Privacy policy

This policy explains how Dad Whats for Dinner (Pty) Ltd (reg: 2025/616693/07) (“Dad’s Dinner”, “we”, “us”) collects and uses personal information when you use the Dad’s Dinner app and our website, https://www.dadwhatsfordinner.co.za/ (together, “the Platform”). It is our notice under section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). Please read it with our Terms of use.

1. Who we are and how to contact us

• Responsible party: Dad Whats for Dinner (Pty) Ltd, Unit 51 Amsterdam Apartments, 83 Jacaranda Avenue, Randburg, Gauteng, 2188
• Information officer: Nico Barnard, registered with the Information Regulator
• Privacy requests and questions: nico@dadwhatsfordinner.co.za
• PAIA manual: PAIA manual, with the request forms and the Information Regulator’s guide

2. What we collect

You can use the app as a guest without giving us your name or email address. Some features need the information listed below and will not work without it. No law requires you to give it to us.

• Guest account: When you first open the app, we create a guest account with a random identifier. Anything you save as a guest is linked to it.
• Account details: your email address, name and login details. We need these to create an account.
• Google or Apple sign-in: if you sign in with Google or Apple, they give us your name, email address and an account identifier. Apple may give us a private relay email address instead of your own. We do not receive your Google or Apple password.
• Terms acceptance: the version of our Terms and Privacy policy you accepted, with the date.
• Date of birth: optional when you set up your profile, and needed to open the nutrition diary, which checks that you are 18 or older. You enter it once.
• Body details and nutrition diary (health information): your sex, height, weight, activity level, dietary preferences (such as diabetic-friendly, gluten-free or nut-free), the food you log, and your calorie and nutrient goals, including goals you mark as “Doctor’s orders”. These are optional. See section 4.
• Your content: your fridge list, favourites, meal plans, shopping lists and settings; recipes you import (the page photos or PDFs, and the recipe read from them); and photos of dishes you add.
• Subscription information: your plan, subscription status and purchase history, which we receive from Apple or Google through RevenueCat. We never receive your card details. We receive your bank details only if we have to pay you a refund ourselves (for example, where consumer law requires it), rather than through Apple or Google.
• Usage and device information: the features and screens you use, text you type into search, which meal (for example, lunch) you log in the diary, crash reports, an app installation identifier and push notification tokens. See section 6.
• Server logs: records of requests to our servers, linked to your account identifier.
• Messages: emails you send us, and our replies.

We collect this information from you, from your device, from Google or Apple when you use them to sign in, and from Apple or Google (through RevenueCat) when you subscribe. We do not collect biometric information or social media content.

3. Why we use it, and our legal basis

• To provide the app and your account: signing in, keeping your plans, lists, fridge and favourites, price comparison, recipe import, subscriptions and refunds. Basis: performing our contract with you (POPIA s11(1)(b)).
• To run the nutrition diary and goals. Basis: your consent (s11(1)(a) and s27(1)(a)). See section 4.
• To send service messages, such as account verification and password-reset emails, renewal reminders, unused-account warnings and cooking-timer notifications. Basis: our contract with you.
• To understand how the app is used and fix crashes. Basis: our legitimate interest in improving the app (s11(1)(f)). You can opt out (section 6).
• To keep the Platform secure, prevent fraud and misuse, and enforce our Terms. Basis: our legitimate interest.
• To comply with the law, respond to lawful requests and deal with legal claims. Basis: legal obligation or legitimate interest.
• To send marketing, only if you agree (section 7). Basis: your consent.

We do not share your personal information with retailers, or with anyone for their own marketing. We do not make decisions about you with legal or similarly significant effects based only on automated processing (POPIA s71). The diary’s age check simply applies the date of birth you give. If we want to use your information for a new purpose that is not compatible with these, we will tell you first and, where needed, ask for your consent.

4. Nutrition diary and health information

The nutrition diary is optional and only for people aged 18 or older. Your body details, dietary preferences, the food you log and your goals are health information, which POPIA treats as special personal information (s26).

• We process this information only with your consent. You choose whether to give body details when you set up your profile, and the app asks for your consent before the diary first opens, and records when you gave it. We use this information only for your recommendations, the diary and your goals and insights, and we treat it as confidential.
• Dietary preferences (such as diabetic-friendly or nut-free) filter the recipes we show you. You can change or clear them in Settings → Edit Profile (guests, once they have created an account).
• It is stored in South Africa (MongoDB Atlas, Cape Town). It is not sent to our analytics providers, except that analytics records which meal you logged (for example, lunch), not what you ate.
• The diary is not medical advice (see our Terms, section 3).
• You can withdraw your consent at any time in Settings → Delete health data, which deletes your diary, goals and body details, or by deleting your account. Your dietary preferences are not deleted that way; clear them in Settings → Edit Profile.
• When you delete a diary entry, what you ate is deleted at once. We keep only a marker with no food details, so your other devices know the entry is gone.
• The app has no export feature. You can ask us for a copy (section 12).

5. Recipe import

• Subscribers can photograph or upload up to 5 pages of a recipe. The pages are stored in Google Cloud Storage in Johannesburg and sent to Google’s Gemini AI (Vertex AI) in the European Union, which reads them. Before your first import, the app asks you to agree to this.
• Page photos are deleted within 30 days of upload. Under Google’s terms, Google may cache requests in memory for up to 24 hours and may keep requests flagged for abuse review for up to 90 days. Google may not use your uploads to train its AI models.
• We use your uploads only to provide recipe import to you, and never for anything else.
• Imported recipes and dish photos are private: they are not shared, shown in search or added to our recipe catalogue. A small number of our directors and contractors with administrator access can technically open them. They are kept until you delete them or your account, including after your subscription ends.
• Please avoid uploading pages that show other people’s personal details.

6. Analytics, crash reports and device identifiers

The app uses these tools:

• Firebase Analytics (Google) and PostHog: record the features and screens you use, including text you type into search and which meal you log in the diary, linked to your account identifier. They do not receive your name or email address.
• Firebase Crashlytics (Google): records crash reports, linked to an app installation identifier.
• Firebase Cloud Messaging (Google): uses a push notification token for your device to deliver notifications.

We rely on our legitimate interest in improving the app. Share usage data in the app’s Settings is on by default. Turning it off stops Firebase Analytics and PostHog. Crash reports continue, because we need them to keep the app working. You can also object to this processing (section 12).

Our website does not use cookies or analytics.

7. Notifications, email and marketing

• Service messages: we send account verification and password-reset emails, notices about your account (a reminder before an annual plan renews, and a warning before we delete an unused account), and push notifications for features you use, such as cooking timers. A renewal reminder comes by push notification if we have no email address for you. These are not marketing.
• Meal-plan reminders and new-recipe updates, by push notification or email, are off by default.
• Product news by email is sent only if you opt in.
• We send direct marketing by email, push notification or other electronic means only with your consent (POPIA s69). Every marketing message will identify us and let you unsubscribe. You can change your choices in the app at any time, or email us.
• We do not send SMS messages.

8. Who we share it with

We share personal information only with:

• Operators that process it for us, listed below;
• Contractors who help us build, run and support the app, only where their work needs it and under confidentiality obligations;
• Apple and Google, as app stores and sign-in providers. They are independent responsible parties with their own privacy policies;
• our professional advisers, auditors and insurers, where needed;
• our bank, if we pay a refund into your bank account;
• authorities, where the law requires it; and
• a buyer of all or part of our business, who must continue to protect it as this policy describes.

Our operators, what they receive and where they process it:

• MongoDB Atlas (on Amazon Web Services): our database, including account, profile, health, diary, list, plan and imported recipe data. South Africa (Cape Town).
• Our application servers: all app traffic and server logs. South Africa.
• Google Firebase (Authentication, Cloud Messaging, Remote Config, App Check): email address, name, sign-in identifiers and push tokens. Global; sign-in data is processed in the United States.
• Google Cloud Storage: recipe page photos (for up to 30 days) and dish photos. South Africa (Johannesburg).
• Google Vertex AI (Gemini): recipe page images and ingredient text. European Union.
• Firebase Analytics and Firebase Crashlytics (Google): usage events, search text and crash reports. Mainly the United States.
• PostHog: usage events and search text. European Union (Germany).
• RevenueCat: account identifier, email address and purchase history. United States.
• Resend: your email address, to send verification, password-reset and account notice emails (such as renewal reminders). United States.
• Vercel: hosts our website, including the email-verification page, in the United States. It receives only what a web host needs to serve a page, such as your IP address and the link you open, and handles it under its own terms and privacy policy.

Apart from Vercel, operators may use your information only to provide their service to us, under their data processing terms, and must keep it secure (POPIA ss20–21).

9. Transfers outside South Africa

Some of our operators are in the United States or the European Union. Each of them, except Vercel, is bound by a written data processing agreement that protects your information in a way substantially similar to POPIA, including the EU’s standard contractual clauses (POPIA s72(1)(a)). Vercel, which hosts our website, receives your IP address and the page you open only because that is needed to show you the page (s72(1)(c)). Your health information is stored in South Africa (section 4).

10. How long we keep it

We keep personal information only as long as we need it for the purposes in section 3, and then delete or de-identify it (POPIA s14).

• Account details, date of birth, body details, diary, goals, fridge, favourites, plans, lists, imported recipes, dish photos, and the record of the Terms and consents you accepted: until you delete your account. Settings → Delete health data deletes the diary, goals and body details sooner. If you have not used the app for 2 years and have no active subscription, we delete your account, telling you 30 days before if we have your email address. Until then, a lapsed subscriber’s data is kept, locked, in case they subscribe again.
• Diary entries you delete in the app: what you ate is deleted at once; a marker with no food details stays until you delete your account.
• Recipe page photos: up to 30 days after upload (see section 5 for Google’s caching and abuse logs).
• Push tokens: until you delete your account, or 180 days after they were last used.
• Record of push notifications sent to you: 400 days.
• Analytics and crash data: Firebase Analytics keeps event data for 2 months and user data for 14 months, and Firebase Crashlytics keeps crash reports for 90 days, including after you delete your account. PostHog keeps usage events for 1 year, or until you delete your account, when we ask PostHog to delete them. Reports built from this data are aggregated and do not identify you.
• Purchase records: kept by RevenueCat until you delete your account, and by Apple and Google under their own policies.
• Refunds we pay ourselves: the refund record and the bank account we paid into, for 7 years, as company and tax law require.
• Server logs: overwritten automatically as new logs are written. They are capped in size and not archived.
• Deleted data in our database’s change log: about four weeks.
• Emails with us: 2 years after our last message, then deleted.

11. Security

We use reasonable technical and organisational measures to protect personal information (POPIA s19), including access controls, authentication, secure handling of credentials and secrets, and industry-standard protection for data in transit. Only people who need access have it, and they must keep the information confidential. If we believe your personal information has been accessed or acquired without authorisation, we will notify you and the Information Regulator as soon as reasonably possible (POPIA s22).

12. Your rights

Email nico@dadwhatsfordinner.co.za to use any of these rights. We may need to confirm your identity first. We aim to respond within 30 days and will tell you if we need longer.

• Access: ask whether we hold information about you (free of charge), for a copy of it, and who has received it (s23). Copies may attract the fee prescribed under the Promotion of Access to Information Act, which we will tell you about in advance. Our PAIA manual explains the process.
• Correction and deletion: ask us to correct or delete information that is wrong, out of date, incomplete, excessive or unlawfully obtained (s24), such as a wrong date of birth. You may use Form 2 of the POPIA Regulations, available on the Information Regulator’s website (not the PAIA Form 2 on our PAIA page).
• Account deletion: delete your account in the app under Settings → Delete account. Guests first create an account, which keeps their data, and then delete it. See Account deletion.
• Objection: object at any time to processing based on our legitimate interests, and to direct marketing (s11(3)). You may use Form 1 of the POPIA Regulations. Switching off Share usage data stops analytics.
• Withdrawing consent: withdraw consent for the nutrition diary or marketing at any time. This does not affect processing before you withdrew it.
• Complaints: you may complain to the Information Regulator, although we would appreciate the chance to resolve your concern first.
  • Website: https://inforegulator.org.za
  • Complaints (Form 5): POPIAComplaints@inforegulator.org.za
  • Enquiries: enquiries@inforegulator.org.za, 010 023 5200
  • Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

13. Children

People under 18 may use the app, except the nutrition diary, but only with the prior consent of a parent or guardian (a “competent person” under POPIA s35). Before the app is used, it tells users that a parent or guardian must agree for anyone under 18. By allowing a child to use the app, the parent or guardian consents to us processing the child’s information as this policy describes. We do not check ages outside the diary, which will not open for anyone under 18. We process a child’s information in the same way as an adult’s, including usage analytics, which a parent or guardian can switch off in Settings → Share usage data. A parent or guardian can ask us to access or delete their child’s information.

14. Changes to this policy

We will post updates here and change the date at the top. We will tell you about material changes in the app or by email before they take effect, and ask for your consent again where the law requires. Previous versions are available on request.