Receptree Privacy Policy

1. Scope

This policy explains how we process personal data when you use Receptree, including the website, account services, support channels, and optional camera bridge features.

2. Data We Process

• Account data: name, email, login metadata, authentication identifiers.
• Profile and content data: recipes, uploads, collections, favorites, comments.
• Technical and security data: IP, user agent, logs, device and browser metadata.
• Consent records: terms/privacy acceptance version, timestamp, and related metadata.
• Payment and billing data via Stripe: subscription status, selected plan, renewal status, and billing identifiers such as Stripe customer, subscription, and checkout session IDs.
• Receptree does not store full payment card details. Card and payment credentials are collected and processed by Stripe.
• Analytics and usage data, where consent is granted: page views, feature interactions, and related technical metadata collected through enabled analytics tools.

3. Purposes and Legal Bases

• Service delivery and account operations (contract necessity).
• Security, abuse prevention, and platform integrity (legitimate interests).
• Billing and subscription handling (contract and legal obligations).
• Analytics and optional marketing where required by consent.
• Compliance with legal obligations and defense of legal claims.

4. Processors and Data Sharing

We use selected service providers to operate Receptree:

• Supabase (authentication, database, and file storage).
• Vercel (application hosting, delivery, and related operational services).
• Stripe (hosted checkout, payment processing, subscription billing, and billing portal).
• Google Analytics (website analytics, only when analytics consent is granted and the service is configured).
• PostHog (product analytics, only when analytics consent is granted and the service is configured).
• Vercel Analytics (website analytics, only when analytics consent is granted and the service is configured).
• SMTP-based email delivery providers for transactional, support, and account emails.

These providers may process personal data on our behalf or, depending on the service, under their own responsibility. Their own privacy terms also apply to their processing.

We do not sell personal data. We may disclose data when legally required or to protect rights, safety, and platform security.

5. International Transfers

Receptree is used globally. Data may be processed outside Switzerland or your residence country, including jurisdictions such as the EU and the USA.

Where required, we apply contractual and technical safeguards (for example, standard contractual clauses or equivalent mechanisms).

6. Retention

• Account data is retained while your account is active and afterwards only as needed for legal obligations, fraud prevention, dispute handling, and security.
• Content is retained until you delete it or delete your account.
• Billing and subscription records may be retained as needed for accounting, tax, fraud prevention, legal defense, and compliance purposes.
• Cookie preference records and legal acceptance records may be retained as needed to demonstrate consent and compliance.
• Security and legal logs may be retained as needed for fraud prevention, legal defense, and compliance.
• Backups may persist temporarily after deletion until they are rotated, overwritten, or otherwise removed in the ordinary backup cycle.

7. Your Rights

Depending on applicable law (for example Swiss FADP, GDPR, UK GDPR, or certain US state laws), you may have rights to access, correction, deletion, objection, restriction, withdrawal of consent, and portability.

You can request exercise of rights via privacy@novasas.ch. We may request identity verification.

8. Cookies and Similar Technologies

We use essential cookies and similar storage technologies for login, session security, and saved preferences. Analytics tools are only enabled when analytics consent is granted. See our Cookie Policy for category-level details, examples, and controls.

9. Children

Receptree is not intended for children under 16, or lower age thresholds only where local law permits and parental authorization requirements are met.

10. Security

We apply technical and organizational safeguards appropriate to risk, including access controls, transport encryption, and security monitoring. No system is fully risk-free.

11. Policy Updates

We may update this policy. Material updates may be announced via email, in-app notices, or on the website.

12. Contact