sources, such as public business and map directories, company websites and public business profiles. For these entries we process business related information: the name or business name, address, phone number, website, a publicly listed email address where available, and location coordinates used to display the entry on a map.

The legal basis for this processing is our legitimate interest under Art. 6 (1) (f) GDPR: connecting people who are looking for nutrition advice with suitable coaches and making the listed providers easier to find. For each entry compiled from public sources we indicate the source.

You can object to the inclusion and display of your entry at any time and request its correction or erasure (Art. 17, 21 GDPR). To do so, use our listing removal page or email us at info@collectivebrain.de; we will then remove the entry promptly. Coaches can also claim their entry, get verified and afterwards manage or delete their profile themselves.

To research publicly available business information for this directory, we use Apify Technologies s.r.o., Prague, Czech Republic (EU) as a processor.

13. Your rights

As a data subject, you have the following rights under the GDPR:

To exercise any of these rights, simply send us an email at info@collectivebrain.de.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit).

14. Information for California and other U.S. residents

We maintain a public directory of nutrition coaches and registered dietitians. Some entries in this directory are compiled from publicly available business sources, such as public web listings, business directories and company websites, rather than submitted directly by the coach. If you are a California resident, or a resident of another U.S. state with a comprehensive privacy law, the following applies to that directory.

Categories of personal information we process for directory entries: business or professional name, business address, phone number and website, plus approximate location coordinates used to place the entry on a map. We do not collect government identifiers, financial account information or precise geolocation beyond that approximate business location.

Purpose: operating a public professional directory that helps people find nutrition coaches and registered dietitians near them.

We do not sell or share your personal information as defined by the CCPA/CPRA, and we do not use it for cross-context behavioral advertising. To research publicly available business information for this directory, we may use Apify Technologies s.r.o. (Prague, Czech Republic) as a service provider.

You have the right to know what personal information we hold about you, to request its correction or deletion, and to opt out of being listed. To exercise any of these rights, use our listing removal page or email us at info@collectivebrain.de. We will not discriminate against you for exercising these rights.

This section supplements, and does not replace, the rest of this privacy policy.

15. Changes to this policy

We may update this privacy policy from time to time, for example when we add new features to the website or when legal requirements change. The current version is always available on this page.

Last updated: August 2026