Mom Nom logoMom NomSign in

Privacy Notice

Last updated: July 5, 2026

This Privacy Notice explains how Stepheni Mendez, doing business as Mom Nom ("Mom Nom", "we", "us"), collects and uses personal data when you use the Mom Nom service (the "Service"). Mom Nom is the data controller for personal data processed through the Service.

1. Personal Data We Collect

  • Account data: your email, display name, and (if you sign in with Google) your Google profile name and avatar URL.
  • Household & meal-plan data: family profile names, ages, dietary flags, aversions, favorites, weekly plans, custom recipes, shopping lists, notes — all provided by you.
  • Usage & device data: pages visited, actions taken, browser type, IP address, timestamps — collected via server logs and analytics.
  • Support communications: the content of emails you send us.
  • Payment metadata: we do not receive or store your card details. Our reseller Paddle collects payment data directly; we receive only subscription status, plan, and a Paddle customer ID.

2. Why We Use It

  • To create and secure your account (legal basis: contract).
  • To generate meal plans, recipes, and shopping lists you request (contract).
  • To process subscriptions and prevent fraud (contract, legitimate interest).
  • To provide customer support (contract, legitimate interest).
  • To improve the Service and diagnose issues (legitimate interest).
  • To comply with tax, accounting, and other legal obligations (legal obligation).

3. AI Processing

When you use AI-powered features (recipe generation, remodels, planner suggestions), we send the relevant inputs (your prompt, the recipe, and family dietary flags) to a third-party model provider via the Lovable AI Gateway. We do not include your email or account identifiers in AI prompts. Model providers may retain inputs for short periods for safety and abuse-prevention purposes; we do not use your data to train models.

4. Who We Share Data With

  • Hosting & infrastructure: Lovable (application hosting), Supabase (database and auth).
  • Merchant of Record: Paddle.com — for checkout, subscription management, payments, tax compliance, and invoicing.
  • AI model providers: via the Lovable AI Gateway (for the AI features you invoke).
  • Content import: Firecrawl, when you ask the app to import a recipe from a URL.
  • Professional advisers (legal, accounting) and authorities when required by law.

5. Data Retention

We keep your account data for as long as your account exists. If you delete your account, we delete or anonymise personal data within 30 days, except where we must retain it for legal, tax, or fraud-prevention reasons (typically up to 7 years for billing records held by Paddle).

6. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to processing. You may withdraw consent at any time. To exercise a right, email me@stephenim.com. We will respond within 30 days. If you are in the UK/EEA, you also have the right to lodge a complaint with your local supervisory authority.

7. International Transfers

Our providers may process data in the United States, the European Union, and other jurisdictions. Where personal data leaves the UK/EEA, we rely on Standard Contractual Clauses or equivalent safeguards offered by our providers.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, encryption at rest, access controls, and audit logging. No system is perfectly secure — please use a strong, unique password.

9. Cookies & Similar Technologies

The Service uses only essential cookies and local storage required to sign you in, keep your session active, and remember your preferences. We do not use marketing cookies.

10. Children

The Service is not directed to children under 13. Do not create an account for a child. Family profiles inside the Service (which may include children's names, ages, and dietary flags) are entered by you the account holder for your household.

11. Changes

We may update this Notice; the "Last updated" date at the top will reflect the change. Material changes will be communicated in-app or by email.

12. Contact

Data protection questions: me@stephenim.com.