Privacy Policy
Culinari (“Culinari”, “we”, “us”) respects your privacy. This Policy explains what personal data we collect when you use Culinari (the “Service”), why we collect it, how we use and share it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Portuguese data-protection law.
1. Who we are
Culinari is operated by IV4, Rua da Fé 24, 1675-Pontinha, Lisboa, Portugal, registered under number 509057381 (the “data controller”). For any privacy question, or to exercise your rights, contact us at [email protected].
2. The data we collect
- Account data — when you register we collect your email address and a securely hashed password. You may optionally add a display name, profile photo (avatar) and language preference.
- Content you create — recipes, ingredients, steps, cooking notes, ratings, photographs, cookbooks, meal plans, shopping lists and the books you add to your library. Some of this is private to you; some you may choose to publish or share with a group.
- Subscription & payment data — when you buy a premium plan, payment is processed by Paddle, which acts as the merchant of record. We do not receive or store your full card details; we receive the transaction metadata (plan, status, country, last digits) needed to manage your subscription.
- AI feature inputs — when you use AI features (for example recipe generation, photo critique or illustration), the text or images you submit are sent to our AI provider to produce the result.
- Usage & device data — like most websites we automatically record technical data such as IP address, browser type, pages visited and timestamps in server logs, to keep the Service secure and working.
- Waitlist — if you join a waitlist before we open, we collect your email solely to notify you when access opens.
3. Why we use your data, and our lawful basis
- To provide the Service — create your account, store and display your content (lawful basis: performance of a contract).
- To process subscriptions and payments (contract; legal obligation for tax and accounting records).
- To deliver the AI features you request (contract; your consent where required).
- To send service emails such as confirmations and security or account notices (contract; legitimate interests).
- To keep the Service secure, prevent abuse and debug problems (legitimate interests).
- To understand usage through privacy-friendly, aggregated analytics (legitimate interests).
- To comply with the law and respond to lawful requests (legal obligation).
We do not sell your personal data, and we do not use your private recipes to train public AI models.
4. AI processing
Some features send the content you submit (such as a recipe draft, a source text, or a photo) to a third-party AI provider that returns a generated result. We send only what is needed to perform the task you asked for. AI output can be inaccurate — see our Terms of Service for the limits of AI-generated content.
5. Who we share data with
We share data only with the service providers (“processors”) that help us run Culinari, under contracts that require them to protect it:
- Paddle — payment processing and subscription billing (merchant of record).
- Our AI provider — to deliver the AI features you use.
- Resend — to send transactional email.
- Our hosting provider (located in the EU) — to host the application and database.
- Privacy-friendly analytics — aggregated, non-identifying usage statistics.
We may also disclose data where required by law, or to protect our rights, our users or the public.
6. Cookies
We use strictly necessary cookies to keep you signed in and to secure forms (session and authentication cookies). These are required for the Service to function. If we add non-essential cookies in future, we will ask for your consent first.
7. International transfers
Our infrastructure is located in the European Union. Where a processor transfers data outside the European Economic Area, that transfer is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
8. How long we keep data
We keep your account and content for as long as your account is active. If you delete content or close your account, we delete or anonymise the associated personal data within a reasonable period, except where we must retain certain records (for example billing records) to meet legal obligations.
9. Your rights
Under the GDPR you have the right to access your data; to correct inaccurate data; to erase your data; to restrict or object to processing; to data portability; and to withdraw consent at any time where processing is based on consent. To exercise any right, email [email protected]. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).
10. Security
We protect your data with measures such as encrypted connections (HTTPS), hashed passwords and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the authorities of any breach as required by law.
11. Children
Culinari is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with data, contact us and we will delete it.
12. Changes to this Policy
We may update this Policy from time to time. When we make material changes we will update the “Last updated” date and, where appropriate, notify you. Continued use of the Service after changes take effect means you accept the updated Policy.
13. Contact
Questions about this Policy or your data: [email protected].