PRIVACY POLICY
Last update: 06/08/2026

We’re committed to protecting the privacy of all individuals that provide Personal Information to us, including the data recorded by customers in Foodzilla that relates to their clients or patients. This Privacy Policy explains how we collect, protect, use and share personal information.

Foodzilla is a professional platform designed exclusively for nutrition and health professionals such as dietitians, nutritionists, and health coaches. The Service is not publicly available to consumers. Only clients of registered professionals may access the Foodzilla mobile app, and only at the invitation of their practitioner.

We may review and change this policy from time to time. When we do, we’ll update this version located at https://foodzilla.com/privacy and in other suitable places.

• "Zilla Technologies", or Zilla Technologies Ltd, is us - the company behind Foodzilla platform and mobile apps.
• "Foodzilla" is the Foodzilla software platform, mobile application, and services related to it that don’t have a separate privacy policy.
• "Agreement" refers to the Foodzilla Terms of Service found at https://foodzilla.com/terms
• "Customer" is a nutrition or health professional who has registered for a Foodzilla account and agreed to our Terms of Service.
• "Client" is a patient or client of a Customer who accesses the Foodzilla mobile app at the invitation of their practitioner.
• "Personal Information" means information that can identify an individual.
• "Services" means the provision of the Foodzilla software platform, mobile applications and related platform, and services related thereto (such as customer support).

SECTION 1 - PERSONAL INFORMATION WE COLLECT

We collect personal data in a couple of ways - directly and indirectly.

PERSONAL INFORMATION WE COLLECT DIRECTLY

We directly collect Personal Information if you send an enquiry to us from our website, use Foodzilla platform and/or mobile apps, or get in touch with us by chat, email, or phone. We may also collect some Personal Information if you engage with us through social media.

This information can include your name, gender, age, email addresses, and banking details.

As part of our registration process, we require all new professionals to provide a valid payment method to begin their free trial. This serves as an identity verification measure to prevent spam, abuse, and unauthorised access to the Service. Payment details are processed securely by Stripe and are not stored on Foodzilla servers.

For customers using Foodzilla mobile apps, we directly collect a special category of personal data. This includes details about their nutrition, exercise and overall health metrics.

We do not directly collect details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership. Nor do we collect any information about criminal convictions and offences.

Foodzilla's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

PERSONAL INFORMATION WE COLLECT INDIRECTLY

We indirectly collect Personal Information when someone uses Foodzilla to record data about someone other than themselves. A typical scenario would be when a healthcare professional records information about a patient or client.

This information can include names, genders, dates of birth, email addresses, information about nutrition and exercise, and patient treatment notes and records. This can include sensitive information such as health records.

• Browser and hardware data, such as IP address, type of device, operating system, browser type, screen resolution, language, device make and model, as well as the versions of the above mentioned services.
• Cookie and tracking technology data, which would include pages visited, time spent on pages, language preferences, and other anonymous traffic data. For more details on the cookies we use and how to manage them, please see our Cookie Policy.
• Transaction data, including details about your Foodzilla subscription, payment dates, and renewal dates.

SECTION 2 - HOW THIS INFORMATION IS USED

Generally speaking, the Personal Information we collect is used by us to operate Foodzilla.

The Personal Information we collect about our own Customers is mostly used for billing, identification, authentication, and for contacting them if we need to.

The special category of Personal Information such as nutrition and exercise data is used to help our Customers visualize their health data and/or their patients' health data.

We may, with consent, use email addresses to share news, tips, updates and special offers. People who receive these promotional emails can unsubscribe at any time.

We may use other data for a range of different purposes, provided we comply with applicable law and our contractual commitments. In some countries (for example, European Economic Area countries), local legal regimes may require us to treat some or all of other data as “personal data” under applicable data protection laws. Where this is the case, we will process other data only for the same purposes as “personal data” under this Privacy Policy.

Foodzilla uses third-party AI services (such as OpenAI) to power certain non-client-data features of the platform. Client personal information, health data, and dietary records are never sent to AI providers. When AI features are used, only the minimum non-personal data necessary to generate the requested output is sent to the AI provider. Your Personal Information is not used to train AI models. We have ensured that our AI providers process data in accordance with their data processing agreements and do not retain input or output data for training purposes.

Other ways we may use your Personal Information:

• To deliver customer service and assist you with any inquiries you may have.
• To analyze trends, administer or optimise Foodzilla, monitor usage or traffic patterns (including to track users’ movements around Foodzilla) and gather demographic information about our user base as a whole.
• To control unauthorised use or abuse of Foodzilla—or otherwise detect, investigate or prevent activities that may violate our policies or be illegal

SECTION 3 - HOW INFORMATION IS DISCLOSED

Except as described in this Privacy Policy, Foodzilla will not share, sell, or rent Personal Information with anyone without your permission or unless ordered by a court of law.

Foodzilla works with third-party services in Singapore, New Zealand, Australia, Europe and the USA that we allow access to Personal Information, and may use it on our behalf strictly for the purposes for which they are engaged. We minimise the amount of personal data that is utilised by these services, and we have ensured that these services process your data in accordance with the appropriate regulations. A full list of our third-party service providers is available in Section 10 below.

In rare circumstances, we may be obliged to disclose Personal Information if disclosure is required to comply with the law, if we believe our Terms of Service, located at https://foodzilla.com/terms, have been violated, if we believe it is necessary to protect our rights, or if the ownership and assets of Zilla Technologies were to be transferred to another party.

If you contact Foodzilla's customer support, your information will be shared with Help Scout (the third-party provider that Foodzilla uses to facilitate customer support operations). By using Foodzilla and its customer support service, you agree to sharing your name and email address with Help Scout. Your information is only used to identify your account within our service and to help you resolve any issues you have with the service.

Foodzilla uses Postmark as its email service provider to send transactional and system emails (such as account notifications, password resets, and subscription confirmations). By using Foodzilla, you agree that your name and email address may be shared with Postmark solely for the purpose of delivering these emails. Postmark does not use your information for any other purpose. Emails sent through Postmark are permanently deleted after 45 days. Foodzilla does not store the content of these emails in our systems.

SECTION 4 - THE SECURITY OF YOUR PERSONAL INFORMATION

Data transfer is encrypted with SSL and WSS, stored in state-of-the-art facilities, access is restricted to those who have a need to know, and we regularly review our technology to maintain security.

Personal Information is also encrypted at rest in our hosted database and in every backup we hold. Administrative access to production systems requires multi-factor authentication and is logged and reviewed. Details of where your data is hosted are set out in Section 6 below.

HIPAA compliance, including the execution of a Business Associate Agreement (BAA), is available exclusively on the HIPAA plan. The HIPAA plan provides access to core features only — including foods, recipes, and meal plan templates — and does not include any client-facing features such as client management, messaging, food diaries, or any functionality that involves the storage or processing of Protected Health Information (PHI). No PHI is stored or processed on the HIPAA plan. Customers on all other plans should not rely on the Service for the storage or processing of PHI as defined under HIPAA.

In the event that there is a breach and your Personal Information that we have collected directly is at risk, you will be notified within 72 hours of discovering the breach. You will be informed of what information is at risk, steps that we have taken to ensure your safety, and what action we are taking or have taken to rectify the breach. To the extent permissible at law, in the event that there is a breach and indirectly collected information is at risk, we will follow the same protocol, however the affected Customers (rather than the individuals) will be notified instead.

SECTION 5 - ACCESSING YOUR PERSONAL INFORMATION

You can request access to the Personal Information you have provided to us, via email to support@foodzilla.io This enables you to receive a copy of the data and to check that we are lawfully processing it.

If you think there’s a problem with the Personal Information we hold about you, you will either have the tools available to make these changes, or you can request a correction. This enables you to have any incomplete or inaccurate data we hold about you corrected (though we may need to verify the accuracy of the new data you provide to us).

If you want to delete your Personal Information, we'll take all reasonable steps to do so unless we are required to keep it for legal reasons, which will be notified to you, if applicable, at the time of your request. As we only collect information that is required, it is likely that revoking your consent will limit the functionality of your Foodzilla account.

Should you require to move your data to another service, you may request the transfer of your data (including Personal Information) to you or to a third party. We will provide to you, or a third party that you have chosen, your data in a structured, commonly used, machine-readable format.

You may withdraw consent at any time where we are relying on consent to process your Personal Information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. This will be notified to you at the time of your request if applicable.

SECTION 6 - INTERNATIONAL DATA TRANSFERS AND LOCAL PRIVACY LAWS

Foodzilla is a worldwide service, and we acknowledge that Personal Information about clients, patients, and the obligations of health professionals relating to them, may be subject to access and privacy laws in the country of residence of those patients and/or clients.

WHERE YOUR DATA IS HOSTED

Our primary data hosting is in Singapore. Customer and Client data — including account details, client records, meal plans, food diaries, messages, and health data — are stored in a MongoDB Atlas database cluster located in the Asia Pacific (Singapore) region. Backups of that data are encrypted and retained as described in Section 8 below.

In order to operate the Service, your Personal Information may also be transferred to and processed in other countries outside your country of residence, including New Zealand (where we are based), the United States, Australia, and countries within the European Union, where our third-party service providers are located. Section 10 below lists each provider and the region it processes data in, and the sub-processor table in our Data Processing Agreement sets out the same for every sub-processor we engage. We ensure that appropriate safeguards are in place for these transfers, including data processing agreements with our providers.

TRANSFERS FROM THE UNITED KINGDOM AND THE EUROPEAN ECONOMIC AREA

Singapore is not covered by UK adequacy regulations or an EU adequacy decision. Where we transfer Personal Information out of the United Kingdom or the European Economic Area, including to our primary hosting location in Singapore, we rely on the following transfer mechanisms:

• Transfers from the UK — the Standard Contractual Clauses approved by the European Commission, together with the International Data Transfer Addendum (the "UK Addendum") issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018, or the UK International Data Transfer Agreement (IDTA) where a provider offers it in place of the Standard Contractual Clauses.
• Transfers from the EEA — the Standard Contractual Clauses approved by the European Commission.
• Adequacy — for transfers to New Zealand, where we are based, we rely on the UK adequacy regulations and the EU adequacy decision recognising New Zealand as providing an adequate level of protection.

These contractual mechanisms sit alongside the technical safeguards described below and in Section 4. Where required, we carry out a transfer risk assessment before relying on them. You can request details of the transfer mechanism that applies to your data by emailing support@foodzilla.io.

AUSTRALIAN PRIVACY PRINCIPLE 8 - CROSS-BORDER DISCLOSURE

Where we disclose Personal Information about Australian individuals to an overseas recipient, including our primary hosting provider in Singapore, we take reasonable steps — as required by Australian Privacy Principle 8 and section 16C of the Privacy Act 1988 (Cth) — to ensure that the recipient does not breach the Australian Privacy Principles in relation to that information. Those steps include:

• Contractual obligations — binding data protection terms with every overseas provider that require standards of protection at least equivalent to those required of us under the Australian Privacy Principles, restrict use of the information to the services we engage the provider for, and prohibit any secondary use or disclosure.
• Encryption — Personal Information is encrypted in transit using TLS/SSL (and WSS for real-time connections) and encrypted at rest in the hosted database and in all backups.
• Access controls — access to Personal Information is restricted to authorised personnel on a need-to-know basis, administrative access requires multi-factor authentication, and access is logged and reviewed.
• Provider assurance — we favour providers that hold recognised independent security certifications (such as ISO 27001 or SOC 2), and we review the security and privacy practices of our providers regularly.
• Breach cooperation — our provider agreements require prompt notification of any security incident affecting Personal Information, so that we can meet our obligations under the Notifiable Data Breaches scheme.

We'll take all reasonable steps to comply with local access and privacy laws, to the extent consistent with legal obligations we have under New Zealand law, where we are based.

SECTION 7 - LEGAL BASIS FOR PROCESSING (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your Personal Information on the following legal bases:

• Contractual necessity — To provide the Service to you as a registered Customer, including account management, billing, and delivering the platform features you have subscribed to.
• Legitimate interest — To operate, improve, and secure the Service, to prevent fraud and abuse, and to communicate with you about your account. We balance our interests against your rights and only rely on this basis where the impact on you is minimal.
• Consent — For sending promotional emails and for the use of non-essential cookies and tracking technologies. You may withdraw consent at any time.
• Legal obligation — To comply with applicable laws, regulations, or lawful requests from public authorities.

SECTION 8 - DATA RETENTION

We retain your Personal Information for as long as your account is active or as needed to provide the Service to you.

Following cancellation or deactivation of your account, Foodzilla retains your data so that you may reactivate your account and resume service without loss of information. We do not automatically delete data upon cancellation. You may request permanent deletion of your data at any time by contacting us, and we will action this promptly across our live systems, with residual backup copies removed within our three month backup cycle.

Your data is not used by Foodzilla for any purpose while your account is inactive, except as required by law or to resolve disputes. Deletion requests can be sent to support@foodzilla.io, and we will confirm once the request has been actioned. We may retain information where retention is required by law.

BACKUP RETENTION

Foodzilla maintains encrypted backups for disaster recovery purposes. Backups are retained for up to three months, after which they are permanently and automatically deleted. When you request deletion of your data, it is removed from our live systems promptly, and any copies persisting in backups are erased within this three month window.

Transaction and billing records may be retained for up to 7 years to comply with tax and accounting obligations, even after a deletion request.

Anonymised or aggregated data that can no longer identify you may be retained indefinitely for analytical purposes.

SECTION 9 - CHILDREN'S PRIVACY

Foodzilla is designed for use by nutrition and health professionals. The Service is not directed at children under the age of 16, and we do not knowingly collect Personal Information from children. If a health professional uses Foodzilla to manage information about a minor client or patient, the professional is responsible for obtaining appropriate parental or guardian consent as required by applicable law.

If we become aware that we have inadvertently collected Personal Information from a child under 16 without appropriate consent, we will take steps to delete that information as soon as possible. If you believe we may have collected information from a child, please contact us at support@foodzilla.io.

SECTION 10 - THIRD-PARTY SERVICE PROVIDERS

Foodzilla uses the following third-party service providers to operate and improve the Service, and the region each one processes data in. Each provider only receives the minimum data necessary to fulfil its purpose:

• MongoDB Atlas — Primary database hosting and storage. Asia Pacific (Singapore).
• Cloudflare — Content delivery, DNS, and security. Global edge network.
• Stripe — Payment processing and subscription management. United States.
• OpenAI — Powers non-client-data features only. Client personal information and health data are never shared. No data is used for model training. United States.
• Ory — Authentication and identity management. European Union.
• Help Scout — Customer support and communication. United States.
• Google Analytics — Website usage analytics and advertising measurement. United States.
• Meta Pixel — Advertising measurement and conversion tracking. United States.
• Datafast — Privacy-focused website analytics. European Union.
• DigitalOcean — Analytics infrastructure and customer support services. United States.

We regularly review our third-party providers to ensure they meet our security and privacy standards. This list may be updated from time to time as we add or remove providers.

SECTION 11 - QUESTIONS OR COMPLAINTS

If you have any questions or complaints about our Privacy Policy or the way we handle your Personal Information, you can contact us at support@foodzilla.io. This is our preferred method of contact.