Privacy Policy

1. Who is responsible

The data controller is Kiran Mistry, who runs WEEK ONE. Contact: week-one@outlook.com.

2. What we collect

• Account: your email address and sign-in details, or your Google account email if you sign in with Google.
• Body and goals: answers you give in the walkthrough, such as age, sex, height, weight, activity level, goal, diet choices (for example vegan or gluten-free), foods you like and your weekly food budget.
• Household: if you add other adults, the details you enter for them.
• Plans and progress: meal plans, meal swaps, calendar entries, weight logs, workout logs and spending notes you save.
• Location: a postcode or location you enter to find nearby shops.
• Coach chats: messages you send to the in-app coach and its replies.
• Payments: your purchase and subscription status, invoices and payment events. Card details are entered on Stripe's page and are not stored by WEEK ONE.

Body measurements and diet choices can reveal health information. We use them only to build your plan.

3. Why we use it

• To run your account and build your meal, budget and training plans (to provide the service you asked for).
• To take payments, manage access and handle refunds or disputes (contract and legal obligations).
• To send account emails such as sign-up confirmation, password reset and purchase confirmation.
• Health-related details are used on the basis of your explicit consent when you enter them.

4. Who processes it for us

• Stripe — payments, subscriptions and billing pages.
• Lovable / cloud hosting — hosts the website, database and sign-in.
• Google — optional Google sign-in, and shop and map searches based on the location you enter.
• Lovable AI Gateway (OpenAI model) — coach messages are sent to an AI model to generate replies.
• postcodes.io — to turn a UK postcode into a location.

We do not sell your data, and we do not use advertising or analytics tracking tools.

5. How long we keep it

• Account and meal-planning data: We retain your information while your account remains active. You can request account and data deletion by emailing week-one@outlook.com. We may retain certain information where necessary for legal, accounting, security or dispute-resolution purposes.
• Financial records: We retain the financial records we need for applicable tax and accounting obligations for the legally required period. Some records may need to be retained for six years or longer, depending on the applicable requirements.
• Guest sessions: Temporary selections may remain in your browser until you clear your browser data.

6. Security

Access to your data is restricted to your own account by database rules, and the site is served over HTTPS. Card payments are handled by Stripe.

7. Your rights

You can ask to see, correct, export or delete your data, or object to how it is used. You can change most details on your Account page. There is no self-service account deletion yet — email us and we will delete it. You can also complain to the Information Commissioner's Office (ico.org.uk).

8. International transfers

Our service providers may process personal information in different countries, depending on the service used. Our hosting provider, AI services and payment processor have their own infrastructure and data-processing arrangements. Where applicable data-protection law requires safeguards for international transfers, those transfers must use an appropriate recognised mechanism.

9. Changes

We will update this page if our practices change and tell you about significant changes.