1. Who is responsible for your data?
The controller of personal data at Przepisowo is RWR Digital Solutions, Lukasz Pawel Reiwer, Eichenweg 3, 74219 Möckmühl, Germany. For data protection matters, write to info@rwr-digital.de; for help with the application, write to kontakt@przepisowo.cloud. Full operator details are in the Imprint.
This policy covers the public website, accounts and families, recipes, plans, shopping lists, chats and AI features. We do not sell user data or family content, or use them for advertising or sales profiling.
2. What data do we process, and why?
- Account and family: name or display name, email address, hashed password, avatar, language, country or region, time zone, memberships, invitations and settings. We use these to register and sign you in, operate your family space and contact you about the service (Article 6(1)(b) GDPR).
- Your content: recipes, ingredients, photos and files, notes, diets, meal plans, shopping lists and messages. We store them to provide the features you select and synchronize family content (Article 6(1)(b) GDPR). Sensitive health-related data is covered separately below.
- Billing: plan, subscription status, purchased AI operations, transaction identifiers and data needed for billing or complaints. Stripe processes payments; we do not store your full card number in Przepisowo (Article 6(1)(b) and (c) GDPR: contract performance and accounting or tax duties).
- Cancellation and withdrawal notices: name, email address, information identifying the contract, type of notice, for a cancellation the requested end date and any explanation, time received, hashed IP address and browser information, handling status, and a record and timestamp of sending the acknowledgement. We use these details to receive and handle your notice, confirm receipt, comply with legal duties and preserve evidence in case of a dispute (Article 6(1)(b), (c) and (f) GDPR, depending on the activity). We record a notice when it is submitted; our team reviews the subsequent processing and it does not automatically change the subscription's status at Stripe.
- Security and operation: IP address, request time, browser data, errors, sign-in events and feature usage counters where needed to protect accounts, diagnose faults, prevent misuse or account for usage limits (Article 6(1)(b) and (f) GDPR: our legitimate interest in a secure service).
- Contact with us: your message and contact details so that we can answer your question or data request (Article 6(1)(b), (c) or (f) GDPR, depending on the matter).
We do not require health data for an ordinary recipe book. Without the data necessary for an account, however, we cannot create or maintain a family space.
3. Families, sharing and public links
Family content is available by default only in accordance with members' permissions. When you deliberately share a selected recipe with a trusted family, that family can access it within the scope of the feature. If you create a preview link, anyone who has it can see the shared recipe without signing in; you can revoke the link. We do not automatically publish your entire recipe book, diets or shopping lists.
If you add another person's data, particularly a household member's or a child's, make sure you are entitled to provide it. Consent to process an adult family member's health data must come from that person; for a child, from an authorized guardian.
4. AI, photos and health information
When you start an AI feature, we send OpenAI only the information needed for the chosen task, such as a dish description, chat text, a recipe photo or images prepared locally from a PDF file. The AI response goes into a draft or plan that you can review and edit. Family Unlimited uses the API key entered by the family, which is stored encrypted in the application; other plans use Przepisowo's service key. OpenAI may also process data for service security under its own policies; the API parameter store: false does not mean that the provider retains no data at all.
The health-related diet feature may involve illnesses, allergies, intolerances, procedures and other health data. It is optional. Before sending a description to AI, we ask for separate, explicit consent for that purpose; the legal basis is Article 6(1)(a) and Article 9(2)(a) GDPR. You can withdraw consent for future processing in the feature settings or by contacting us. Withdrawal does not affect processing that was lawful before it. A saved plan and result may remain in the family until deleted; withdrawal blocks new use of that data for health analysis.
AI can make mistakes. Dietary output does not replace a diagnosis or advice from a doctor or dietitian; check it before acting on it.
5. Who may receive data?
Access is limited to the people and providers needed to deliver the service: authorized family members and recipients of a shared recipe; server infrastructure and email providers; Stripe for payments; OpenAI for AI features you invoke; and a browser notification provider (such as Apple, Google or Mozilla) if you enable push. A chat notification contains a neutral message without the chat text. A local DB-IP database helps suggest an approximate country from an IP address; we do not send your IP address to DB-IP for this purpose.
Stripe, OpenAI and push services may involve processing outside the European Economic Area. Appropriate safeguards under Chapter V GDPR are used in those cases, including adequacy decisions or standard contractual clauses, depending on the provider and transfer. You may request details of the safeguards and a copy of the applicable clauses from the controller.
6. Cookies, language, location and notifications
We use necessary cookies and similar browser storage for sessions, security, forms and remembering your language. The language choice is stored on your device for up to 180 days. We do not run marketing or conversion tracking or advertising profiling. Counters necessary for features and billing remain active. Details are on the Cookies page.
An approximate country may be suggested using a local IP address lookup. You share a more precise location for offers only after a separate choice, and can turn that option off. Push notifications require activation on your device, and you can disable them in the browser or application.
7. How long do we keep data?
- Account and family content remain until you delete them or we handle a request to delete the family. Ending a subscription moves the family to Free and does not automatically delete recipes.
- Private source images produced during a recipe import are marked for deletion after 48 hours and removed in the next scheduled cleanup. The saved recipe and photos you deliberately add to it remain separate content.
- A family export archive is available for 24 hours. We keep transaction data, records of acknowledgements and accounting documents for periods required by law or needed to defend legal claims.
- We keep cancellation and withdrawal notices and acknowledgements for as long as needed to process them, meet legal obligations, or document the handling of a case or defend legal claims. Once these purposes no longer apply, we delete them in line with storage limitation principles.
- We keep security logs and backups for the time needed to detect incidents and according to the usual backup rotation cycle. Data deleted from the active database may remain in backups for a limited time, without ordinary access through the application. Following a restoration, we reapply justified deletion requests.
Deleting an entire family may require contacting us, particularly where billing documents must be retained. On request, we will explain the applicable period for a specific category of data.
8. Your rights and how to contact us
You may request access, correction, deletion, restriction of processing and data portability, and object to processing based on legitimate interests. You may withdraw consent at any time for future processing. An export of selected family data is available in the application; for a broader request or data concerning a particular household member, write to info@rwr-digital.de. We may verify the requester's identity before releasing data.
You have the right to complain to a data protection supervisory authority, in particular the LfDI Baden-Württemberg, or an authority in your country of habitual residence. We do not use AI to make solely automated decisions with legal effects.