Culinote.app Privacy Policy

1. Who We Are (Data Controller)

The company responsible for the data described in this policy (the Data Controller) is Culinote.

Contact for Privacy Questions: support@culinote.app

2. Information We Collect and Why We Need It

We adhere to a principle of data minimization, meaning we only collect data strictly necessary to provide and improve the Culinote.app service.

A. Data to Run Your Account (Contractual Necessity)

We require this data to fulfill our agreement (your subscription) and provide the Service:

• Email Address: Used to create your account and communicate with you about service updates.
• Membership Details: Records of your plan (SOLO, COUPLE, FAMILY) and activity (streaks, feature usage) to manage your membership.
• User-Generated Content (UGC): The recipes, meal plans, and shopping lists you input. This is the core of the app and is stored so you can access and organize your meals.

B. Financial and Billing Data (Legal Obligation)

When you purchase a subscription:

• Payment Information: We use a secure, third-party processor (Stripe) to handle payments. We do not store your full credit card number. We only store a secure payment token and billing history to manage payments and comply with Belgian tax laws.

C. Technical and Usage Data (Service Improvement)

We collect technical data automatically to maintain the app and improve your experience:

• Technical Identifiers: Includes your device type, IP address, and browser information. This helps us ensure the security of the app and fix bugs.
• Usage Data: Information on how you interact with the app (e.g., features you use). This helps us understand what works and what needs improvement.

3. How We Share Your Information (Third-Party Processors)

We share minimal necessary data with carefully selected third-party service providers. These providers are obligated to protect your data under strict contracts and GDPR requirements.

• Hosting: We use Amazon Web Services (AWS) to securely store all application data, including your recipes and account details.
• Payments: We use Stripe to securely process all subscription payments.
• AI Functionality: If you use features leveraging our AI, your recipe content and contextual input requests are sent to the Google Gemini API to generate smart features (like recipe extraction).
• Sharing with Invited Users: If you are on a COUPLE or FAMILY plan, the recipes and meal plans you input are shared only with the other users you specifically invite to your membership.

International Data Transfers

Our service providers (AWS, Stripe, Google) are primarily based in the United States. When your data is transferred outside the European Economic Area (EEA), we use legal safeguards mandated by the European Commission, such as Standard Contractual Clauses (SCCs), to ensure your data remains protected to GDPR standards.

4. How Long We Keep Your Data (Data Retention)

We keep your data only for as long as necessary:

• Account and Recipe Data: Retained as long as your account is active. We delete this data when you close your account, unless legally required to keep it.
• Financial Records: We are legally required under Belgian tax law to retain certain financial and billing records for 10 years following the accounting year.

5. Your Data Protection Rights (GDPR)

As a resident of the European Union, you have significant rights regarding your personal data. You can exercise any of these rights by emailing us at support@culinote.app.

• Right to Access: You can ask for a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct data that is incomplete or inaccurate.
• Right to Erasure ('Right to be Forgotten'): You can ask us to delete your personal data (this is subject to our legal requirement to keep financial records).
• Right to Portability: You can request that we transfer your data to you or another service provider in a common, machine-readable format.
• Right to Object: You can object to our processing of your data, especially for marketing purposes.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) or the data protection authority in your country of residence.

6. Contact Information

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

Email: support@culinote.app

General Support: support@culinote.app