1. Scope and Roles
This Policy applies to users worldwide. We comply with the EU/EEA General Data Protection Regulation (GDPR) and applicable local laws. We are the controller; our cloud/IT vendors act as data processors under data processing agreements.
2. What Data We Process
A. App-Specific User Content
- Recipe links, recipe text, ingredients, shopping lists, saved recipes, cooking preferences, and generated recipe outputs
- Photos, screenshots, images, image metadata, and visual content you choose to upload for processing
- Prompts, instructions, uploaded files, and app-specific settings
- AI-generated outputs and processing results
B. Cycle, Mood, Wellness, and Partner Data (where supported by a specific app)
- Partner's name (optional)
- Cycle data (start/end, cycle day, mood, symptoms)
- Health information or illnesses related to the cycle
- Goal tags (e.g., intimacy, time together, communication)
C. Account / Registration Data
- Email address provided at registration
- Social login data (Facebook ID, Google ID, Apple ID, email if provided by the provider)
- Password (if created in our system)
D. Calendar Data (optional, if enabled)
- By default: busy/free status and time blocks
- Enhanced forecasts (optional): event titles may be classified on-device into categories where technically supported
E. Technical / Service Data
- Pseudonymous user ID, app version, device/OS type, subscription/receipt tokens, security logs
- Diagnostics, crash logs, fraud-prevention signals, and basic usage events
- Your analytics-cookie choice and, when you opt in, website usage data collected through Google Analytics
F. Support Data
- Email address, app name, purchase identifiers, screenshots, and message content if you contact support
3. Special Categories of Data and Sensitive Uploads
Some AppCraft apps may process menstrual cycle data, mood and emotional state, health information, symptoms, goals related to sexual life, or similar sensitive data. These may be special category data under GDPR and require explicit consent before processing.
Uploaded photos and images may also reveal sensitive information, including health conditions, biometric characteristics, location context, children, or other identifiable people. You should not upload sensitive images or images of other people unless you have the right and lawful basis to do so. If you enter or upload data about another person, you must ensure that you have obtained that person's informed and explicit consent where required.
4. Purposes and Legal Bases
We use your data to:
- Provide app features: including recipe generation, recipe storage, shopping lists, photo processing, AI-assisted outputs, cycle features, mood forecasts, calendar features, and account access (Legal basis: Contract; explicit consent where sensitive data is processed)
- AI and image processing: sending selected inputs, photos, prompts, and outputs to AI or image-processing providers only as needed to provide the requested feature (Legal basis: Contract; consent where required)
- Authentication and account management: registration, login, account security, and subscription access (Legal basis: Contract)
- Customer support and communication: responding to inquiries, purchase questions, bug reports, and privacy requests (Legal basis: Contract and Legitimate interests)
- Reliability and security: fraud prevention, abuse detection, diagnostics, crash analysis, and service protection (Legal basis: Legitimate interests)
- Optional website analytics: understanding website traffic, referral sources, and page usage through Google Analytics only when you consent through the cookie banner (Legal basis: Consent)
- Legal compliance: tax, payment, consumer protection, app store, and regulatory obligations (Legal basis: Legal obligation)
We do not sell personal data. We do not use uploaded photos, sensitive health or cycle data, or partner data for cross-context behavioral advertising.
5. Data Minimization & Pseudonymization
- We request only the data needed for the user-facing feature
- Recipe and photo features should use user-selected uploads or platform pickers where possible instead of broad device library access
- Cycle flows should use structured inputs where possible
- Calendar data defaults to busy/free processing; enhanced classification may happen on-device where technically supported
- Forecasting, diagnostics, and analytics records are linked to a pseudonymous user ID where practical
6. Sharing, Processors, and AI Providers
We share limited data with service providers only as needed to operate the services. These may include cloud hosting, storage, authentication, analytics, crash reporting, customer support, payment providers, app stores, email providers, AI model providers, and image-processing providers.
For AI-assisted features, selected prompts, uploaded photos, recipe content, structured inputs, and generated outputs may be processed by providers such as OpenAI/ChatGPT or similar providers. We use such providers to deliver requested features, not to sell your data. Where required, processors act under data processing agreements or equivalent contractual safeguards.
6A. Website Analytics and Cookies
We use Google Tag Manager and Google Analytics to measure website traffic only after you accept analytics cookies. If you reject analytics cookies, we keep Google advertising storage disabled and do not store Google Analytics cookies. Google Consent Mode may still send limited cookieless consent signals to Google; these do not use analytics cookies. You can change your choice at any time through the Cookie settings button displayed on the website.
7. International Transfers
Personal data may be transferred outside the EEA/UK only under lawful mechanisms (e.g., Standard Contractual Clauses) with appropriate safeguards.
AI, cloud, payment, analytics, and support providers may process data outside your country or outside the EEA/UK. Where required, we use lawful transfer mechanisms such as Standard Contractual Clauses, adequacy decisions, or equivalent safeguards.
8. Retention
- Recipe content, saved recipes, uploaded photos, generated outputs, cycle, mood, health, and calendar data: retained until you delete them, delete your account, or request deletion, unless a shorter product-specific retention period applies
- Temporary processing files: retained only as long as needed to provide the feature, debug failures, prevent abuse, or comply with law
- Dormant accounts: automatically deleted or anonymized after 24 months of inactivity where technically supported
- Diagnostics and security logs: retained briefly, then deleted or anonymized unless needed for security or legal reasons
- Support data: retained as long as necessary to resolve your request and maintain records of the interaction
- Payment and tax records: retained as required by law and payment provider rules
9. Your Rights
You may:
- Access, correct, erase your data
- Restrict or object to processing
- Withdraw consent at any time
Contact us at [email protected] to exercise these rights.
10. Security
We implement encryption (in transit and at rest), role-based access, network segmentation, secure development practices, supplier due diligence, and regular reviews.
11. Children's Privacy
The AppCraft services are not intended for children under 13, and some apps may be intended for adults 18+ only depending on their content. We do not knowingly process children's personal data without appropriate legal basis and consent. Do not upload photos or data of minors unless you are legally authorized to do so and the upload is lawful and appropriate. If we become aware that a minor's data has been entered without valid consent, we will delete or restrict such data.
12. Health, Wellness, Food, and AI Disclaimer
Mood forecasts, cycle insights, recipe suggestions, nutrition-related outputs, shopping lists, food preparation instructions, and AI-generated content are informational only. They are not medical, dietary, allergy, food-safety, or professional advice. Always review outputs and consult qualified professionals where appropriate.
13. Automated Processing and AI-Generated Content
We may use algorithms and AI systems to forecast mood, classify calendar context, process uploaded photos, extract recipe information, generate recipes, create shopping lists, or produce other app-specific outputs. These outputs are informational and do not produce legal or similarly significant effects.
Where required by law, app UI or related disclosures should make clear when users are interacting with AI features or receiving AI-generated content, especially where generated or modified content could be mistaken for human-created or real-world content.
14. Changes to this Policy
We may update this Policy from time to time. Updates will be published in the App or on our website.
15. Contact Us
- Email: [email protected]
- Data Protection Officer: Aleksei Metelkin
- Address: ul. Galczynskiego 40j, 52-214, Wroclaw, Poland, VAT PL8992905316
16. Jurisdiction-Specific Disclosures
EEA/UK: Processing under GDPR/UK GDPR. Lead supervisory authority: UODO (Poland)
California (CPRA): We do not sell or share personal information for cross-context behavioral advertising
Brazil (LGPD): We act as controller for forecasting and support data. Exercise LGPD rights via [email protected]