Privacy Policy

General provisions

In accordance with the provisions of Law No. 195/2024 of the Republic of Moldova «On the Protection of Personal Data», Prana Cafe SRL collects and processes personal data of Users. The processing of personal data is carried out in good faith, on a legal basis and in strict accordance with the requirements of current legislation.

Processing of personal data can be carried out both by automated and non-automated methods, with compliance with measures ensuring security, confidentiality and protection of the rights of personal data subjects.

What data we collect

The Company processes only those personal data that the User voluntarily provides when using the website www.foodplan.md, including when placing an order and filling out a questionnaire. Such data may include:

  • first and last name;
  • phone number;
  • delivery address;
  • email address;
  • other information necessary for the provision of services.

Questionnaire and individual meal selection

Additionally, when filling out the questionnaire on the site, the User may provide information regarding lifestyle, dietary preferences and other parameters that are necessary for the nutritionist to select and create an individual meal plan.

Filling out the questionnaire is voluntary. Providing such data means the User's consent to their processing exclusively for the purpose of providing services and does not imply the transfer of this data to third parties, except as provided by law.

Purposes of personal data processing

Personal data of Users is used exclusively for the following purposes:

  • administration of the website www.foodplan.md;
  • providing access to the site's functionality;
  • processing and delivery of orders;
  • communication with the User in the framework of service provision;
  • improving service quality.

Any information provided by the User on the website www.foodplan.md is considered as an expression of consent to the processing of personal data in accordance with this Privacy Policy and current legislation.

Transfer of personal data to third parties

Prana Cafe SRL does not transfer personal data to third parties, does not sell or exchange it, except for cases directly provided by the legislation of the Republic of Moldova, including upon lawful request of state bodies or other authorized authorities.

Personal data may be used in anonymized form for statistical, analytical and internal marketing purposes aimed at improving the quality of services provided.

Data storage and protection

Personal data is processed and stored only for the period necessary to achieve the purposes for which it was collected, or for the period established by the legislation of the Republic of Moldova.

The Company takes necessary organizational and technical measures to protect personal data from unauthorized access, loss, destruction, alteration or disclosure. Only authorized persons who are obliged to maintain confidentiality have access to personal data.

Payment information

Prana Cafe SRL does not collect and store data related to payment transactions. Payment information is processed exclusively by payment services in accordance with their own security policies.

Legal bases for processing

We process your personal data only when we have one of the legal bases set out in Art. 6 of Law No. 195/2024:

  • Your consent — for marketing cookies (Meta Pixel, Google Ads, our fp_attr attribution cookie) and for processing data submitted through contact and free-consultation forms.
  • Performance of a contract — to process, deliver and bill your order (name, phone, address, order history).
  • Compliance with a legal obligation — retention of accounting and tax records in the scope and periods required by the legislation of the Republic of Moldova.
  • Our legitimate interests — protecting the site from fraud and fixing technical issues, site visit statistics, advertising measurement by click identifier. For each of these we have documented in writing how our interests weigh against your rights, and you may object at any time — see the section below.

Site statistics and advertising measurement

Visit statistics. We use Google Analytics 4 to understand which pages people read, where they abandon a form and what is worth improving. We collect the page address, device and browser type, approximate region; the IP address is not retained. Advertising features, Google Signals and data sharing with Google Ads are switched off — statistics are not used to show you ads. The basis is our legitimate interest (Art. 6(1)(f) of Law No. 195/2024): understanding how the site we pay for actually works. You can switch it off with the “Necessary only” button in the cookie banner or the “Statistics” toggle in its settings.

Advertising measurement. If you came to the site from a Google or Meta advertisement and submitted an enquiry, we tell that platform the enquiry happened. We transmit: the click identifier the platform itself issued on arrival, the page address, the time and — as Meta technically requires — the IP address and browser type. We do not transmit your name, phone, e-mail or the content of the enquiry — neither in the clear nor as hashes. Nothing is stored on your device. The purpose is to pay only for advertising that brings customers. The basis is our legitimate interest (Art. 6(1)(f)).

How to object. Tick “Do not tell advertising services about my enquiry” in the form, press “Necessary only” in the cookie banner, or write to foodplanmd@gmail.com. An objection takes effect immediately and does not affect how we handle your enquiry or serve you. This is your right under Art. 21 of Law No. 195/2024.

Marketing cookies, advertising audiences and retargeting work only with your consent — the “Accept all” button or the “Marketing” toggle in cookie settings.

Data retention periods

We keep your personal data only for as long as necessary for the purposes for which it was collected:

  • Data from contact forms where no order was placed — 2 months, then deleted.
  • Customer data (name, phone, address, order history) — 1 year from the date of the last order, then deleted or anonymized.
  • Ad click identifier — stored together with the enquiry and deleted on the same schedule.
  • Cookie-consent records (fp_consent) — 180 days.
  • Accounting and tax records — for the periods required by the legislation of the Republic of Moldova.
  • Technical web-server logs — up to 90 days.

International data transfers

Some of the services we use are located outside the Republic of Moldova:

  • Vercel Inc. (website hosting) — European Union region.
  • Neon Inc. (database) — European Union region.
  • Functional Software, Inc. (Sentry — technical error monitoring) — stored in the European Union region. Technical data is collected: the error text, page address, browser and device type. Session recordings are stored anonymized — all text and form field contents are masked before sending, so your name, phone and other entered data never reach them. The company is registered in the USA, so Standard Contractual Clauses (SCC) apply.
  • Google LLC (Google Analytics 4, Google Ads) — United States. We transmit visit statistics and, if you arrived from an advertisement and have not objected, the fact of an enquiry together with the ad click identifier. Transfer is based on Standard Contractual Clauses (SCC) approved by the European Commission.
  • Meta Platforms Ireland Ltd. (Meta Pixel and Conversions API) — Ireland/USA. If you arrived from an advertisement and have not objected, on form submission we report the fact of the enquiry to Meta: the ad click identifier issued by Meta itself, the page address, IP address and browser type. Name, phone and e-mail are not transmitted — neither in the clear nor as hashes. The Meta Pixel in the browser loads only with your consent. Standard Contractual Clauses (SCC) approved by the European Commission apply.

Transfers for statistics and advertising measurement rely on our legitimate interest — you may object at any time. Transfers involving marketing cookies happen only with your consent, which you may withdraw at any time.

Cookies and other tracking technologies

We use three categories of cookies:

  • Necessary (always on): fp_consent (remembers your cookie choice — 180 days), session cookies for form functionality and CSRF protection.
  • Statistics (legitimate interest, can be switched off): _ga, _ga_KVL28GYH1V — Google Analytics 4 without advertising features, anonymised visit statistics (13 months).
  • Marketing (only with consent): our own traffic-attribution cookie fp_attr (30 days), _fbp (Meta Pixel, 90 days), _gcl_* (Google Ads, 90 days).

You can manage consent at any time via the "Cookie settings" link in the site footer. Withdrawing consent does not affect the lawfulness of processing prior to withdrawal.

Rights of data subjects

Under Arts. 15-22 of Law No. 195/2024 you have the following rights:

  • Right of access — obtain confirmation of processing and a copy of your data.
  • Right to rectification — correct inaccurate or incomplete data.
  • Right to erasure ("right to be forgotten") — request deletion of data that is no longer needed or where you withdrew consent.
  • Right to restriction of processing — temporarily pause processing in certain cases.
  • Right to portability — receive your data in a structured, machine-readable format, or transfer it to another controller.
  • Right to object — against processing based on our legitimate interests or direct marketing.
  • Right not to be subject to a decision based solely on automated processing, including profiling.

How to exercise your rights and file a complaint

To exercise any of the rights above or to withdraw consent:

  • Write to foodplanmd@gmail.com — subject line "Personal data".
  • Or call: +373 79 444 403 (WhatsApp — same number).

We respond within 30 calendar days of receiving the request (up to 60 days for complex cases, with prior notice).

You can withdraw cookie consent at any time via the "Cookie settings" link in the site footer.

If you believe your rights have been violated, you may file a complaint with the National Center for Personal Data Protection of the Republic of Moldova (CNPDCP): website https://www.datepersonale.md, address str. Serghei Lazo 48, Chișinău, MD-2004, phone +373 22 811 807.

Automated decisions and profiling

We do NOT use automated decision-making, including profiling, that would produce legal or similarly significant effects concerning you. All decisions about meal composition and nutrition recommendations are made by our doctor-nutritionist on the basis of a free consultation, not by an algorithm.

Contact information

Personal data controller — Prana Cafe SRL. Registered address and tax code (IDNO) are provided upon reasoned request.

For any questions about the processing of personal data, use of the site or the content of this Privacy Policy:

  • Email: foodplanmd@gmail.com
  • Phone / WhatsApp: +373 79 444 403
  • Instagram: @foodplan.md

Updates to the Privacy Policy

We may update this Policy as our processes or the law change. We will notify you of material changes via the site (banner, refreshed cookie prompt, or email if we have one). The current version is always available at /privacy-policy. Last updated: 25 August 2026.

Have questions?

Leave a request or message us — we'll happily get in touch to help you pick your perfect plan.

0 (79) 444403Call