Privacy Policy
Last updated: 2026
Who we are
Acara Crest Inc (the "Company", "we", "us") operates Eat 4 Well at https://eat4well.com (the "Site" and the "Service"). We are the controller of the personal information described in this policy. You can reach us at [email protected], by phone on +1 (888) 856-1359, or by post at 4118 Brookside Oaks, Owings Mills, MD 21117, USA.
This policy explains what information we collect when you visit the Site or use the Service, why, who we share it with, how long we keep it, how we protect it, and the rights you have over it.
Information we collect
Account information. When you create an account we collect your name, email address, phone number and billing address, and a password that we store only as a one-way hash.
Payment information. Payments are taken by our payment processor, which collects your card number, expiry date and security code directly. We never store the full card number or the security code. We keep only a payment reference, the card brand, the last four digits and the expiry month and year, so we can show you which card is on file, send receipts and handle refunds.
Orders, subscriptions and support. We keep a record of what you bought, when, for how much, the status of each order and subscription, refunds, and the emails we have sent you. If you contact us, we keep the correspondence.
Information specific to the Service. The Service stores the content and settings you create in it. The product pages on this Site describe what that is; where the Service processes anything beyond ordinary account data, this policy says so in the section "Information specific to this Service" below.
Information collected automatically. When you use the Site we record your IP address, browser and device type, the pages you request, the time of each request and, for security, failed login attempts. This is server log data; we do not run third-party analytics or advertising trackers on the Site.
Cookies. We use a small number of cookies that are necessary for the Site to work: a session cookie that keeps you logged in, a cookie that protects forms against cross-site request forgery, and a short-lived cookie that carries a message from one page to the next. Our network provider may set a security cookie to tell real browsers from automated traffic. None of these is used for advertising or sold to anyone. You can delete or block cookies in your browser, but the Site cannot keep you logged in without them.
How we use information
We use personal information to: provide the Service and your account; take payment, send receipts, renewal notices and other billing messages; answer questions and provide support; keep the Site secure and prevent fraud and abuse; comply with legal, tax and accounting obligations; and, only if you ask for them, send product news. We do not sell personal information, rent it, trade it, or share it with anyone for their own marketing.
Where European or UK data-protection law applies, our legal bases are: performance of our contract with you (the account, the Service, billing and support); our legitimate interests in running, securing and improving the Service; compliance with legal obligations; and your consent, for any optional communication, which you can withdraw at any time.
Who we share information with
We share personal information only with the providers we need to run the Service, each bound by a contract that limits what they may do with it:
- Payment processing. Our payment processor receives the details needed to take and refund payments. Card data goes to the processor, not to us.
- Hosting and storage. The Service, its database and any files you store in it run on Amazon Web Services in the United States (US East, Northern Virginia). Database backups are stored in the same region.
- Network security and delivery. Cloudflare sits in front of the Site, providing DNS, TLS and protection against attacks, and therefore sees the traffic between your browser and the Site.
- Email delivery. The provider that delivers our transactional email (receipts, notices, alerts, password resets) processes the recipient address and the message.
We also disclose information when the law requires it, to establish or defend legal claims, to protect the rights and safety of our customers or others, and, if the business is sold or merged, to the new owner under the same commitments.
A current list of these providers is available from [email protected] on request.
Information specific to this Service
Eat 4 Well is an AI nutrition coach, so it processes health-related information you choose to give it. This is sensitive data; we process it only to provide the service to you, and only with your consent, which you give by entering it and can withdraw by asking us to delete it.
- Your profile: first name, sex, age, height, weight and target weight, activity level, goal, diet type, food preferences, allergies and any medical conditions you enter.
- What the service generates for you: meal plans, recipes, grocery lists, food-check results, assessment results, journal summaries and recommendations. Recipes are cached and may be reused for other members with the same dietary constraints; the cache holds no name or account.
- Coach conversations: every message you send and every reply.
- Journal entries and health assessment answers.
- Files you upload: blood-test PDFs and the values read from them, and photos of food for photo checks. Files are stored in our private storage and served only to you; the staff who run this site can open them when they help you or investigate a problem.
- Support requests: your name, email and message, delivered to our support mailbox.
- Usage records: which feature was used, when, and the size of the AI request, for plan limits and billing. These records never contain your messages or results.
Who processes this content. To produce an answer the service sends what the answer needs to Anthropic (the provider of the Claude models): for recipes and meal plans, your allergies, conditions, diet type, preferences and calorie target; for food checks, the same plus the product label text or the photo; for the coach, your first name, allergies, conditions, diet type, preferences, goal, calorie and macro targets, your latest assessment, values from your most recent blood-test reports, your recent journal entries and summary, relevant library passages and the recent conversation; for blood-test reading, the whole PDF you uploaded; for journal summaries, your recent entries. Anthropic processes it under its API terms as our processor; we do not use your data to train AI models and we send none of it for marketing. Open Food Facts receives only the barcode you scan. The member area loads a font from Google Fonts and shows library videos from YouTube or Vimeo, which see your IP address when a page with them loads. Payment, hosting, backups, network delivery and email are the providers named above.
How long it is kept. Everything in your account is kept until you ask us to delete it, including after a plan ends: profile, generated plans (earlier versions are kept as superseded), conversations, journal, assessments, blood-test documents and photos. You can delete a food-check scan and its photo yourself from the scanner. Closing your account or deleting data: email [email protected] and we delete your account, or the items you name, within 30 days, keeping only the billing records the law requires us to hold.
How long we keep information
- Account information: for as long as your account exists, and for up to 30 days after you ask us to close it, so we can complete the closure and honour refund requests.
- Orders, payments, receipts and refunds: for as long as accounting, tax and payment-dispute rules require after the transaction.
- Support correspondence: for up to two years after the last message.
- Server logs and security records: for up to 90 days.
- Email delivery records: for 90 days.
- Backups: encrypted database backups are kept for up to 14 days and then overwritten; information deleted from the Service disappears from backups on that cycle.
When a retention period ends we delete or anonymise the information.
Security
All traffic between your browser and the Site is encrypted (TLS). Passwords are hashed with a modern algorithm and cannot be read by us. Card numbers never touch our systems. Access to production data is limited to the people who operate the Service and is logged. If we become aware of a breach of security that affects your personal information, we will notify you and, where the law requires it, the relevant supervisory authority without undue delay, and within 72 hours where that timescale applies.
International processing
The Service is hosted in the United States and may be supported from other countries. If you use it from the European Economic Area, the United Kingdom or elsewhere, your information is transferred to and processed in the United States. Where that transfer needs a legal safeguard we rely on standard contractual clauses or an equivalent mechanism with our providers.
Your rights
You can ask us to: tell you what personal information we hold about you and give you a copy; correct it; delete it; restrict or object to how we use it; and provide it in a portable format. You can withdraw consent to any optional communication at any time. If you are in the European Economic Area or the United Kingdom you also have the right to complain to your data-protection authority. If you are a California resident, you have the right to know what personal information we collect, use and disclose, to request its deletion or correction, and not to be discriminated against for exercising these rights; we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of.
How to make a privacy request
Email [email protected] with the subject "Privacy request", from the address on your account, saying what you would like us to do. We may ask you to confirm your identity. We answer within 30 days, free of charge, and explain our reasons if we cannot do what you ask.
Children
The Service is not directed at anyone under 18 and we do not knowingly collect information from them. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy. The date at the top shows the current version. If a change is material we will email the address on your account before it takes effect.
Contact
Acara Crest Inc
4118 Brookside Oaks, Owings Mills, MD 21117, USA
Email: [email protected]
Phone: +1 (888) 856-1359 (Mon–Fri, 9am–6pm)
