Privacy Policy

1. Who we are

RecipeKeep is operated by Swand AB (org-nr 559523-0896), a Swedish limited company. Registered address and contact information is available on our Impressum. For any privacy-related question, email privacy@recipekeep.de.

2. What data we collect

• Account data: email, display name, avatar, and locale.
• Recipe data: recipes you save, boards you create, and imported content. These are private by default.
• Usage data: anonymized, aggregated events (page views, feature use) via PostHog EU.
• Billing data (Pro users only): handled by Stripe; we never see your card number.
• Technical logs: IP address, user-agent, request paths (for abuse prevention), retained 30 days.

3. Legal basis (GDPR Art. 6)

• Contract (Art. 6(1)(b)): we process account and recipe data to provide the service you signed up for.
• Legitimate interest (Art. 6(1)(f)): security logging, abuse prevention, product improvement via anonymized analytics.
• Consent (Art. 6(1)(a)): optional cookies and marketing email — you can withdraw consent any time.
• Legal obligation (Art. 6(1)(c)): keeping accounting records for billing as required by Swedish law.

4. Processors we use

We share data only with the processors below, each under a signed Data Processing Agreement (DPA). Transfers to processors outside the EU rely on the EU–US Data Privacy Framework or SCCs.

5. Your rights (GDPR Art. 15–22)

You have the right to:

• access a copy of the data we hold about you;
• correct inaccurate data;
• delete your account and data (right to erasure);
• export your data (data portability, JSON or CSV);
• object to processing based on legitimate interest;
• complain to a supervisory authority — in Sweden, the Integritets­skyddsmyndigheten (IMY); in Germany, the respective Landesdatenschutz­beauftragter.

Email privacy@recipekeep.de to exercise any right. We reply within 30 days.

6. Retention

Account and recipe data are retained as long as your account is active. On deletion, we purge data within 30 days (billing records kept 7 years as required by the Swedish Bokföringslagen). Technical logs are retained 30 days.

7. Cookies

Strictly necessary cookies (auth session) are always set. Analytics and marketing cookies are disabled by default and require your consent via the cookie banner.

8. Changes to this policy

Material changes will be announced at least 14 days in advance by email and via an in-app banner.