Privacy Notice
Effective date: 13 September 2026 · Last updated: 3 October 2026
1. Who we are
Mila (mila.menu) is a meal-planning tool for households, currently in a closed, invite-only pilot. It is run by John Bird, trading as Mila, a sole trader based in the United Kingdom, who is the data controller for the personal data described here. You can reach us at the feedback address shown in the app footer and on your Allergens & safety page. See also our Terms of Service.
2. What we collect, and why
| Data | Why we collect it |
|---|---|
| Your email address and a password (stored as a one-way hash — we never see or store the password itself) | To create your account, sign you in, send verification and password-reset links, and send the optional weekly planning reminder if you turn it on |
| Household set-up: household type (solo / pair / family), the name you choose to show, your plan-shape and servings defaults, theme choice, reminder day | To tailor planning to your household and remember your preferences |
| People in your household: a display name, whether they are an adult or child, appetite, dietary tags, allergens marked severe or preference, dislikes, and any “notes to yourself” | To plan meals everyone can eat and to run the allergen safety check. Allergen and dietary information is health data — see section 3 |
| Cooking preferences: equipment, complexity, cooking time, use-up items | To generate practical, achievable plans |
| What you make in Mila: meal plans, recipes, shopping lists, ratings, notes, collections and tags, cooking history, feedback on meals | To show your current plan and history, and to plan better over time |
| Things you import: the address of a recipe web page you paste (we fetch that page), or a photo of a recipe you upload | To turn a page or photo into a recipe. Photos are sent to our AI provider to read the recipe and are not stored by Mila |
| Optional recipe illustrations: if you ask Mila to illustrate a recipe, we generate an image and store it | To show the illustration on the recipe. The stored image is served from a public web address (it contains no personal data — it is a picture of a dish) |
| Share links and calendar feed: a random token for each shopping list or plan you share, and for your calendar subscription | So a link you hand to someone else works without them signing in — see section 6 |
| Billing (only once Mila Pro is live): your Stripe customer and subscription references, subscription status, chosen plan and renewal date | To know whether your household has an active Mila Pro subscription. We never see or store your card details — Stripe holds those |
| Technical data: standard web-server request logs (IP address, pages requested), error reports, and product-usage events (which features you use) | To keep Mila running, find and fix bugs, and understand which parts of the product are used |
We do not collect location data, data from social-media accounts, or advertising identifiers.
3. Legal basis
- Contract (Article 6(1)(b) UK GDPR). Running your account, generating your plans, and — once live — billing Mila Pro are all things we do to provide the service you signed up for.
- Explicit consent (Article 9(2)(a) UK GDPR) for health data: allergens, dietary tags and free-text dietary notes about you and the people in your household. By entering this information you give explicit consent for us to use it solely to plan meals and run the allergen check. You can withdraw that consent at any time by removing the information from your household, or by deleting your account. Information about children in your household is entered by you as their parent or guardian; Mila accounts themselves are for adults.
- Legitimate interests (Article 6(1)(f) UK GDPR) for keeping the service secure, monitoring errors, understanding product usage, and preventing abuse. You can object to this processing (section 8).
- Legal obligation for keeping billing and tax records once Mila Pro is live.
4. How Mila uses AI, and what it sends where
Mila uses AI models to write meal plans and recipes, swap meals, adapt a recipe when you ask, read imported pages and photos, and (optionally) illustrate recipes. What is sent to the AI provider for each job:
- Planning and swapping: your household's dietary tags, allergens, dislikes, cooking preferences, use-up items, and the household's shape (how many adults and children). Your name and email are never sent.
- Importing a recipe from a web page or photo: the text of that page, or the photo you uploaded.
- Adapting a recipe with Mila: the recipe (title, ingredients and method), the change you asked for, and your household's allergens and dietary tags. Your name and email are never sent.
- Re-checking a recipe's allergens: the recipe's ingredient list.
- Illustrating a recipe: a description of the dish (title and type), nothing about your household.
Important — the allergen safety check is not an AI decision. For allergens you mark as severe, Mila runs a fixed, rule-based word-matching check of each recipe's ingredient list. The AI writes recipes; the check itself is deterministic. What it does and does not catch is spelled out on your Allergens & safety page and in section 5 of the Terms of Service. Mila makes no automated decisions about you that have legal or similar effects.
5. Who we share your data with
Your data passes through the following service providers. We do not sell your data to anyone, and we do not share it with advertisers.
| Service | Purpose | What is sent |
|---|---|---|
| Supabase (EU, Stockholm region) | Database, sign-in, and file storage | Everything in section 2 — this is where your account lives |
| Anthropic | AI planning, swapping, recipe import, recipe adaptation, allergen re-checks | The inputs listed in section 4; never your name or email |
| OpenAI | AI recipe illustrations (only when you ask for one, and only once this is switched on for the pilot) | A description of the dish |
| Stripe (only once Mila Pro is live) | Payments and subscription management | Your email and the payment details you give Stripe directly; Stripe sends us back subscription references and status |
| Vercel | Hosting | Standard web-server request logs (IP address, pages requested) |
| Resend | Email delivery | Your email address and the content of the emails we send you (verification, password reset, reminders, data-export links, account notices) |
| Sentry | Error monitoring | Error reports, with dietary, allergen, recipe, plan, email and link-token fields removed before they leave the app. A small sample of sessions is recorded to help reproduce bugs, with all on-screen text masked |
| PostHog (EU) | Product analytics | Which features you use, tied to an anonymous user identifier — never dietary, allergen or recipe content, by rule |
Some of these providers (Anthropic, OpenAI, Vercel, Sentry) process data outside the United Kingdom, mainly in the United States, under their standard data-protection terms.
6. Public links and what they reveal
- A shared shopping list or plan is readable by anyone who has the link, without signing in. A shared plan shows the display name you chose (or the first part of your email address if you haven't chosen one). Share links stop working after 7 days, and you can revoke one at any time by sharing again or deleting it.
- Your calendar feed address works for anyone who has it and keeps working until you generate a new one from your Plans page. It contains your planned meals, not your household's dietary or allergen details.
7. Cookies and storage in your browser
Mila uses essential cookies to keep you signed in, plus a short-lived cookie during a password reset that proves the reset link was really used. Your theme choice is stored in your browser. PostHog stores an identifier in your browser so that visits can be told apart for analytics. There are no advertising or tracking cookies, and we do not show a cookie banner during the invite-only pilot; this is a documented decision that will be revisited at the privacy review.
8. Your rights, and how to use them
Under UK GDPR you have the right to access, correct, delete, and receive a copy of your personal data, to object to processing based on legitimate interests, and to withdraw consent for health data at any time.
You can exercise most of these yourself from Household → Account inside Mila:
- Download my data (right of access and portability) — Mila prepares a JSON file of everything we hold about you: your account and profile, household members, plans, meals, recipes, collections, tags, notes, ratings, cooking history, shopping lists, feedback, preference history, subscription status, and any account-closure record. Share-link and calendar tokens are redacted in the file because they are live credentials. The file is usually ready within a few minutes; we email you a download link that works for 24 hours, and the file itself is deleted after 7 days.
- Correct your data by editing it in the app. Change email sends a confirmation link to the new address, valid for 60 minutes; your existing address keeps working until you click it.
- Delete my account (right of erasure) — see section 9 for exactly what happens.
- Withdraw consent for health data by removing it from your household members, or by deleting your account.
For anything else — objecting to processing, a correction you can't make yourself, or a complaint — email the feedback address in the app. We will respond within 30 days. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
9. Deleting your account — what actually happens
- If your household has a Mila Pro subscription, we cancel it with Stripe first and wait for Stripe to confirm, so you cannot be charged for an account that no longer exists.
- We then delete your account and everything attached to it: profile, household members, plans, recipes, shopping lists, ratings, notes, share links, calendar feed, and any pending data export.
- We send a confirmation email to the address on the account.
This usually completes within a minute or two. If our payment provider cannot be reached, your account stays exactly as it is, you see a pending status with a support reference, and Mila retries automatically (at least once a day) until it completes.
What remains after deletion:
- One anonymised row per AI request (model name, token counts, cost) with no link to you, kept for cost auditing.
- A minimal account-closure record (an internal account identifier, Stripe references, timestamps, and your email address with most characters replaced by dots) kept to defend any later billing dispute. It contains no household, dietary, allergen or recipe content.
- Stripe keeps its own transaction records under its retention rules.
- Routine database backups kept by our database provider for a short rolling period, after which deleted data is gone from those too.
10. How long we keep your data
- While your account is active: everything in section 2.
- Data-export files: deleted 7 days after they are created (the download link itself expires after 24 hours).
- Share links: 7 days.
- Error reports and usage analytics: for a limited time under those services' retention settings, then deleted.
- After account deletion: only the items listed in section 9.
11. Changes to this notice
If we make material changes to this notice, we will email active users before the changes take effect. The dates at the top always reflect the current version.
See also our Terms of Service.