Data Processing Agreement
Last updated: November 08, 2026
This Data Processing Agreement ("DPA") supplements and forms part of the Terms of Service between you and ialae, operator of OmadMode (the "Service"), and applies where and to the extent that ialae processes personal data on your behalf as a processor, or where applicable data protection law (such as the EU/UK GDPR) requires such terms. For personal data where ialae determines the purposes and means of processing, ialae acts as a controller and our Privacy Policy applies.
1. Definitions
"Personal data", "processing", "controller", "processor", "data subject", and "supervisory authority" have the meanings given in applicable data protection law. "Applicable Data Protection Law" means all laws and regulations relating to the processing of personal data that apply to the parties, including the EU GDPR, the UK GDPR, and other equivalent laws.
2. Roles and scope
To the extent ialae processes personal data on your behalf (for example, information contained in the inputs and content you submit), you are the controller and ialae is the processor. ialae processes such personal data only to provide the Service and on your documented instructions (including as set out in the Terms and your use of the Service), unless required otherwise by law, in which case ialae will inform you where legally permitted.
3. Subject-matter, duration, nature and purpose
- Subject-matter: processing of personal data to provide the Service.
- Duration: for the term of your use of the Service and as required thereafter by law.
- Nature and purpose: generating meals and nutritional estimates, operating your account and library, billing, analytics, support, and security.
- Types of personal data: account identifiers, profile and preference data, usage and technical data, and any personal data you choose to include in your inputs.
- Categories of data subjects: you and any individuals whose data you include.
4. Processor obligations
ialae will: (a) process personal data only on documented instructions; (b) ensure persons authorised to process personal data are bound by confidentiality; (c) implement appropriate technical and organisational measures (section 6); (d) respect the conditions for engaging sub-processors (section 5); (e) assist you, taking into account the nature of processing, in responding to data-subject requests and in meeting your security, breach-notification, impact-assessment, and consultation obligations; (f) at your choice, delete or return personal data at the end of the services, except where retention is required by law; and (g) make available information necessary to demonstrate compliance and allow for and contribute to audits, subject to reasonable confidentiality and security conditions.
5. Sub-processors
You provide general authorisation for ialae to engage sub-processors to process personal data, provided that ialae imposes data protection obligations on them that are no less protective than those in this DPA and remains responsible for their performance. We will give reasonable notice of the addition or replacement of a sub-processor, and you may object on reasonable data-protection grounds. Our current sub-processors are:
| Sub-processor | Purpose | Data processed |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, database, object storage (S3), and email delivery (SES) | All Service data; transactional email |
| OpenAI | AI generation of recipes and nutritional estimates from your inputs | Your inputs and generation prompts |
| ScoutVibe | Product and website analytics | Usage events, device/analytics data, hashed IP |
| PayPal (via our billing service) | Subscription billing and payment processing | Billing and subscription data |
| Optional single sign-on (OAuth) | Email and account identifier, only if you use Google sign-in |
6. Security measures
ialae implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including: encryption of data in transit; hashing of passwords; access controls and least-privilege access; logical separation and network controls; monitoring and logging; and procedures for restoring availability after an incident. Measures may be updated provided the level of security is not materially decreased.
7. Personal data breaches
ialae will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide information reasonably available to help you meet your notification obligations.
8. International transfers
Where processing involves transfers of personal data across borders, the parties will rely on an appropriate transfer mechanism (such as standard contractual clauses) where required by Applicable Data Protection Law.
9. Data-subject requests
Taking into account the nature of the processing, ialae will assist you by appropriate technical and organisational measures, insofar as possible, to respond to requests from data subjects exercising their rights.
10. Deletion and return
On termination of the Service, or on your request, ialae will delete or return personal data processed on your behalf and delete existing copies, except to the extent retention is required by law (see the Privacy Policy for retention).
11. Liability and conflict
Liability under this DPA is subject to the limitations in the Terms. In case of conflict between this DPA and the Terms on data protection matters, this DPA prevails.
Questions: contact@ialae.com.
This document is provided for transparency and does not constitute legal advice.