In accordance with Federal Law No. 152-FZ “On Personal Data”
1.1. This Personal Data Processing Policy (the “Policy”) has been prepared in accordance with Federal Law No. 152-FZ of 27 July 2006 “On Personal Data” and defines the procedure for processing personal data and the measures taken to ensure their security within the “Mera” mobile application and website (the “Service”).
1.2. The operator of personal data is Individual Entrepreneur Shagabutdinov Renat Khannanovich (the “Operator”), State Registration Number 324774600675720, Taxpayer Identification Number 773389350806.
1.3. This Policy applies to all personal data that the Operator may obtain from the User in the course of the use of the Service.
The Operator processes the following categories of personal data:
| Category | Contents | Purpose of processing |
|---|---|---|
| Account data | Email, password hash, registration method (email/Google/Apple), email-verification status | Registration, authentication, account recovery |
| Profile data | Gender, age, height, weight, target weight, activity level, rate of weight change, diet type, time zone | Calculating personalised calorie and macronutrient goals (Mifflin–St Jeor equation); personalising the Service |
| Nutrition data | Meal names, portion weights, calories, macronutrients, notes, meal times, ingredients, product barcodes | Maintaining the nutrition diary, calorie counting, analytics |
| Photographs | Images of food in base64 format (up to approximately 7.5 MB) | AI analysis of meal composition. Images are not retained after processing |
| Weight data | Weight entries with dates | Tracking weight trends and producing projections |
| AI chat data | Messages sent by the user and responses from the assistant | Operation of the AI assistant for nutrition questions |
| Device data | Push token, platform (iOS/Android), application version, operating-system version, device model | Delivering push notifications; handling support requests |
| Payment data | Subscription identifier, plan, status, period, amount, currency; for App Store subscriptions, the Apple transaction identifier | Managing subscriptions and recurring payments via YooKassa or the App Store |
| Installation and onboarding data | Application installation identifier, onboarding steps (including those completed before registration), platform, application version, event time | Analytics of installations and onboarding completion; determining which installations led to a registration |
| App usage data | Application usage events: a random installation identifier created by the application (not the advertising identifier) and, once the User signs in, the account; platform, application version and build, session identifier, event time and name (a view of a screen from a fixed list of screens; a meal recognition being started, submitted, saved or discarded, with its method; paywall and subscription checkout steps; a notification being opened) and a limited set of event parameters. Meal names, typed text, photographs, location and advertising identifiers are not transmitted | Improving the application and measuring product quality |
| Abuse-prevention data | Bank card hash (fingerprint), application installation identifier, email address, participation in the “Invite a friend” programme (invite code, referring and invited accounts, status, days granted) | Checking eligibility for the trial period and for the “Invite a friend” programme terms (Section 9 of the Public Offer): preventing the same bank card from obtaining a trial period or a first month under the “Invite a friend” programme more than once, and self-referral |
The bank card hash is computed by the Operator with the SHA-256 algorithm from the first 6 and last 4 digits of the card number, the card’s expiry date and the card type, which the payment provider YooKassa passes to the Operator with every successful bank card payment. The Operator never receives the full card number; the digits and expiry date are not stored, only the hash is. The application installation identifier is a random identifier that the application creates and keeps on the device; it does not change when the User signs out. The application sends it with onboarding events (including before registration) and at registration, after which it is stored in the account. Email addresses are compared by whether they deliver to the same mailbox (for example, ignoring the part after a “+” sign).
The processing of personal data is carried out on the following principles:
Processing is carried out on the following legal bases:
6.1. Personal data is collected by the following means:
6.2. The provision of personal data is voluntary. A refusal to provide mandatory data (email) makes use of the Service impossible.
7.1. Processing is carried out by means of automation.
7.2. Data is stored on servers located within the territory of the Russian Federation.
7.3. Retention periods:
The Operator takes the necessary legal, organisational, and technical measures to protect personal data:
9.1. The Operator does not transfer personal data to third parties, save in the cases provided for by law and by this Policy.
9.2. Data may be transferred to:
9.3. Cross-border transfers are effected only to countries that provide adequate protection of the rights of data subjects.
The User has the right to:
12.1. The Operator is entitled to make changes to this Policy. The new version takes effect upon its publication on this page.
12.2. This Policy is governed by the law of the Russian Federation.
12.3. For all inquiries, please contact: contact@mera-api.ru.