Recipy

1. Data controller

The data controller is Łukasz Jałocha, the owner and operator of the Recipy application within the European Union.

Contact for privacy matters: lukaszjalocha55@gmail.com

2. Personal data processed

• User account data
  • Email address provided during Google OAuth sign-in.
  • User account identifier in the Recipy system.
• Service usage data
  • Plan information (Free / Premium) and usage limits.
  • Generated recipes and dietary preferences (e.g., allowed and blocked ingredients, number of servings, meal type).
  • History of recipe generations.
• AI question data
  • Questions you ask about recipes and AI-generated answers linked to your account and the relevant recipe.
• Communication data
  • Content of submitted feedback or contact requests.
• Technical data
  • IP address.
  • Basic server logs and device information used solely for security and service maintenance.

The administrator does not store Google account passwords. Authentication is handled exclusively through Google OAuth.

3. Purpose and legal basis

• Providing the service and managing user accounts, including recipe generation, storing history, and personalizing content (legal basis: Art. 6(1)(b) GDPR).
• Maintaining and developing the Service, improving quality, analyzing errors, and testing new features (legal basis: Art. 6(1)(f) GDPR – legitimate interest).
• Handling requests and contacting users (legal basis: Art. 6(1)(b) or (f) GDPR).
• Ensuring Service security (legal basis: Art. 6(1)(f) GDPR).
• Answering user questions about recipes using AI with the provided context (legal basis: Art. 6(1)(b) GDPR).

4. Automated processing and AI

• Recipy uses artificial intelligence models to automatically generate recipes based on data provided by the user.
• This processing supports content personalization and proper Service operation.
• Only data necessary to generate the recipe (e.g., ingredients, dietary preferences, meal type) is shared with the AI provider.
• The administrator does not send to the AI provider data that directly identifies the user, such as an email address.
• Questions asked about recipes and the recipe context may be sent to AI providers solely to prepare the answer.

5. Data recipients

• Google – for authentication (Google OAuth) and cloud infrastructure (Google Cloud Platform).
• Neon – provider of the PostgreSQL database service.
• OpenAI – provider of artificial intelligence models used to generate content.

These processors handle data based on appropriate data processing agreements or standard contractual clauses.

6. Transfers outside the European Union

• Using some providers (particularly OpenAI and Google) may involve transferring personal data outside the European Economic Area, including to the United States.
• Transfers are secured with appropriate safeguards, especially the European Commission's standard contractual clauses.

7. Data retention

• Personal data is stored for the duration of the user's account in the Service.
• Saved questions and answers are kept with your account/recipes and removed upon account or recipe deletion.
• After account deletion, the data is removed from production systems.
• Backup copies may be retained for up to 30 days to ensure service continuity and security.
• Technical data and logs are stored for no longer than 30 days.

8. User rights

• Access your personal data.
• Rectify data.
• Erase data ("right to be forgotten").
• Restrict processing.
• Data portability.
• Object to processing.
• Lodge a complaint with the relevant data protection authority.

To exercise your rights, contact the Administrator at the email provided in this Policy.

9. Cookies and technical data

• The Service uses only cookies necessary for proper application operation.
• Recipy does not use marketing or tracking cookies without prior user consent.