Privacy policy

Who is responsible

The data controller is the site owner, identified at the bottom of this page (name, tax ID, address and contact email). It is a company based in Uruguay that offers the service to people in Spain and other countries.

For any question about your data, write to the contact email. If a representative in the European Union has been appointed, it is also shown at the bottom of the page.

What data we process

If you only browse the public recipes and menus, we ask for no data. Like any server, we log the IP address and technical details of each request so the site works and to protect it from abuse.

If you use the app as a guest, we store an anonymous identifier in a cookie and your household data: your settings (people, meals, dietary restrictions), planned weeks, shopping list, own recipes and favourites. We do not ask for your name or email.

If you create an account, we also process your name and email (provided by Google, or the one you type to receive the sign-in link), and your language, region and time zone. For each session we store the IP address and browser you sign in from, for security.

The dietary restrictions you enter (for example, gluten-free or lactose-free) may reveal health data. They are optional: we only use them to filter recipes and process them with your explicit consent, given when you enter them and withdrawn by removing them.

We only send emails needed for the service, such as the sign-in link. We do not send marketing email.

Why and on what legal basis

To provide the service (creating your account or guest household, saving your plan and recipes, keeping your session and sending the sign-in link): performance of the service you request (Art. 6(1)(b) GDPR).

To keep the site secure and prevent abuse (access logs, usage limits): legitimate interest (Art. 6(1)(f)).

To measure usage with cookie-based analytics (Google Analytics) and to show advertising: only with your consent (Art. 6(1)(a)), which you can withdraw at any time from “Cookie preferences” without affecting what came before. For cookie-free analytics, our legitimate interest in knowing which pages work, without identifying you.

To filter recipes by your dietary restrictions: your explicit consent (Art. 9(2)(a)).

To handle your requests and meet the legal obligations that apply to us (Art. 6(1)(c) and 6(1)(f)).

We do not make automated decisions with legal effects on you and we do not build profiles.

Who we share it with

With the providers that make the service possible and act as data processors: Microsoft Azure (app hosting), Neon (database), Google (sign-in with Google and, only if you accept, Google Analytics), Resend (sending the sign-in link by email) and Cloudflare (DNS and forwarding of the contact email). Advertising providers, only if you accept them.

We do not sell your data or hand it to third parties for their own purposes.

International transfers

The site owner is in Uruguay, which has an adequacy decision from the European Commission. Several providers process data in the United States: they do so under the EU–US Data Privacy Framework when certified or, otherwise, the European Commission's standard contractual clauses. Resend hosts email sending in the European Union (Ireland).

How long we keep it

Your account and household: as long as you keep them. If you delete your account (Settings → Delete account), we erase your data immediately; the provider's backups are overwritten within 30 days at most.

Guest households: deleted after 12 months without activity.

Sessions: expire after 7 days; expired-session records (IP and browser) are deleted after 30 days.

Cookie-based analytics: Google Analytics keeps data for 14 months.

If you exercise a right or a legal obligation applies, we keep the bare minimum, blocked, for the limitation periods.

Your rights

You can request access, rectification, erasure, restriction, objection and portability of your data, and withdraw your consent at any time, by writing to the contact email. We will reply within one month (extendable for complex cases) and it is free of charge; we may ask you to verify your identity.

If you think we are not handling your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country of residence. If you live in Uruguay, also to the Personal Data Regulatory and Control Unit (Law 18,331).

Account data is necessary to create the account; without it you can use guest mode.

Minors and security

The service is not aimed at children under 14. If you believe a minor has given us data, write to us and we will delete it.

We protect data with encrypted connections (HTTPS), restricted access and providers that meet recognised security standards. If a breach affects you, we will notify the authority and, where required, you, within the legal deadlines.

Site owner

Name or company:

Pedro Franco SAS

Tax ID:

219406450017

Address:

21 de setiembre 2560, Montevideo, Uruguay

Contact email:

hola@comidias.com