Privacy Policy — Mibo

Last updated: September 21, 2026

1. Who we are

The Mibo mobile app (the “App”) is published by:

• Publisher: Rémi Dutot, sole trader (French entreprise individuelle / micro-entreprise)
• Address: 2 Impasse du Maine Poirier, 17360 La Clotte, France
• Registration number: SIRET 834 715 534 00022
• Contact / data controller: mibo@solis-apps.com

The publisher is the data controller for the personal data described in this document, within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the “GDPR”) and, for users located in Switzerland, within the meaning of Article 5(j) of the Swiss Federal Act on Data Protection (the “FADP”, see section 13). Details specific to users located in Quebec are set out in section 14.

2. How the App works, briefly

Mibo generates a weekly meal plan from preferences you provide during an onboarding flow (preferred store, weekly budget, household size, diet, declared allergies, disliked ingredients, meal style, kitchen equipment, number of dinners per week). There is no traditional account creation (no email/password): the App uses an anonymous Supabase session — a unique technical identifier generated automatically on install, with no sign-up or identity verification.

3. Data we collect

Your allergies and diet may reveal information about your health or religious beliefs, which is sensitive data (GDPR Art. 9, FADP Art. 5(c), Section 12 of the Quebec private-sector Act). This is why they stay only on your device: recipe selection is computed locally, and this information is never sent to our servers, analytics tools or service providers. The publisher has no access to it. It is erased when you use “Delete my data” or uninstall the App. See also the disclaimer in section 11.

4. Why we process this data (purposes and legal bases)

5. Who we share your data with (processors)

We do not sell personal data. Some data is shared with technical service providers, each acting as a processor under Article 28 of the GDPR, strictly for the purposes listed above:

Apple and Google, as operators of the App Store and Google Play, process subscription payments as independent controllers rather than as processors.

6. International data transfers

RevenueCat, Tenjin, Google/Firebase and Apple are US-based companies that may process data outside the European Union. These transfers rely on the following safeguards:

• Google LLC (Firebase / Google Ads): certification under the EU-US Data Privacy Framework, recognized as adequate by the European Commission (Art. 45 GDPR);
• RevenueCat and Tenjin: Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR), incorporated into the data processing agreement (DPA) entered into with each of them;
• Apple and Google Play, as store operators: they process payment data as independent controllers, under their own privacy policies and transfer safeguards.

The publisher reviews the safeguards applicable to each provider periodically, as certification statuses and contractual arrangements change over time. You may request details of the safeguards applicable to a given provider by writing to mibo@solis-apps.com.

Safeguards applicable to disclosures of data from Switzerland and from Quebec are described in sections 13 and 14.

7. Retention period

• Preferences and meal history: kept for as long as you use the App, until you exercise your right to erasure (section 9) or durably uninstall the App.
• Recent meal history: the last 14 days are actively used to avoid suggesting the same recipe too soon. No automatic purge policy currently applies to older history, which remains stored until you delete it.
• Feedback messages: kept until your request is handled, then for 12 months, unless deleted earlier via “Delete my data”.
• Diagnostic data (Sentry): kept per Sentry's retention policy, typically 90 days.
• Attribution/advertising data: kept per each partner's own retention policy (Tenjin, Google).

8. Your choices about advertising tracking (ATT and Android equivalent)

On iOS, the App asks for your permission via Apple's system-level “App Tracking Transparency” prompt before any tracking activity used for advertising attribution. You can review or change this choice at any time in your phone Settings > Privacy & Security > Tracking, or in Mibo > Settings > Tracking status (ATT).

If you decline, the App continues to work normally; only advertising attribution features are disabled or limited to non-individualized data.

9. Your rights

Under Articles 15 to 22 of the GDPR, you have the following rights over your personal data:

• Right of access: obtain a copy of your data;
• Right to rectification: correct inaccurate data — available directly in Preferences for your meal preferences;
• Right to erasure: delete your data — available directly in Settings > Delete my data, which erases your server-side preferences, meal history and feedback messages, as well as the preferences kept on your device (including allergies and diet), then returns you to onboarding;
• Right to restriction of processing;
• Right to object, in particular to processing based on legitimate interest (section 4);
• Right to data portability for data you provided to us;
• Right to withdraw consent at any time for processing that relies on it (section 8), without affecting the lawfulness of processing carried out before withdrawal;
• Right to set directives on the fate of your data after your death (French law, Art. 85 of the Loi Informatique et Libertés), for users in France.

To exercise these rights (other than in-app deletion), contact mibo@solis-apps.com. You may also lodge a complaint with your national data protection authority in the EU (e.g. the CNIL in France — www.cnil.fr), or the supervisory authority of your country of residence. If you reside in Switzerland or Quebec, your rights and the competent authority are set out in section 13 and section 14.

10. Security

Your data is protected by strict database-level access rules (Supabase Row Level Security): each anonymous session can only read, modify or delete its own data. Communications between the App and our servers are encrypted (TLS).

11. Important disclaimer — allergies and diet

To the extent permitted by applicable law, the publisher is not liable for any allergic reaction, health incident, or damage resulting from incorrect or incomplete food information.

12. Children

The App is not directed at individuals under 16. If you are between 13 and 16 (depending on the digital age of consent set by your EU country of residence), use of the App requires parental consent. In Switzerland, use of the App by a person aged 13 to 16 likewise requires the consent of their legal representative.

13. Users located in Switzerland (FADP)

If you reside in Switzerland, the processing of your data is also governed by the Swiss Federal Act on Data Protection of 25 September 2020 (the “FADP”, SR 235.1) and its Ordinance (the “DPO”, SR 235.11), which apply whenever processing has an effect in Switzerland (Art. 3 FADP). This entire document applies to users located in Switzerland; this section clarifies or adapts certain points.

13.1 Controller

The controller is the publisher identified in section 1, established in France, reachable at mibo@solis-apps.com. No representative in Switzerland has been appointed, as the cumulative conditions of Article 14 FADP (large-scale, regular processing involving a high risk to the personality of data subjects) are not met.

13.2 Principles and grounds for justification

The FADP does not require a legal basis for every processing operation; it requires compliance with the principles of lawfulness, good faith, proportionality, purpose limitation, accuracy and security (Arts. 6 and 8 FADP). Where a ground for justification is required (Art. 31 FADP), we rely on the grounds set out in section 4: performance of a contract, our overriding interest, or your consent. The advertising-tracking consent mechanism described in section 8 also applies in Switzerland.

13.3 Disclosure of data abroad

Your data may be disclosed to the recipients listed in section 5, located in the following countries:

• European Union member states (including Ireland and Germany): they are on the Federal Council's list of countries providing an adequate level of data protection (Art. 16(1) FADP, Annex 1 DPO);
• United States:
  • Google LLC: certification under the Swiss-U.S. Data Privacy Framework, recognized by the Federal Council as ensuring an adequate level of protection since 15 September 2024;
  • RevenueCat and Tenjin: European Commission standard contractual clauses recognized by the Federal Data Protection and Information Commissioner, adapted to Swiss law in the data processing agreement entered into with each of them (Art. 16(2)(d) FADP);
  • Apple and Google Play: see section 6.

13.4 Automated individual decisions

Your meal plan is generated automatically, but this is not an automated individual decision within the meaning of Article 21 FADP: it has no legal effect on you and does not significantly affect you. No other decision of this kind is made about you.

13.5 Your rights

In particular, you have the following rights:

• right of access to your data (Art. 25 FADP): we respond free of charge as a rule, within 30 days (Arts. 18 and 19 DPO);
• right to data delivery or transmission in a commonly used electronic format (Art. 28 FADP);
• right to rectification of inaccurate data (Art. 32(1) FADP);
• right to object to processing, to have it stopped, or to have your data erased or destroyed (Arts. 30(2) and 32(2) FADP) — erasure is also available directly in Settings > Delete my data;
• right to withdraw your consent at any time for processing that relies on it.

To exercise these rights, write to mibo@solis-apps.com. Since the App works without an account, we may ask you for the information needed to locate the data associated with your anonymous session. If you believe the processing of your data breaches the FADP, you may contact the Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch — or bring a claim before the competent civil courts.

14. Users located in Quebec (Law 25)

If you reside in Quebec, the processing of your personal information is also governed by the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25 (the “Act”). This entire document applies to users located in Quebec; this section clarifies certain points.

14.1 Person in charge of the protection of personal information

In accordance with Section 3.1 of the Act, the person in charge of the protection of personal information is Rémi Dutot, publisher of the App, reachable at mibo@solis-apps.com. Any question, access request or complaint about your personal information may be addressed to him.

14.2 Consent and privacy settings

Your information is collected from you, through the App, for the purposes described in section 4. In accordance with Sections 8.1 and 9.1 of the Act, the App's settings provide the highest level of confidentiality by default:

• advertising tracking (section 8) and audience measurement (PostHog) are off by default and only enabled with your consent, which you can withdraw at any time in Settings;
• the App does not use your device's geolocation;
• your allergies and diet, which may be sensitive information (Section 12 of the Act), stay only on your device (section 3).

14.3 Communication outside Quebec

Your personal information is communicated outside Quebec, to the service providers listed in section 5, in the European Union (Ireland, Germany) and the United States. These communications are governed by the contractual commitments and safeguards described in section 6 (Section 17 of the Act).

14.4 Automated decisions

Your meal plan is generated automatically, but no decision based exclusively on automated processing and producing effects on you is made within the meaning of Section 12.1 of the Act.

14.5 Your rights

• right of access to your personal information and right to rectification of information that is inaccurate, incomplete or equivocal (Sections 27 and 28 of the Act): we respond within 30 days (Section 32);
• right to portability: obtain the computerized information collected from you in a structured, commonly used technological format (Section 27);
• right to withdraw your consent at any time, and to request deletion of your information — available directly in Settings > Delete my data.

To exercise these rights, write to mibo@solis-apps.com. In the event of a confidentiality incident presenting a risk of serious injury, we will notify you and the Commission d'accès à l'information (Section 3.5). If you are not satisfied with our response, you may contact the Commission d'accès à l'information du Québec (CAI) — www.cai.gouv.qc.ca.

15. Users located in other countries

Since the App is distributed worldwide via the App Store and Google Play, the principles in this document (GDPR) are applied as our baseline standard of processing for all users. If you reside outside the EU, Switzerland and Quebec, additional local regulations may grant you different or additional rights (for example, the California Consumer Privacy Act for California residents). This document does not detail those local regimes; to exercise a right specific to your jurisdiction, contact mibo@solis-apps.com.

16. Changes to this policy

This policy may be updated to reflect changes to the App or to applicable law. The “last updated” date at the top of this document reflects the latest revision. You will be notified in-app of any material change.

17. Contact

For any question about this policy or your personal data: mibo@solis-apps.com. No Data Protection Officer (DPO) has been appointed to date, as appointing one is not mandatory given the scale and nature of the Publisher's processing activities.