[Your App Name]

The data controller for [Your App Name] is [Your Company Name Ltd], a company registered in England and Wales. We are responsible for deciding how and why personal data is processed in connection with the Service.

You can contact us about any data protection matter at [email protected].

We collect the minimum data necessary to provide the Service. Here is a summary of what we collect and why.

We do not currently send marketing emails. If we introduce this in the future, we will only do so with your explicit opt-in consent, and you will always be able to unsubscribe.

Under UK GDPR, we must have a lawful basis for each type of processing. We rely on the following:

• Contract — processing necessary to provide the Service you have signed up for (account management, recipe storage, credit management).
• Legal obligation — retaining financial and transaction records as required by law.
• Legitimate interests — server logging and security monitoring to protect the Service and its users. We have assessed that these interests do not override your data protection rights.
• Consent — if we introduce optional features such as marketing emails in the future, we will obtain your explicit consent before processing data for those purposes.

When you upload an image to extract a recipe, that image is transmitted to our servers and processed by an AI model to extract structured recipe data. We want to be transparent about how this works:

• The image is processed in memory and is not written to permanent storage.
• The image is discarded immediately after the recipe data has been extracted.
• We do not use your uploaded images to train AI models.
• AI extraction is performed using a third-party AI provider. Your image is transmitted to that provider solely for the purpose of extraction and is subject to a data processing agreement that restricts its use.

If you upload an optional illustrative image to display alongside a saved recipe, that image is stored in our cloud storage. You can delete it at any time from within the app.

We do not sell your data. We do not share it with advertisers. We share data with third parties only where necessary to provide the Service, and only under written data processing agreements that restrict how they may use it.

We may also disclose data where required by law, court order, or to protect the rights and safety of our users or the public.

Under UK GDPR you have the following rights in relation to your personal data. You can exercise most of these directly from within the app, or by contacting us at [email protected].

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your data. Note that we may need to retain some data for legal reasons (e.g. transaction records).
• Right to restriction — you can ask us to pause processing of your data in certain circumstances.
• Right to data portability — you can request your recipe data in a structured, machine-readable format.
• Right to object — you can object to processing based on legitimate interests.
• Rights related to automated decision-making — we do not make solely automated decisions that significantly affect you.

We will respond to all rights requests within one month. There is no charge for making a request. We may ask you to verify your identity before processing a request.

We use only essential cookies necessary to operate the Service — specifically, session cookies that keep you logged in. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies.

Because we only use essential cookies, we do not require a cookie consent banner under PECR. If we introduce non-essential cookies in the future, we will update this policy and obtain your consent before setting them.

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include:

• Passwords are hashed using a modern, secure algorithm.
• Data is transmitted over encrypted connections (HTTPS/TLS).
• Access to production systems is restricted to authorised personnel only.
• Payment data is handled entirely by our PCI-DSS compliant payment provider.

No system is completely secure. In the event of a data breach that is likely to affect your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay.

The Service is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data without appropriate consent, please contact us at [email protected] and we will delete it promptly.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by displaying a prominent notice in the app before the changes take effect. The "last updated" date at the top of this page will always reflect the most recent version.

If you have any questions about this policy or how we handle your data, please contact our data protection contact at [email protected].

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO):

We would always appreciate the opportunity to resolve your concern directly before you contact the ICO.