Recipheon Privacy Policy

1. Controller and scope of this document

This Privacy Policy describes how the personal data of Recipheon platform users is processed. The controller of the personal data is FIAMEKSO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office at ul. SZLAK no. 77, unit 222, KRAKOW, 31-153, POLAND, registration details: KRS: 0001231410, NIP: 6762716852, registry court: Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy Krajowego Rejestru Sądowego, share capital: PLN 20,000.00.

Privacy contact details: - e-mail: support@recipheon.com

This Policy covers data processed in connection with the use of the website, mobile application, content reporting mechanisms, and contact with the Controller.

2. What data we process

Depending on how Recipheon is used, we may process the following categories of data:

- Account data - e-mail address, password in hashed form, username, display name, e-mail verification status, and information about a pending e-mail address change.

- Social login data - account identifier with the login provider, e-mail address, and basic profile data provided by Google, Facebook, or another provider if the user chooses this login method.

- Profile data - bio, profile photo, language, account and interface settings, including the light / dark mode preference, if the user chooses to provide or save them.

- Session and login security data - session identifiers, refresh tokens, token usage logs, login data, and actions performed within a session.

- Activity data - recipes, comments, replies, ratings, comment likes, saved recipes, recently viewed content, and other actions performed within the Service.

- Social relationship data - followers, following, and counters and relationships associated with the profile.

- Report and contact data - the user identifier or a guest’s name and e-mail address, the reason for the report, the case description, the URL or another content identifier, as well as a declaration or other express confirmation submitted by the reporting person, if required in the given reporting channel, and contact preferences, if collected.

- Feedback data - message content, report type, platform information (web / mobile), and the user identifier or contact data.

- Consent data - information about consents granted, refused, or withdrawn for cookies and analytics, together with the scope of consent, a timestamp, and the notice version.

- Security and audit data - logs of administrative and system actions, information about who or what performed an action and when, and, in some cases, the state before and after a change.

- Technical data - IP address, device or browser identifiers, error and performance data, anti-spam limitations, and other technical information necessary for security and service maintenance.

3. Purposes and legal bases of processing

We process personal data for the following purposes and on the following legal bases:

1. Creating and operating an account, logging in, maintaining a profile, publishing recipes and comments, saved recipes, social features, and other Service functions - Article 6(1)(b) GDPR, i.e. performance of a contract for electronic services or taking steps at the user’s request before entering into such a contract.

2. Handling reports, complaints, contact, and user support - Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the nature of the matter.

3. Ensuring Service security, authentication, abuse prevention, anti-spam protection, incident analysis, and maintaining security logs - Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in protecting the service, users, and compliance with the Terms.

4. Handling notices concerning illegal content and Terms violations, moderation, and documenting actions taken - Article 6(1)(c) and Article 6(1)(f) GDPR respectively, to the extent of legal obligations and the Controller’s legitimate interest in protecting third-party rights and service safety.

5. Complying with legal obligations, including obligations arising from data protection law and cooperation with competent authorities - Article 6(1)(c) GDPR.

6. Web and mobile analytics based on Microsoft Clarity and similar optional tools - Article 6(1)(a) GDPR, i.e. user consent, and electronic communications privacy rules.

7. Establishing, pursuing, or defending claims - Article 6(1)(f) GDPR.

4. Is providing data mandatory

Publicly available content on Recipheon can be browsed without creating an account. Providing some data is necessary to create and maintain an account and to use functions available after logging in, in particular the e-mail address, username, and authentication data. Providing optional data, such as bio, profile photo, language, or interface preferences, remains voluntary, but the lack of such data may limit personalization or some profile functions.

For the report form, failure to provide data marked as required may make it difficult or impossible to examine the report or provide a response.

5. Data recipients

Data may be disclosed to entities supporting the Controller in maintaining and developing Recipheon, in particular hosting and cloud infrastructure providers, e-mail providers, authentication providers, security tools, development services, technical support, and analytics tools.

If the user uses social login, the relevant login provider acts under its own rules as a separate controller within the scope of its service.

For web analytics and mobile app analytics, we may use Microsoft Clarity, including Clarity for Mobile Apps. Microsoft documentation indicates that Microsoft acts as a controller in relation to data processed within that service. Details regarding how Microsoft acts and its responsibilities follow from Microsoft documentation and privacy policies.

6. Transfers outside the EEA

As a rule, we seek to use solutions ensuring an adequate level of data protection. Some technology providers may nevertheless process data outside the European Economic Area or provide remote access from outside the EEA. In such cases, data transfers are made using appropriate legal mechanisms, in particular standard contractual clauses or another suitable mechanism provided for by the GDPR.

If we use Microsoft Clarity or services of other global providers, data may be transferred to countries outside the EEA, including the United States. Depending on the country and recipient, the transfer may rely on an adequacy decision, the US recipient’s active participation in the EU-US Data Privacy Framework, standard contractual clauses, or another mechanism provided by law. Information about the mechanism used by a particular partner is available in its privacy notice or can be obtained from the Controller.

7. Retention periods

We keep data no longer than necessary for the purposes for which it was collected. The main periods are as follows:

1. Account and profile data - for the duration of the account and, following effective submission of an account deletion request, generally for up to 30 days in active systems to complete deletion operations; backups until overwritten, generally up to 90 days.

2. Recipes, comments, and other user content - for as long as it is maintained in the Service or until the account / content is deleted; after deletion generally in line with the active-system and backup periods indicated above.

3. Session data, security logs, IP addresses, and anti-abuse data - generally from 90 to 180 days, and longer if necessary to clarify an incident, for the time required to close the matter.

4. Data concerning reports, complaints, appeals, and contact - for the duration of the matter and then for the period necessary to demonstrate compliance, and to establish, pursue, or defend claims, generally up to 3 years unless a longer period follows from the nature of the case or a legal obligation.

5. Current cookie and analytics preferences, together with the date and notice version - on the device until the user changes the preferences or deletes local data, and in the account until the preferences are changed or the account is deleted. The change history recorded in the audit log is normally retained for 180 days from the creation of the entry, subject to the exceptions for legal obligations and claims described below.

6. Analytics data collected on the basis of consent - according to the retention settings of the relevant tool and the scope of the user’s consent, no longer than needed for analytics purposes.

7. In-Service notifications – read notifications are automatically deleted from active systems once 90 days have passed since their creation. A notification read after this period is deleted during the next automatic cleanup. Deletion runs in the background and may be subject to a technical delay. Unread notifications are not deleted based on their age; once read, the rule above applies. Notifications may be deleted earlier when the account or related content is deleted. Backups follow the periods stated above.

Retention may be extended if necessary to comply with a legal obligation or to establish, pursue, or defend claims.

8. Deletion of the account and data from active systems

After effective submission of an account deletion request, access to the account is disabled immediately and the process of permanently deleting the user’s data and content from active systems begins. Deletion is generally completed within 30 days and without anonymization, unless further retention of specific data is necessary for legal, security, or claims-related reasons.

An account can be deleted from the privacy settings in the Service or by sending an account deletion request to support@recipheon.com.

In practice this means: - the account, profile, recipes, comments, and related data are directed to permanent deletion; - some data may temporarily remain in backups until they are overwritten; - selected logs, incident traces, moderation reports, or data necessary to defend claims may be retained despite account deletion, to the minimum extent necessary.

9. Microsoft Clarity and analytics data

In Recipheon, we may use Microsoft Clarity both on the website and, if implemented, in the mobile app, in order to understand how the Service is used, analyze navigation, errors, interface elements, and improve usability. In the web layer, this tool is activated only after obtaining valid user consent for analytics cookies or similar technologies.

Analytics data may include events and interactions with the interface, page views and page URLs, browser and device technical data, and the IP address used, among other things, for approximate geolocation and security. The scope of recorded data also depends on the content-masking settings in Microsoft Clarity.

10. Rights of the data subject

The user is entitled, in cases provided by law, to access their data, rectify it, erase it, restrict processing, data portability, and object to processing based on the Controller’s legitimate interests.

Where processing is based on consent, the user has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

The user also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

11. Automated decision-making

As a rule, we do not make decisions concerning users that produce legal effects or similarly significantly affect them solely by automated means. We may use automatic tools supporting security, spam filtering, or the initial triage of reports, but decisions in disputed matters should remain under human oversight.

12. Data security

The Controller implements appropriate technical and organizational measures aimed at protecting personal data, in particular access control, authentication, communication safeguards, event logging, limitation of privileges, and regular maintenance activities. The scope of those measures is adapted to the risk associated with the nature of the service and the data processed.

13. Pinterest integration — Recipheon Social

Recipheon Social is an internal tool for publishing selected recipes on official Recipheon brand accounts. The Pinterest integration is being prepared for launch; the following rules apply when it is enabled. It is not a Pinterest login for Recipheon or a service for connecting visitors’ accounts. Browsing recipes and using a Recipheon account do not require a Pinterest account.

Access and tokens. Connecting requires authorisation by a person entitled to manage the official account and an access token issued by Pinterest. The token only permits actions within the granted permissions. The integration does not collect Pinterest passwords or session cookies. Tokens are stored in server configuration, outside the public website and recipe content; authorised operators and infrastructure providers have access to that configuration as needed to operate the service. The current integration neither stores tokens in publication-history records nor displays them to visitors.

Data involved. We send Pinterest recipe titles and descriptions approved for publication, images or their URLs, links to public recipes, and the destination board identifier. These materials originate from Recipheon. If they contain personal data, such as author information in a description or image, that information may also become public. The current mechanism does not retrieve private messages, contact lists or visitors’ account data, and does not send Pinterest their Recipheon login details.

Publication history. Our database records the recipe identifier, language, category, destination board, prepared content and image URLs, operator approval, publication attempt times and counts, status and a technical error reason. Following successful publication, we store the Pin identifier returned by Pinterest. An operator can also mark a previously published recipe as published by supplying an existing Pin identifier. These records support queue management, error investigation and duplicate prevention, not visitor profiling. We do not sell data received from the Pinterest API or use it for advertising outside Pinterest or training artificial intelligence models.

Purposes and legal basis. To the extent personal data is involved, managing official accounts, promoting public recipes, overseeing publication and preventing abuse rely on Article 6(1)(f) GDPR — the Controller’s legitimate interest in brand communication and secure publishing operations, taking into account the rights and reasonable expectations of the people concerned. This does not authorise unrestricted sharing of private content; permission to use materials also depends on the Terms and their authors’ rights. You can object by contacting support@recipheon.com; for direct marketing, you may object at any time.

Recipients and public Pins. Pinterest receives the submitted materials and processes data within its service under its own rules as a separate controller. Publicly published Pins can be viewed, saved and shared by others. Information about the Pinterest entities, data processing and transfers outside the EEA is available at https://policy.pinterest.com/en/privacy-policy. Sections 5 and 6 of this Policy also apply to the infrastructure supporting Recipheon.

Storage. A token remains in server configuration until an authorised operator removes or replaces it. Revoking permission in Pinterest prevents further authorised access, but does not itself remove the token from our configuration or erase local history. Publication history is currently not automatically deleted solely because time has passed; outside the recipe deletion process described below, deleting it requires operator action. The need for continued storage depends on handling publications, investigating errors, preventing duplicates and resolving requests. Personal data in these records remains subject to storage limitation, the periods in section 7 and the rights in section 10; being part of the history does not justify keeping data without a continuing need.

Deleting a recipe, including as part of account deletion, includes cleanup of local publishing jobs and their content. For a publication already sent or with an uncertain outcome, a technical record may remain for reviewing its removal from the external platform: platform, language, Pin identifier if known, a technical job reference, reason and date. It contains no publication text or explicit recipe or author identifier, but we do not treat it as fully anonymous. Handling and deleting it requires operator action; it currently has no automatic expiry.

Disconnection and deletion. The account manager can revoke the app’s access in Pinterest settings. Requests to delete local integration data, pending publications or content published by Recipheon can be sent to support@recipheon.com. Include the recipe or Pin link and the scope of the request; do not send passwords or tokens. These requests require operator handling. Deleting a recipe or Recipheon account does not automatically delete its Pin from Pinterest. Removing a publication from our profile and copies saved by other people is also subject to Pinterest’s capabilities and rules.

The publishing integration runs on the server and does not add the Pinterest Tag or Pinterest advertising cookies to a visitor’s browser. Our profile link and website verification tag are not such tracking tools. Any future advertising measurement implementation would require a separate disclosure and appropriate consent configuration.

14. Country checks when purchasing an AI Assistant subscription

When automatic purchase-country checks are enabled, Vercel, the website infrastructure provider, derives an approximate connection country from the IP address. Recipheon’s backend on Render compares it with the declared habitual residence and purchase details, or uses independent evidence reviewed by support. We do not use GPS or precise location for this purpose. An IP country does not prove nationality or residence; VPNs and travel can cause discrepancies.

The check verifies purchase eligibility and reduces incorrect declarations, based on Article 6(1)(f) GDPR: our legitimate interest in handling purchases correctly and preventing abuse. It is not used for advertising profiling. A foreign or unidentified IP country may pause a new purchase pending clarification. When support confirms evidence conflicting with eligibility to purchase in Poland, we stop new purchases and future subscription charges pending clarification. You can object, correct your details and request a human review at support@recipheon.com, including when travelling or using a VPN. The check does not itself block public recipes, purchase history or rights under an already paid, unexpired subscription period.

We keep account-linked history of country declarations and changes, and evidence reviewed by support: country code, source, time and outcome, including previous and new values when changed. This history lets us reconstruct eligibility checks and clarify discrepancies before the next charge. It contains no full IP addresses, card data or check signatures. It is included in the account data export and deleted when the account is closed; separate transaction records follow the retention rules below.

We do not create a separate record of full IP addresses or a history of rejected automatic IP-country checks for this purpose. For a created order, we retain the country code or an unknown-country result, source, time and check outcome alongside the declaration and purchase details. These data follow purchase-record retention criteria: as needed to handle the transaction, complaints or claims and applicable record-keeping duties, where relevant. A sandbox test alone does not create a tax obligation. Security logs and provider records follow separate rules described in sections 5–7; excluding full IP addresses from orders does not mean that no such logs exist.

Separately, we may use the same approximate IP country to target our own AI Assistant banner to connections from Poland. The basis is Article 6(1)(f) GDPR: our legitimate interest in promoting our own service in a selected market without building an advertising profile. For this banner, we do not keep a separate history of countries or IP addresses, use additional cookies or persistent browser storage; the result is briefly cached in page memory. Hiding the banner does not block access to the public offer description. You can object to this processing at support@recipheon.com.

15. Recipheon AI subscription and billing

We process the account identifier, name, email, address and country declaration, account creation time, start and end of 7-day trial and paid Premium, AI usage allowance validity, capacity and consumption, plan, price, periods, terms versions and separate confirmations of acceptance, recurring payments and early start. We record payment-operator order identifiers and states, deferral of the paid period until trial end, cancellations, plan changes, withdrawals, complaints and refund settlements. The bases are performance of the contract and billing under GDPR Article 6(1)(b), legal obligations where applicable under (c), and security and legal claims under (f). Payment authorisation is neither marketing consent nor separate GDPR consent. The financial usage ledger records period and call identifiers, reservations, reported usage, settlement outcome and policy version, without request text, photos or AI responses. It supports variable allowance billing, reconciliation of unknown outcomes and complaints; money refunds are not determined solely by the percentage used.

Przelewy24 / PayPro S.A. receives the order and payer data necessary for payments, renewals and refunds. Card details are entered with the operator; Recipheon does not store full card numbers, CVV or BLIK codes. A protected recurring-payment identifier is used only for authorised charges. Billing data is not sent to OpenAI, and the payment operator receives no prompts, product photos or recipes. Infrastructure providers handle data as described in sections 5–6; the email provider receives the minimum necessary to deliver notices and documents. Sandbox can still process real payer data.

Account deletion disables future renewals and removes the active payment-method association after safe handling of operations already initiated. Minimal contract, charge, usage, authorisation and refund records may remain for settlement, record-keeping duties or claims under section 7, and are not used for marketing. Restricted payment diagnostic logs are normally kept for 90 days without full operator responses or card details. Withdrawal and complaints remain available at support@recipheon.com after deletion. Access, rectification, erasure, restriction, portability and objection rights are explained in section 10.

16. Changes to the Privacy Policy

The Privacy Policy may be updated in the event of changes in law, changes in Recipheon functionality, technology providers, or the way data is processed. The current version is published in the Service together with its effective date.

Effective date: 09.10.2026.