CulinaryCard

    Privacy Policy

    Privacy Policy

    Effective Date: January 1, 2026
    Last Updated: January 1, 2026

    Introduction

    This Privacy Policy describes how Rooted Labs LLC ("we," "us," or "our") collects, uses, and shares your personal information when you use Culinary Card (the "Service"), available at www.culinarycard.app.

    By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

    1. Information We Collect

    1.1 Information You Provide

    • Account Information: When you create an account, we collect your email address and password (encrypted and stored securely via Supabase authentication).
    • Profile Information: Display name, phone number, birthday, avatar/profile photo, and preferences (image style, language, image generation settings).
    • Recipe Content: Any recipes you create or import, including:
      • Recipe text, URLs, or images you submit
      • User-uploaded photos
      • Tags, notes, and other metadata you add
    • Payment Information: Credit card and billing information processed through Stripe (we do not store your full credit card numbers on our servers).

    1.2 Automatically Collected Information

    • Usage Data: Information about how you interact with the Service, including pages visited, features used, recipes created, and time spent.
    • Device Information: IP address, browser type, operating system, device identifiers.
    • Cookies and Similar Technologies: We use cookies and similar tracking technologies to track activity and hold certain information. You can instruct your browser to refuse all cookies or indicate when a cookie is being sent.
    • Analytics Data: We use PostHog to collect analytics data including user events, performance metrics, and error tracking to improve our Service.

    1.3 Information from Third Parties

    • Recipe Websites: When you import a recipe from a URL or Pinterest, we fetch publicly available content from those websites.
    • AI Processing: Recipe and image data you submit is processed by OpenAI's API to extract structured recipe information and generate images.

    2. How We Use Your Information

    We use the collected information for the following purposes:

    • Provide the Service: To create, store, and manage your recipe collection.
    • AI Features: To process your recipes using OpenAI's GPT models for recipe parsing and image generation.
    • Payment Processing: To process subscription payments and credit purchases via Stripe.
    • Account Management: To manage your account, authentication, and user preferences.
    • Service Improvement: To analyze usage patterns, fix bugs, and improve features.
    • Communications: To send you service-related emails (account notifications, subscription updates, password resets).
    • Security: To detect and prevent fraud, abuse, and security incidents.
    • Legal Compliance: To comply with legal obligations and enforce our Terms of Service.

    3. AI Data Processing

    3.1 OpenAI Processing

    When you use the Service, we send your recipe content (URLs, text, images) to OpenAI's API for processing. This includes:

    • Recipe extraction and structuring
    • Image generation based on recipe descriptions
    • Image-to-image editing for recipe photos

    Important: OpenAI's data usage policies apply to data processed through their API. As of our last review, OpenAI does not use data submitted via the API to train their models unless you explicitly opt-in. Please review OpenAI's privacy policy at https://openai.com/privacy for current information.

    3.2 Data Retention for AI Processing

    Recipe data sent to OpenAI is processed in real-time and is subject to OpenAI's retention policies. We do not control how long OpenAI retains data, but we take reasonable steps to minimize data sent and use the most privacy-protective API options available.

    4. Data Sharing and Disclosure

    We do not sell your personal information. We may share your information in the following circumstances:

    4.1 Service Providers

    • Supabase: Database and authentication services
    • OpenAI: AI processing for recipe parsing and image generation
    • Stripe: Payment processing for subscriptions and credit purchases
    • PostHog: Analytics and error tracking
    • Vercel/Railway: Hosting infrastructure

    All service providers are bound by confidentiality obligations and are only permitted to use your data to provide services to us.

    4.2 Legal Requirements

    We may disclose your information if required by law, court order, or governmental request, or to protect our rights, property, or safety, or that of others.

    4.3 Business Transfers

    If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

    5. Data Storage and Security

    5.1 Data Storage

    • User Data: Stored in Supabase (PostgreSQL database)
    • Recipe Images: Stored in Supabase Storage with public URLs
    • Location: Our primary data centers are located in the United States

    5.2 Security Measures

    We implement industry-standard security measures including:

    • Encryption of data in transit (HTTPS/TLS)
    • Encrypted password storage
    • Regular security audits
    • Access controls and authentication

    However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

    6. Your Data Rights

    Depending on your location, you may have the following rights:

    • Access: Request a copy of your personal data
    • Correction: Request correction of inaccurate data
    • Deletion: Request deletion of your account and associated data
    • Portability: Request your data in a machine-readable format
    • Objection: Object to certain processing of your data
    • Restriction: Request restriction of processing

    To exercise these rights, contact us at [email protected] or via Telegram: @culinarycard.

    6.1 Data Deletion

    You may delete your account at any time through your profile settings. Upon deletion:

    • Your account and profile information will be permanently deleted
    • Your recipes and images will be deleted from our servers
    • Payment history will be retained for accounting and tax compliance (minimum 7 years)
    • Some data may be retained in backups for up to 90 days

    7. Cookies and Tracking

    We use the following types of cookies:

    • Essential Cookies: Required for authentication and basic functionality
    • Analytics Cookies: PostHog analytics to understand how you use the Service
    • Preference Cookies: Remember your settings and preferences

    You can control cookies through your browser settings, but disabling certain cookies may limit functionality.

    8. Children's Privacy

    The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

    9. International Data Transfers

    Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using the Service, you consent to such transfers.

    For users in the European Economic Area (EEA), we ensure appropriate safeguards are in place for international data transfers in accordance with GDPR requirements.

    10. California Privacy Rights

    If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

    • Right to know what personal information is collected, used, shared, or sold
    • Right to delete personal information
    • Right to opt-out of the sale of personal information (we do not sell personal information)
    • Right to non-discrimination for exercising your rights

    To exercise these rights, contact us at [email protected] or via Telegram: @culinarycard.

    11. Changes to This Privacy Policy

    We may update this Privacy Policy from time to time. We will notify you of material changes by:

    • Posting the new Privacy Policy on this page
    • Updating the "Last Updated" date
    • Sending an email notification (for significant changes)

    Your continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

    12. Third-Party Links

    The Service may contain links to third-party websites (e.g., recipe source websites). We are not responsible for the privacy practices of these third-party sites. We encourage you to read their privacy policies.

    13. Do Not Track Signals

    We do not currently respond to Do Not Track (DNT) browser signals. We may adopt DNT practices in the future.

    14. Data Retention

    We retain your personal information for as long as your account is active or as needed to provide services. Specific retention periods:

    • Account Data: Until account deletion or 3 years of inactivity
    • Recipe Data: Until you delete recipes or your account
    • Payment Records: Minimum 7 years for tax and accounting compliance
    • Analytics Data: Aggregated/anonymized data may be retained indefinitely
    • Server Logs: 90 days

    15. Contact Us

    If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

    Rooted Labs LLC
    Email: [email protected]
    Telegram: @culinarycard
    Website: www.culinarycard.app

    For data protection inquiries, please include "Privacy Request" in your email subject line.

    16. Legal Basis for Processing (GDPR)

    For users in the EEA, our legal bases for processing your personal information include:

    • Contract Performance: Processing necessary to provide the Service
    • Consent: Where you have given explicit consent
    • Legitimate Interests: To improve our Service, prevent fraud, and ensure security
    • Legal Obligations: To comply with applicable laws

    Rooted Labs LLC
    Minnesota, United States
    Last Updated: January 1, 2026