Data Processing Addendum (Summary)
This is a short summary aimed at anyone — organisational or business user — who needs to understand how MadsMenu processes data on their behalf. A full, signed DPA is available on request; see the end of this page.
Processor role
Where a household is used by a group acting for an organisation (for example, a shared house run by a small business or non-profit), the MadsMenu project acts as a data processor processing the household, member, and meal plan data you enter, strictly to provide the meal-planning service you've configured. We do not use this data for any purpose beyond delivering the service.
Sub-processors
The only sub-processor is Fly.io, our infrastructure hosting provider, which stores application data and runs the app servers. No other third party has access to your data. We don't use analytics vendors, ad networks, or CDN-hosted scripts of any kind.
Security measures
- Session and recovery credentials are stored as HMAC-SHA-256 hashes with a server-side pepper — never in plaintext.
- Session cookies are HttpOnly; CSRF protection uses a double-submit cookie pattern.
- All traffic is encrypted in transit via TLS.
- Rate limiting is applied to sensitive endpoints to reduce abuse and brute-force risk.
- No third-party scripts, fonts, or trackers run in the app, reducing third-party attack surface.
- Server logs strip cookie, authorization, CSRF, token, code, and invite fields before being written.
Breach notification
If we become aware of a personal data breach affecting your household's data, we commit to notifying affected controllers who have provided us contact information within 72 hours of becoming aware, consistent with GDPR Article 33.
More information
For everything else — data categories, retention, legal basis, and your rights — see the full Privacy Policy. A formal, signed DPA document is available on request via privacy@madsmenu.app, though it is not provided proactively given the project's current scale.