Privacy policy
[to confirm: draft] Draft of 23 October 2026, written to the General Data Protection Regulation (GDPR) and Dutch law. Before publication the points marked [to confirm] are filled in and the text is checked by a lawyer. The Dutch version prevails; this translation is for convenience.
This policy covers the Sevenhills Software website and our products. Today that is one product, Mealbooks. It explains which personal data we use, why, on which legal basis, who receives it, how long we keep it and what rights you have (articles 13 and 14 GDPR).
1. Who we are
Sevenhills Software, a sole trader (eenmanszaak) of Subhashini Sivasubramani
Saturnus 16, 1188 EC Amstelveen, Netherlands
KVK (Dutch trade register) 42162009 · VAT ID NL005545855B86
Privacy questions: nakshafoods@gmail.com
We are the controller for the data in sections 2 to 4. We have no data protection officer; we are not required to appoint one (article 37 GDPR). Questions go to the address above.
For the business data our customers keep in Mealbooks about their own customers, suppliers and staff, we are not the controller but the processor: see section 10.
2. The website
- The website sets no cookies, stores nothing in your browser and has no analytics, advertising or tracking. The fonts are on our own server, so your browser does not contact Google or any other font service. See the cookie policy.
- There is no contact form. If you e-mail us, we use your address and message only to answer you (legitimate interest, article 6(1)(f) GDPR, or steps before a contract, article 6(1)(b)).
- The server that hosts the website records standard technical data for each request (shortened IP address, date and time, page, browser), to deliver the site and keep it secure (legitimate interest, article 6(1)(f)). These logs are deleted after 30 days.
3. Mealbooks: what we process about you
| Category | What | Where it comes from |
|---|---|---|
| Account data | name, e-mail address, phone number, username; your password only as a one-way hash | you, or the business that gave you an account |
| Company data | business name, type of business, country, address, trade register number, VAT number, IBAN | you |
| Sign-up data | e-mail address and registration number used for a free trial; whether the sign-up looks like an earlier one (same registration number, e-mail domain or phone number); when you accepted our terms, privacy policy and processing agreement, and which version | you |
| Subscription and payment data | subscription status, our invoices to you, payments on them, the payment reference and method Mollie reports; for business customers in another EU country the result of the VAT number check (section 5) | you, Mollie, the EU VIES system |
| Support | your questions in Help & Support, our answers, an attached file, a rating | you |
| Technical and security data | sign-in sessions (last activity), failed sign-in attempts, temporary address-based counters against password guessing, two-step sign-in codes (only as a hash), server logs | your use of Mealbooks |
Giving your account, company and sign-up data is necessary to conclude and perform the contract: without it we cannot create an account. Giving payment data is necessary for a paid subscription. Everything else is optional.
We do not use your data for advertising, we do not sell it, we do not build profiles, and we take no decisions about you based solely on automated processing (article 22 GDPR). The check of a new sign-up against earlier ones only marks it for a person to look at; it never refuses you by itself.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, providing Mealbooks, the service e-mails (sign-up code, trial reminders, payment, deletion and security messages) | Performance of the contract, article 6(1)(b) |
| Invoicing, keeping our invoices and payment records, the VAT treatment of your subscription (including the VIES check) | Legal obligation under tax law, article 6(1)(c) |
| Security: account locks, sign-in checks, logs, backups | Legitimate interest in a secure, reliable service, article 6(1)(f) |
| One free trial per e-mail address, noticing repeated sign-ups | Legitimate interest in preventing misuse of the free trial, article 6(1)(f) |
| Proof that you accepted our terms | Legitimate interest in being able to prove the agreement, article 6(1)(f) |
| Answering support questions | Performance of the contract, or our legitimate interest when you are not (yet) a customer |
| Complying with orders of courts and authorities | Legal obligation, article 6(1)(c) |
Where we rely on our legitimate interest, we have weighed it against your interests; you can object at any time (section 9). We do not ask for consent for any of the above, so there is no consent to withdraw.
5. Who receives your data
We use service providers that process data for us under a processing agreement (article 28 GDPR), and a few parties that act under their own responsibility.
| Recipient | Role | Purpose | Data |
|---|---|---|---|
| Hosting provider Hetzner Online GmbH, data centre in Germany | Processor | Running Mealbooks and the website, the database, files and backups | All data in Mealbooks |
| E-mail delivery provider Brevo (Sendinblue SAS), France | Processor | Sending e-mails from Mealbooks | E-mail address, name, the message |
| Google (Gmail), for our mailbox nakshafoods@gmail.com | Provider of our mailbox | Receiving and answering e-mail you send us | Your e-mail and its content |
| Mollie B.V., Amsterdam | Independent controller (licensed payment institution) | Your subscription payments | Name, e-mail, the bank or card details you give Mollie, amounts. Mollie’s own privacy statement applies |
| European Commission and the tax authority of your country, through VIES | Independent controllers | Checking that an EU VAT number is valid (business customers outside the Netherlands only) | Your VAT number and country |
| Google (Google Maps Platform) | Processor | Turning delivery addresses into map positions, only when Route Planning is switched on for your company | Delivery addresses (no names) |
| OpenStreetMap Foundation (Nominatim) | Processor | Back-up for the same address lookup, only with Route Planning | Delivery addresses (no names) |
| Authorities, courts | Independent controllers | Only when the law obliges us | What the order requires |
When you send an invoice through WhatsApp, Mealbooks only opens WhatsApp on your own device with the text filled in; what you send there is between you and WhatsApp.
6. Transfers outside the European Economic Area
Mealbooks is hosted in the EU or EEA. Data leaves the EEA only where a recipient above is established outside it, and only with a safeguard from chapter V GDPR:
- Google (Google LLC, United States): the EU–US Data Privacy Framework (adequacy decision of 10 July 2023), under which Google LLC is certified, and the European Commission’s standard contractual clauses.
- OpenStreetMap Foundation (United Kingdom): the European Commission’s adequacy decision for the United Kingdom.
Each delivery address is looked up once and then remembered for your company only, so it is sent as rarely as possible.
7. How long we keep your data
| Data | How long |
|---|---|
| Account and company data | As long as the account exists. After a trial ends or a subscription stops, the account is switched off and deleted after a waiting period: at least 30 and at most 50 days for an online sign-up. We e-mail you 30 and 7 days before; until the deletion you can sign in and download all your data |
| Final export at deletion | 30 days after the deletion, then removed |
| Backups | Overwritten within 30 days |
| Sign-up data and proof of acceptance | 2 years after the sign-up, and never shorter than the account exists |
| Our invoices to you and the payments on them | 7 years after the end of the year they belong to (Dutch tax law, article 52 General State Taxes Act), also after your account is deleted |
| Closed support tickets | 1 year after closing |
| Sign-in sessions | 1 day after your last activity |
| Counters against password guessing, sign-up and two-step codes | Minutes to hours: until their time window or the code expires |
| Server logs | 30 days |
The business data you keep in Mealbooks (section 10) follows your own settings: archived records are deleted after the period set for your company (default 10 years) and HACCP checks 2 years after their date.
Issued invoices, credit notes and payments are not changed or deleted in Mealbooks afterwards: a mistake is corrected with a credit note or by reversing a payment with a reason. Each of them, and every monthly and yearly closing, is also kept in your company’s chained record: document numbers and dates, amounts and VAT per rate, the payment method, the reason for a reversal, and references to the customer and to the user who recorded it. That record is never changed, is included in the backups and in Download my data, and is kept as long as the account exists; it is deleted only when the account itself is deleted.
8. Security
- Passwords are stored only as a one-way hash. An account is locked for a while after 5 wrong passwords; two-step sign-in with a code sent by e-mail can be switched on.
- Every company sees only its own data. Only Sevenhills Software’s owner has administrator access, and looks at a customer’s data only when needed to help that customer, to keep the service secure, or because the law requires it.
- Connections are encrypted (HTTPS). The data is backed up every night. Uploaded photos are made smaller and stripped of hidden details (such as location) before they are stored.
- If a personal data breach is likely to put you at risk, we report it to the Dutch Data Protection Authority within 72 hours and, where required, to you (articles 33 and 34 GDPR).
9. Your rights
Under articles 15 to 21 GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification: most of it you can correct yourself in Mealbooks (Settings);
- erasure, unless we must keep the data, for example our invoices under tax law;
- restriction of processing;
- data portability: lists can be exported as CSV files, and once your account is switched off, Download my data gives all your company’s data in one structured, machine-readable file (or ask us for it at any time);
- objection to processing based on our legitimate interest, at any time, for reasons relating to your situation.
E-mail nakshafoods@gmail.com. We answer within one month; if a request is complex we may extend this by two months and will tell you why within the first month (article 12 GDPR). We may ask you to confirm your identity.
You can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the supervisory authority of the EU country where you live or work (article 77 GDPR), for example the data protection authority of your federal state in Germany, the CNIL in France, the AEPD in Spain or the Garante in Italy.
10. Your customers’ data (you are the controller)
The data you keep in Mealbooks about your customers, suppliers and staff (names, addresses, phone numbers, e-mail addresses, orders, invoices, HACCP checks) is yours: you decide what is in it and why. For it you are the controller and we are your processor; our processing agreement applies. It is your duty to inform those people about how you use their data and to answer their requests; we help you where needed.
11. Changes
We update this policy when what we do changes. We tell Mealbooks users about important changes by e-mail before they apply.
Version 2026-10-26 (draft).