Privacy policy

1. Data controller

The data controller is Valérian ZOLTOWSKI, sole trader, registered under SIRET 984 210 625 00013, operating the service under the trading name Casa Croqueta (the “Publisher”).

Contact: support@casacroqueta.fr. No data protection officer has been appointed, as this is not required under Article 37 GDPR. Any question about your data may be sent to the address above, and is answered by a person.

2. Data we collect

• Account data: email address, display name, username, chosen language, avatar and biography (both optional);
• Your content: recipes, ingredients, steps, photographs, collections, meal plans, favourites — and, if you join a family space, your membership of it;
• Billing data: Stripe customer reference, plan, subscription status and expiry. No card details ever pass through our servers: payment takes place on Stripe’s own pages, to which you are redirected;
• Import assistant: the text you paste or the photographs you submit, together with any instruction you add. See section 4;
• Usage measurement: the fact that a feature was used, and its outcome — never its content.

What we do not collect. Your IP address is used transiently to limit abusive login attempts; it is not stored in any table of our database. It appears in our servers’ technical logs, which are capped in size and continuously overwritten — in the order of a few weeks. We collect neither your browser type, nor your browsing history, nor any analytics data.

3. Purposes and legal bases

• Providing the service (performance of a contract, Art. 6(1)(b)): account creation, authentication, management of your recipes, collections and meal plans;
• Import assistant (performance of a contract, Art. 6(1)(b)): transcribing the text or page you submit. This feature only runs when you trigger it;
• Quality control and moderation (legitimate interest, Art. 6(1)(f)): recipes you choose to make public are analysed automatically in order to filter out unlawful or manifestly unsuitable content. Private recipes are not analysed. See section 5;
• Subscription management (performance of a contract, Art. 6(1)(b)): payment, invoicing, renewal;
• Service security (legitimate interest, Art. 6(1)(f)): rate-limiting login attempts, protection against automated requests;
• Legal obligations (Art. 6(1)(c)): retention of accounting records, response to judicial requests.

4. The import assistant and the use of artificial intelligence

When you use the assistant that transcribes pasted text or a photographed page, the content you submit is transmitted to a language-model provider in order to extract the fields of a recipe. The same applies to the analysis of recipes you publish (section 3).

What is transmitted: the text or images you submit, and any instruction. Neither your name, nor your email address, nor any account identifier is attached to the call — the provider receives content, not a person.

What happens to your photographs: they are erased from our servers as soon as transcription ends, whatever the outcome, including on failure. They are never published, nor attached to the recipe created.

Providers used:

• Mistral AI SAS, a French company established in Paris. Processing entrusted to Mistral takes place within the European Union: it involves no international transfer, and no additional safeguard is required on that account;
• OpenAI, whose contracting entity for the European Economic Area is OpenAI Ireland Limited (Dublin). Processing may involve a transfer to the United States. That transfer is covered by OpenAI’s certification under the EU-US Data Privacy Framework and, failing that or in addition, by the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914) set out in its data processing agreement. A copy of those safeguards is available on request at support@casacroqueta.fr.

We favour the European provider whenever the task allows it.

You are never required to use this assistant: entering a recipe manually involves no artificial-intelligence provider.

5. Automated decisions

Two automated checks may stand in the way of publishing content:

• a completeness check, which returns a public recipe to private when essential elements are missing, and gives you the list of what is missing;
• a content analysis, which may refuse a transcription or delay a publication.

These checks can get it wrong. You may request review by a person by writing to support@casacroqueta.fr within 90 days of the refusal. After that, the excerpt we kept no longer exists and we will ask you to submit your text again. None of these decisions produces legal effects concerning you: they bear on the publication of a piece of content, never on your account, and your recipes remain in your notebook in every case.

What we keep when an import is refused. When a transcription is refused, we record the date, the reason for the refusal and an excerpt of the text you submitted, capped at 400 characters. That excerpt lets us check the refusal was warranted if you contest it, and spot accounts that repeatedly submit prohibited content. It is erased after 90 days. Beyond that we keep only the fact that a refusal occurred and its reason, for one year — without the text. We never keep the original photograph: it is destroyed as soon as the transcription ends. Reading the excerpt is restricted to administrators; moderators see the reason, not the text. This record rests on our legitimate interest in protecting the service (Article 6(1)(f) GDPR); you may object by writing to us, and we will consider your request.

6. Recipients and processors

Your data is never sold, nor passed to third parties for advertising or commercial purposes. It is shared only with the people you invite into your family space, according to the visibility you choose for each recipe, and with the following technical providers:

• OVH SAS (France) — server and database hosting;
• Stripe, Inc. (United States) — online payment. Data transmitted: email address, amount, subscription reference. Stripe is PCI DSS certified; its data processing agreement is published at stripe.com/legal/dpa;
• Proton AG (Switzerland) — delivery of service emails (address verification, password reset, moderation notices). Switzerland benefits from a European Commission adequacy decision;
• Mistral AI SAS (France) and OpenAI (EEA contracting entity: OpenAI Ireland Limited, Ireland) — import assistant and quality control. See section 4.

Transfers outside the European Union. Hosting, the database and the processing entrusted to Mistral AI all take place within the European Union. Only payment (Stripe) and, where applicable, processing entrusted to OpenAI may involve a transfer to the United States. Service emails pass through Switzerland, which benefits from an adequacy decision.

7. Retention periods

Account deletion. You can delete your account yourself, from your profile, without writing to us. Your account data, recipes, photographs, collections and meal plans are then erased immediately and irreversibly — including the stored image files. Only the accounting records mentioned above remain.

8. Your rights

Under Regulation (EU) 2016/679 and French Act No. 78-17 of 6 January 1978, you have the following rights:

• Right of access and to data portability: you can download a complete copy of your data yourself, at any time and from your profile, in JSON format. This is free of charge, with no limit on how often, and available on every plan;
• Right to rectification: your account data and your content can be edited directly within the service;
• Right to erasure: see section 7;
• Right to object: you may object to processing based on our legitimate interest (section 3);
• Right to restriction: you may request that processing be suspended.

For rights that cannot be exercised directly within the service, write to support@casacroqueta.fr. We answer within one month of receipt, a period we may extend by two months for complex requests, informing you and explaining why (Art. 12(3)). Exercising your rights is free (Art. 12(5)).

If our answer does not satisfy you, you may lodge a complaint with the CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr.

9. Security

Communications are encrypted (HTTPS/TLS), passwords are hashed with bcrypt, and access to data is subject to an ownership check verified on every request. Email addresses are masked in our application logs. As no system is infallible, we cannot guarantee absolute security; in the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with Article 34 GDPR.

10. Cookies

The service uses only trackers strictly necessary to its operation and loads no third-party script. The details are in our cookie policy.

11. Changes

This policy may be updated. In the event of a substantial change, we inform you by email at least thirty days before it takes effect, stating what changes. The date of the last update appears at the top of this document, and previous versions are kept and provided on request.