Privacy Policy
How we collect, use, and protect your personal data
Last updated: September 2026
Table of contents
1. Data controller
- Identity: GESTIÓN CALPE, S.L.U. (hereinafter, “Makroa”, which is its trade name)
- Tax ID (NIF): B26641332
- Registered address: c/ Navío 6, 4º A, 03710 Calpe (Alicante), Spain
- Registration: Commercial Register of Alicante
- Email: equipo@makroa.com
- Phone / WhatsApp: +34 675 97 55 88
- Website: https://makroa.com
We are not required to appoint a Data Protection Officer; the contact point for anything concerning your data is equipo@makroa.com.
You can contact us at any time to exercise your rights or resolve any questions regarding the processing of your personal data by writing to equipo@makroa.com.
2. Data we collect
2.1. Waitlist
When you join our waitlist, we store:
- Name and email address
- Preferred delivery zone, exactly as you type it, plus the district, municipality and postcode when we can work them out
- Nutritional goal (lose fat, build muscle, maintain)
- The language you browse in and your position on the list
- Source data: the campaign parameters in the URL you arrived with (UTM), the page you landed on, the site you came from (referrer) and an anonymous session ID. This tells us which channel brought you here, and the session ID links your signup to your earlier browsing and to the calculator if you used it.
2.2. Macro calculator
The maths happens in your browser, but what you type is stored on our servers, and it is stored step by step, as you go: if you leave halfway through, we keep whatever you had filled in up to that point. Specifically: sex, age, weight, height, activity level, goal and, if you finish, the resulting calories and macros.
Alongside those, each calculator session records the context of the visit: the step you reached, the language you browse in, your browser and device (user agent) and the campaign parameters in the URL you arrived with.
This is tied to an anonymous session ID, not to your name or email, so on its own it does not identify you. It only becomes linked to you if you then join the waitlist from that same session. We use it to size the service (which profiles and calorie ranges people are asking for) and to see where the calculator loses people so we can fix it.
2.3. Orders and customer account
When you place an order we store: first and last name, email address, phone number, delivery address and instructions for the courier, the dishes you chose and your order history, and your nutritional profile: target calories, macronutrient split, coverage percentage and, if you enter them, sex, age, weight, height, activity level, allergies and intolerances. Those last ones are health-related data and we only process them with your explicit consent, which we ask for through a separate tick box when you create your profile. Without that consent we can sell you dishes from the menu, but not adapt them to you. You can withdraw it at any time from your account or by writing to us; withdrawing it does not affect orders already prepared.
Payments. Payment is processed by Stripe Payments Europe, Ltd. (Ireland). Makroa neither sees nor stores your full card number: we receive from Stripe a payment-method identifier, the last four digits and the result of the charge. Stripe processes your data as an independent controller for fraud prevention, in accordance with its privacy policy (stripe.com/privacy).
2.4. Menu preferences (thank-you page)
Once you have signed up we ask you, entirely optionally, how many meals a week you would order and whether you follow any diet or have any dietary restriction. You can skip it and your signup stands exactly the same.
None, vegetarian and vegan are dietary preferences and we store them as they come. Allergies, gluten-free and lactose-free, however, are health-related data and fall under the special categories of Art. 9 GDPR: we only store them if you tick the specific consent box shown next to those options. The box is never pre-ticked, and if you leave it unticked those answers are discarded and never reach our database. When you do tick it, we also record the date and time, so we can evidence your consent.
We use this for one thing only: designing your menu and not sending you food you cannot eat. You can withdraw this consent whenever you like by writing to equipo@makroa.com; we will delete that data without affecting your place on the waitlist.
2.5. Browsing data
Independently of cookies, we log basic visit measurement on our own servers: page viewed, referring site, browser and device (user agent), language, campaign parameters and an anonymous session ID. It contains no name or email, although — as noted in 2.1 — the session ID lets us reconstruct your path if you end up signing up.
On top of that, if you accept analytics cookies through our consent banner, we load Google Analytics 4 and Microsoft Clarity, which collect browsing data such as pages visited, time on site, device type, language and country (with no identifiable IP address), plus heatmaps and anonymized recordings of how the page is used. If you decline cookies, neither tool ever loads.
2.6. Data we do NOT collect
We do not store your full card number or your banking credentials: payment is processed by Stripe under the terms of section 2.3. We do not collect data on political opinions, trade union membership, religion, ethnic origin, sex life, or genetic or biometric data. The only health data we process are the nutritional profile, allergies and intolerances you choose to give us under the terms of sections 2.3 and 2.4. Nor do we knowingly collect data from anyone under 18.
3. Purposes of processing
We process your personal data to:
- Manage the waitlist and send pre-launch communications (name, email, zone, goal).
- Understand which channel brought you here and measure which campaigns work (UTM, referrer, landing page, session ID).
- Calculate your macros and size the service — which profiles and calorie ranges people ask for (sex, age, weight, height, activity level, goal, calculated macros).
- Improve the calculator by seeing at which step people drop off.
- Design your menu and leave out ingredients you cannot eat (meals per week, dietary preferences and, with explicit consent only, allergies and intolerances).
- Analyse and improve the website.
- Comply with legal obligations.
When you buy: purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Manage and deliver your orders, charge for them and handle incidents | Identification, contact details, address, orders, payment | Performance of the contract (Art. 6.1.b GDPR) | While you are a customer and 5 years afterwards (contractual claims period) |
| Adapt the dishes to your nutritional needs | Nutritional profile, allergies and intolerances | Explicit consent (Art. 9.2.a GDPR) | Until you withdraw it, or 12 months without orders |
| Invoice and comply with tax and accounting obligations | Identification, address, amounts | Legal obligation (Art. 6.1.c GDPR; Spanish tax and commercial law) | 6 years from the invoice |
| Send you the menu of the week and Makroa news | Email address | Legitimate interest for customers (Art. 21.2 LSSI) and consent for everyone else | Until you unsubscribe (link in every email) |
| Manage allergens and food safety for your orders | Declared allergies and intolerances | Explicit consent; Regulation 1169/2011 also requires us to inform about allergens | Same as the nutritional profile |
4. Legal basis
- Consent (Art. 6.1.a GDPR): the basis for almost everything we process — joining the waitlist, using the calculator, and answering the optional menu questions. You can withdraw it at any time.
- Explicit consent (Art. 9.2.a GDPR): for health-related data — allergies and intolerances — which are a special category. We collect it through a dedicated box, separate from the rest of the form and never pre-ticked, and we record when you ticked it. Without that consent we process no health data at all.
- Legitimate interest (Art. 6.1.f GDPR): for the basic visit measurement on our own servers, which uses no cookies and builds no advertising profiles.
- Performance of the contract (Art. 6.1.b GDPR): to manage, charge for and deliver your orders and handle any incidents.
- Legitimate interest for customers (Art. 21.2 LSSI): to send you the menu of the week and news about products similar to those you have already bought. You can unsubscribe in one click from any of those emails.
- Legal obligation (Art. 6.1.c GDPR): when required by applicable law, including the tax and accounting obligations that come with invoicing.
5. Data retention
- Waitlist (including zone, goal and source data): until the service launches or until you ask us to delete it. Maximum 24 months from signup if the service does not launch.
- Calculator sessions (finished or abandoned): maximum 24 months from the session, or until you request deletion if they are linked to your signup.
- Menu preferences and health data (allergies and intolerances): while your signup stands, or until you withdraw consent. If you withdraw it, they are deleted immediately even though your signup continues.
- Our own visit measurement: maximum 24 months from the visit.
- Third-party analytics: Google Analytics 4, 14 months (standard configuration); Microsoft Clarity, 30 days for recordings (a reduced sample for up to 9 months) and 9 months for heatmaps.
- Orders, invoicing and customer nutritional profile: as set out in the table in section 3.
6. Your rights
Under the GDPR, you have the right to: access, rectification, erasure, restriction of processing, data portability — including your order history and nutritional profile in a machine-readable format —, objection, and withdrawal of consent, including the explicit consent for health data, which you can withdraw on its own without losing your place on the waitlist. To exercise these rights, email equipo@makroa.com.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. Data processors
We use the following data processors: Supabase (database, EU servers), Vercel (web hosting, EU with global CDN), Google Analytics 4 (analytics, EU region configured), Microsoft Clarity (heatmaps and session recordings, United States, with consent only), Resend (email delivery for our internal new-signup alerts, United States), Stripe Payments Europe, Ltd. (card payments, Ireland — which also acts as an independent controller for fraud prevention), the delivery operator Makroa contracts (your name, address, phone number and delivery instructions for your delivery day only; it will be named here once contracted) and our accounting firm (invoicing and tax obligations, Spain). All processors have signed appropriate data processing agreements.
8. International data transfers
Our main database (Supabase) is hosted in the EU (Frankfurt, Germany), and Google Analytics 4 is set to the EU data region. Microsoft Clarity (only if you accept analytics cookies) and Resend (internal new-signup alerts) process data in the United States. Stripe processes payment data through its European entity, Stripe Payments Europe, Ltd. (Ireland), although it may rely on its US parent company with the safeguards of Art. 46 GDPR. Any transfer outside the EEA is covered by Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46.2.c GDPR.
10. Minors
The service is intended for people over 18. We do not accept orders from minors and we do not knowingly collect personal data from children. If you believe your child has provided us with personal data, contact us at equipo@makroa.com.
11. Updates to this policy
We reserve the right to update this privacy policy. Significant changes will be communicated through this website or by email. We recommend reviewing this page periodically.
Questions about this policy? Write to us at equipo@makroa.com