Last updated: May 2026 · Available in English and French upon request · Governed by the laws of Canada

⚕️ Medical & Nutritional Disclaimer

Dietcraft Express is not a substitute for professional medical or nutritional advice. Meal plans, recipes, and nutritional estimates are generated by artificial intelligence for general informational and planning purposes only. They are not intended to diagnose, treat, cure, or prevent any disease or health condition.

Always consult a qualified healthcare provider, registered dietitian, or nutritionist before making significant dietary changes — especially if you have a medical condition, food allergies, are pregnant, nursing, or managing a chronic illness. Never disregard professional medical advice based on anything generated on this website.

AI-generated recipes may contain errors. If you have a severe or life-threatening food allergy, always independently verify every ingredient. Dietcraft Express and its operators assume no liability for health outcomes resulting from use of this tool.

1. Who We Are

Dietcraft Express is a Canadian AI-powered meal planning tool operated by Dietcraft Express, based in Canada. This policy is governed by Canadian federal and provincial privacy laws including PIPEDA and Quebec's Law 25, and extends to cover the privacy rights of users in the United States, European Union, and United Kingdom.

2. Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies. We request your consent before placing non-essential cookies on your device — required under Quebec's Law 25, the EU ePrivacy Directive, and UK PECR. We use three categories of cookies:

• Essential cookies: Required for the site to function. Cannot be disabled. Do not track you for advertising. No consent required.
• Analytics cookies: Help us understand how visitors interact with the site so we can improve it. Only placed with your consent.
• Advertising cookies: Placed by Google AdSense to serve relevant ads. Google uses these cookies to show ads based on your browsing history on this and other sites. Only placed with your consent.

You may withdraw consent at any time by clicking "Cookie Preferences" in the footer or clearing your browser cookies. You may also opt out of personalized Google advertising at adssettings.google.com or the Network Advertising Initiative.

How to withdraw consent — step by step:

• AdSense personalized ads: (1) Click "Cookie Preferences" in the footer of any page → toggle "Advertising / AdSense" off → click "Save My Choices." This immediately prevents the AdSense script from loading. (2) Alternatively, visit adssettings.google.com → click "Turn off" → follow Google's opt-out steps. (3) For a complete opt-out across all sites, use the Digital Advertising Alliance opt-out tool.
• AI processing / overseas data transfer: Simply stop using the meal planning tool. No account exists to delete. To request deletion of any server logs containing your IP address, email privacy@dietcraftexpress.com with subject "Log Deletion Request" and include your approximate date of visit and IP address if known. We will delete matching records within 10 business days and confirm in writing.
• All cookies (nuclear option): Clear your browser's cookies and localStorage for dietcraftexpress.com. Instructions vary by browser — search "[your browser] clear cookies for one site."

Note on localStorage and device changes: Your cookie consent preferences are stored in your browser's localStorage. This means if you switch to a different device, use a different browser, or clear your browser data, your consent preferences will be reset and the cookie banner will reappear. This is by design — we require fresh consent per device and browser session.

3. What We Collect

• Dietary preferences and restrictions — processed in real-time, not intentionally retained in persistent application storage after your session ends
• Province/state selection — used only to match your shopping list to local stores
• Household size — used only to scale recipe quantities
• Standard web server logs — IP address, browser type, referring URL, pages visited; retained 30 days for security only
• Cookie consent preferences — stored locally on your device
• Email correspondence — only if you contact us directly

Sensitive Personal Information: Dietary restrictions you enter (such as religious dietary laws, medical conditions, or allergen information) may constitute sensitive personal information under applicable law including the CCPA/CPRA. We use this information solely and exclusively to generate your meal plan. We do not sell, share, or use it for any other purpose including advertising targeting.

4. What We Do Not Collect

• We do not store your generated meal plans, recipes, or shopping lists on our servers
• We do not create user accounts or personal profiles
• We do not collect your name, address, date of birth, or government ID
• We do not collect payment or financial information
• We do not sell, rent, trade, or share personal information with third parties for marketing
• We do not use personal information to build advertising profiles
• We do not use cross-context behavioural advertising based on your sensitive dietary data
• We do not knowingly collect personal information from children under 13

5. Google AdSense & Third-Party Advertising

The free web version of Dietcraft Express displays advertisements served by Google AdSense (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Google is a third-party vendor that uses cookies — including the DoubleClick cookie — to serve ads based on your prior visits to this and other websites.

We do not control Google's data collection or use. For full details, see Google's Privacy Policy and Google's Advertising Policy.

You may opt out of personalized advertising via:

• Google Ads Settings
• Network Advertising Initiative opt-out
• Digital Advertising Alliance opt-out
• Your browser's cookie settings

Note for California residents: Google AdSense may constitute a "sale" or "sharing" of personal information under CCPA/CPRA. See Section 14 for your opt-out rights.

Note for EU/UK residents: Google AdSense cookies are placed only after you provide explicit consent via our cookie banner.

Consent Management Platform (CMP) notice: We currently use a custom-built consent banner. Prior to full AdSense activation, we intend to implement a Google-certified CMP — such as CookieYes, Cookiebot, Complianz, or Usercentrics — which integrates with Google's Consent Mode v2. This is required for full EU/UK/Quebec AdSense compliance. Until a certified CMP is in place, AdSense is not active on this site.

6. Third-Party AI Processing — Anthropic

Meal plan, recipe, and shopping list generation is powered by Anthropic PBC (548 Market St, San Francisco, CA 94104, USA) via their Claude AI API. When you submit preferences, the following non-identifying information is transmitted to Anthropic: dietary restrictions selected, household size, province/region, and any optional text preferences entered.

What is not sent to Anthropic: Your IP address, browser information, and web server logs remain on our servers only and are never transmitted to Anthropic or any other third party. No personally identifying information is included in prompts sent to Anthropic's API.

Anthropic data retention: Anthropic may retain prompts and outputs submitted via their API. Based on Anthropic's publicly available API usage policy, inputs and outputs submitted through the API are not used to train Anthropic's models by default for paid API customers, though retention periods for operational purposes may apply. We encourage you to review Anthropic's Privacy Policy, their Usage Policy, and their Privacy Centre for the most current information on prompt and output retention. If Anthropic's current policy does not specify a retention period applicable to your data, we will state this plainly: the exact duration Anthropic retains API inputs and outputs is subject to their policy and may not be fully disclosed. We recommend reviewing Anthropic's privacy documentation directly.

Data Processing Agreement (DPA) status: We currently operate under Anthropic's standard API terms of service, which include data handling provisions. We do not yet have a separately executed Data Processing Agreement (DPA) with Anthropic. Until a formal DPA is in place, our mitigation steps are: (1) data minimization — we transmit only the minimum information needed (dietary restrictions, household size, province, optional text preferences); (2) no PII in prompts — we do not include names, email addresses, IP addresses, or other identifiers in API calls; (3) immediate session deletion — session data is discarded immediately after the API response is received and is never written to persistent storage on our servers. We will update this policy when a formal DPA is executed.

Free-text input data minimization: The optional preferences field (e.g., "quick meals under 30 min") is transmitted as entered. We do not currently apply automated redaction to free-text inputs. Users should not enter personal information, names, addresses, or other identifying details in this field. Our server-side proxy does not log or store prompt content.

Technical safeguards: Your Anthropic API key is stored server-side in a PHP proxy file and is never exposed to website visitors or included in client-side code. All communications between our server and Anthropic's API use HTTPS encryption. User inputs are not intentionally retained in persistent application storage beyond the duration of the API call; transient processing in server memory, proxies, or infrastructure buffers may occur as part of normal web operations.

By using this tool you consent to your non-identifying preference data being processed on servers located in the United States. EU/UK users: this transfer is based on your explicit consent as the lawful basis under GDPR Article 6(1)(a).

7. Children's Privacy — COPPA Compliance

Dietcraft Express is not directed at children under the age of 13. We do not knowingly collect, use, or disclose personal information from children under 13, in compliance with the US Children's Online Privacy Protection Act (COPPA), Canada's PIPEDA, and applicable international children's privacy laws.

If you are a parent or guardian and believe your child under 13 has submitted personal information through this tool, please contact our Privacy Officer at privacy@dietcraftexpress.com with the subject line "COPPA — Child Data Request." We will:

• Verify your identity as parent or guardian. We offer two verification options: (a) submit a copy of government-issued ID — this will be used solely for identity verification, stored securely for no longer than 30 days, then permanently deleted; or (b) provide a signed declaration including your full name, the child's first name and age, and a statement of your parental relationship — this may be used as an alternative where ID submission is not practical
• Identify what information, if any, was collected — noting that our tool does not retain session data by design, making meaningful data collection highly unlikely
• Permanently delete any confirmed personal information within 10 business days of completed identity verification
• Confirm deletion to you in writing at the email address provided
• Verification documents (government ID or signed declaration) will be stored in an encrypted email environment, used only for the verification purpose, and permanently deleted within 30 days of receipt regardless of the outcome of the request

Users between ages 13 and 18 should review this policy with a parent or guardian. In jurisdictions where the age of digital consent is higher than 13 (e.g., 16 in some EU member states), users below that age require parental consent.

8. Data Retention

The following table is the definitive and complete record of all data categories we process, where they are stored, and how long they are retained:

No "Save Plan" feature currently exists in the web tool. If a save feature is added in a future update, this policy will be updated before that feature is released to disclose what is stored, where, and for how long.

9. Security & Breach Notification

Automated Decision-Making Statement: Dietcraft Express uses AI to generate meal plans based on your stated preferences. This automated processing does not produce legal effects or similarly significant effects on users — it generates meal suggestions only, which you are free to follow or disregard. No decisions about your access, creditworthiness, employment, health treatment, or legal status are made by automated means. If you wish to request human review of any output generated by the tool, contact privacy@dietcraftexpress.com.

We implement reasonable technical and organizational security measures including HTTPS encryption, server-side API key storage, and regular access control review. However, no internet transmission is 100% secure.

In the event of a privacy breach posing real risk of significant harm:

• Canada: We will notify the Office of the Privacy Commissioner (OPC) and all affected individuals as soon as feasible, and maintain breach records for 24 months per PIPEDA
• Quebec: We will notify the Commission d'accès à l'information (CAI) of any confidentiality incident involving Quebec residents' personal information per Law 25
• EU/UK: We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and notify affected individuals without undue delay, per GDPR Article 33 and UK GDPR
• USA: We will comply with applicable state breach notification laws, including California's data breach notification requirements under California Civil Code § 1798.82

10. Canadian Residents — PIPEDA Rights

Under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, you have the right to:

• Access — request a copy of any personal information we hold about you
• Correction — request correction of inaccurate information
• Deletion — request deletion of your personal information
• Withdrawal of consent — withdraw consent at any time, subject to legal restrictions
• Complaint — file a complaint with the Office of the Privacy Commissioner of Canada at 1-800-282-1376

To submit a rights request, email privacy@dietcraftexpress.com with the subject line "Privacy Rights Request — [Your Right]" (e.g., "Privacy Rights Request — Access"). Include your name, a description of your request, and sufficient information to verify your identity. We will acknowledge receipt within 5 business days and respond fully within 30 days. If your request is complex, we may extend this period by an additional 30 days with notice.

11. Quebec Residents — Loi 25 / Law 25

Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), in full effect since September 2023, grants Quebec residents rights beyond federal PIPEDA. As a Quebec resident you have the right to:

• Prior explicit consent — non-essential cookies require your free, informed, and specific prior consent
• Withdraw consent at any time without consequence via the cookie banner or by contacting us
• Data portability — receive your personal information in a structured, commonly used technological format
• De-indexation — request removal of hyperlinks to information that could harm your reputation or privacy
• Automated decision disclosure — be informed when automated processing produces legal or significant effects on you
• French language — request this Privacy Policy and all communications in French

Complaints may be directed to the Commission d'accès à l'information (CAI) at cai.gouv.qc.ca.

12. EU/EEA Residents — GDPR

Canada's EU Adequacy Decision: The European Commission has recognized Canada as providing an adequate level of personal data protection under PIPEDA. This means your data transferred to Canada is protected without requiring additional transfer mechanisms such as Standard Contractual Clauses — a significant protection for EU users that few non-EU countries enjoy.

Data transfers to the United States (Anthropic): Canada's adequacy decision covers data transferred to Canada only — it does not extend to onward transfers to the United States. Data transmitted to Anthropic's API (your non-identifying dietary preferences) is transferred to the US on the lawful basis of your explicit consent under GDPR Article 6(1)(a) and Article 49(1)(a).

We acknowledge that relying solely on consent as a transfer mechanism is considered less robust than Standard Contractual Clauses (SCCs) under GDPR guidance. Our current position: (1) we minimize data transferred to Anthropic to non-identifying information only; (2) we are reviewing whether SCCs or Anthropic's Binding Corporate Rules apply to our use case and will adopt them if appropriate; (3) we will update this policy before processing EU personal data at any material scale. You may withdraw consent to this transfer at any time by discontinuing use of the meal planning tool — withdrawal does not affect the lawfulness of prior processing.

EU Representative: Dietcraft Express does not currently have an establishment in the EU and does not systematically target EU users as a primary market. If our EU user base grows to a scale where Article 27 of the GDPR requires appointment of an EU-based representative, we will appoint one and publish their details here. In the meantime, EU users may direct inquiries to our Privacy Officer at privacy@dietcraftexpress.com.

Lawful basis for processing:

• Meal plan preferences: Consent (Article 6(1)(a)) — you freely provide this to generate your plan
• Server logs: Legitimate interests (Article 6(1)(f)) — security and fraud prevention
• Advertising cookies: Consent (Article 6(1)(a)) — only placed after your explicit opt-in

Your 8 GDPR Rights:

• Right of Access (Art. 15) — obtain confirmation of whether we process your data and a copy of it
• Right to Rectification (Art. 16) — correct inaccurate personal data without undue delay
• Right to Erasure / "Right to be Forgotten" (Art. 17) — request deletion of your personal data where there is no legitimate reason to continue processing
• Right to Restriction of Processing (Art. 18) — request we restrict processing under certain circumstances
• Right to Data Portability (Art. 20) — receive your personal data in a structured, machine-readable format and transmit it to another controller
• Right to Object (Art. 21) — object to processing based on legitimate interests or for direct marketing purposes
• Rights Related to Automated Decision-Making (Art. 22) — not be subject to decisions based solely on automated processing that produce significant effects, without human review
• Right to Withdraw Consent (Art. 7(3)) — withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal

To exercise any GDPR right, contact privacy@dietcraftexpress.com. We respond within 30 days. You also have the right to lodge a complaint with your local EU supervisory authority — a list is available at edpb.europa.eu.

EU Representative: Dietcraft Express does not currently have an establishment in the EU. If you believe an EU-based representative is required for your jurisdiction, please contact us and we will facilitate compliance.

13. UK Residents — UK GDPR & Data Protection Act 2018

Following Brexit, the United Kingdom applies the UK GDPR and Data Protection Act 2018, which are substantively equivalent to EU GDPR. All rights described in Section 12 apply equally to UK residents.

The UK has granted Canada an adequacy decision under its own post-Brexit framework, meaning data transfers from the UK to Canada are lawful without additional transfer mechanisms.

Data transfers to the US (Anthropic) from the UK are based on your explicit consent. You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

14. California Residents — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:

Categories of Personal Information Collected:

• Internet or other electronic network activity information (server logs, IP address)
• Sensitive personal information: dietary restrictions, religious practices reflected in food choices, health-related dietary needs

Categories of Third Parties with Whom Personal Information is Shared:

• Google LLC (advertising cookies — with your consent only)
• Anthropic PBC (AI processing of dietary preferences — non-identifying)
• Bluehost/web hosting provider (server infrastructure — incidental server log access)

Your California Privacy Rights:

• Right to Know — request disclosure of personal information collected, used, disclosed, or sold about you in the past 12 months
• Right to Delete — request deletion of personal information we have collected, subject to certain exceptions
• Right to Correct — request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing — you have the right to opt out of the sale or sharing of your personal information. While we do not sell personal information in the traditional sense, Google AdSense may constitute a "sale" or "sharing" under CCPA/CPRA. You may opt out using the link below or via Google's Ads Settings
• Right to Limit Use of Sensitive Personal Information — we use sensitive personal information (dietary restrictions) only for the purpose of generating your meal plan. We do not use it for advertising, profiling, or any secondary purpose
• Right to Non-Discrimination — we will not discriminate against you for exercising any CCPA/CPRA rights

To submit a CCPA/CPRA rights request, contact privacy@dietcraftexpress.com with "California Privacy Request" in the subject line. We will respond within 45 days. Requests may be submitted by an authorized agent acting on your behalf.

15. Other US State Residents — Virginia, Colorado, Connecticut & Others

Residents of US states with comprehensive privacy laws — including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and others — have privacy rights similar to those described for California residents above, including the rights to access, correct, delete, and port personal data, and to opt out of targeted advertising.

We honour these rights regardless of which state you reside in. To exercise any US state privacy right, contact privacy@dietcraftexpress.com identifying your state of residence. We will respond within the timeframe required by your state's law (typically 45–60 days).

We do not discriminate against any user for exercising their privacy rights under any applicable US state law.

Third-Party Vendor Summary & DPA Status

The following table summarizes our key third-party vendors, their role, DPA status, and where to find their privacy documentation:

16. Terms of Use

• The Dietcraft Express™ name, logo, tool interface, and all original content are intellectual property of Dietcraft Express, protected under Canadian trademark and copyright law and international intellectual property conventions
• You may use this tool for personal, non-commercial meal planning only
• You may not scrape, reproduce, redistribute, or commercially exploit any content without prior written permission
• You may not reverse-engineer, copy, or replicate this tool or its underlying systems
• We reserve the right to suspend or terminate access for abuse or misuse
• The tool is provided "as is" without warranties of any kind, express or implied
• AI accuracy disclaimer: Nutritional values, calorie estimates, recipes, ingredient suggestions, allergen identification, portion sizes, and grocery matching generated by this tool may contain inaccuracies, omissions, or errors. AI-generated content is not reviewed by a registered dietitian before delivery. You assume full responsibility for independently verifying any nutritional or allergen information before acting on it, particularly if you have a medical condition, food allergy, or dietary restriction with health implications
• To the extent permitted by applicable law, our liability is limited to direct damages only and capped at the greater of CA$100 or the total fees paid by you in the prior 12 months. We expressly disclaim liability for any indirect, incidental, consequential, punitive, or special damages to the maximum extent permitted by law. Nothing in this clause limits liability for death, personal injury, fraud, or any other liability that cannot be excluded under applicable law
• These terms are governed by the laws of Canada and disputes shall be subject to Canadian jurisdiction

17. Privacy Officer

As required by PIPEDA, Quebec's Law 25, and consistent with GDPR accountability principles, Dietcraft Express has designated a Privacy Officer responsible for overseeing privacy compliance.

18. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. Material changes will be reflected in the "Last updated" date above. Continued use of Dietcraft Express after changes are posted constitutes acceptance of the revised policy. If you do not agree, please discontinue use of the tool.

19. Contact & Regulatory Complaints

For all privacy inquiries, rights requests, or complaints: privacy@dietcraftexpress.com

If unsatisfied with our response, you may escalate to the appropriate authority:

• Canada — Office of the Privacy Commissioner: priv.gc.ca · 1-800-282-1376
• Quebec — Commission d'accès à l'information: cai.gouv.qc.ca
• EU — Your local supervisory authority: edpb.europa.eu
• UK — Information Commissioner's Office: ico.org.uk · 0303 123 1113
• California — California Privacy Protection Agency: cppa.ca.gov

Last updated: May 2026 · Applies to dietcraftexpress.com and all Dietcraft Express web properties

What Is a Cookie?

A cookie is a small text file placed on your device by a website when you visit it. Cookies help websites remember your preferences, keep you logged in, and serve relevant content. Similar technologies include localStorage, sessionStorage, pixel tags, and web beacons — we refer to all of these collectively as "cookies" in this policy.

Dietcraft Express uses cookies for three purposes only: site functionality, optional analytics (Google Analytics 4), and optional advertising. We request your consent before placing any non-essential cookie on your device.

Cookie Categories We Use

How to Control Cookies

You have full control over non-essential cookies at all times:

• Cookie banner: When you first visit the site, our cookie banner lets you accept all, select categories, or reject non-essential cookies
• Cookie Preferences link: Available in the footer of every page — click it anytime to update your choices
• Browser settings: All modern browsers let you block or delete cookies. Note this will reset your consent preferences and the banner will reappear
• Google opt-out: Visit adssettings.google.com to opt out of Google personalized advertising across all sites
• Industry opt-out: Use the Digital Advertising Alliance or Network Advertising Initiative tools

Changes to This Cookie Policy

We will update this policy before activating any new cookie categories or third-party tools. The "Last updated" date above reflects the most recent revision.

Contact

For questions about our use of cookies: privacy@dietcraftexpress.com