Privacy Policy, Kisscooks

Last updated: May 29, 2026, Version: 1.1

1. Data Controller Identification

We are committed to protecting our users’ privacy and processing their personal data in accordance with the General Data Protection Regulation (GDPR) (EU 2016/679) and applicable national legislation.

2. Scope

This policy applies to:

• The Kisscooks mobile application available on the App Store (iOS) and Google Play Store (Android);
• The web application accessible via browser;
• Any interaction with our services (API, push notifications, support).

3. Personal Data Collected

3.1 Data Provided Directly by the User

Sensitive data: Medical dietary restrictions (allergies, medical diets) constitute health data under the GDPR. Their collection is based on the user’s explicit consent (Art. 9(2)(a) GDPR). The user may delete them at any time in their settings.

3.2 Automatically Collected Data

3.3 Data Received from Third Parties upon Social Login

Only the data necessary for account creation is imported. We do not store third-party service access tokens beyond what is necessary for authentication.

4. Legal Bases for Processing

5. Purposes of Processing

Data collected is used to:

• Provide the service: account creation, authentication, access to recipes, menus, and shopping lists;
• Personalize the experience: recommendations based on culinary profile and preferences;
• Enable social features: subscribing to authors, content sharing, list collaboration;
• Manage subscriptions: in-app purchase processing, premium access validation;
• Improve the application: usage analysis (under consent), bug fixes;
• Ensure security: detecting abnormal behavior, protection against abuse;
• Process support requests: ticket responses, content reporting;
• Send notifications: cooking reminders, community alerts (under consent).

6. Subcontractors and Third Parties

6.1 Subcontractor Table

6.2 Transfers Outside the EU

Some providers (RevenueCat, Apple, Google) process data in the United States. These transfers are governed by:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Data Processing Agreements (DPAs) concluded with each provider;
• Where applicable, the EU-US Data Privacy Framework.

7. Cookie and Tracker Management

7.1 Types of Cookies Used

7.2 Consent Management

On first use, a consent banner is displayed. The user can accept all, reject all (except essentials), or configure their preferences by category.

The choice can be modified at any time in Settings > Privacy.

PostHog is configured in persistence: 'memory' mode: no cookie is written to disk until consent to statistics is granted.

8. Push Notifications

Sending push notifications is subject to your explicit consent, requested during onboarding or in the app settings.

You can revoke this consent at any time:

• iOS: Settings > Notifications > Kisscooks
• Android: Settings > Apps > Kisscooks > Notifications
• In the app: Settings > Notifications

9. Access to Device Features

All these permissions can be revoked in your device’s system settings. Denying a permission does not prevent the use of other features.

10. Retention Periods

After account deletion, all personal data is erased within 30 days, except for data subject to a legal retention obligation.

11. User Rights (GDPR)

Response time: 30 days (extendable to 3 months for complex requests, with prior notification).

Complaint: You may lodge a complaint with the CNIL (www.cnil.fr (http://www.cnil.fr/)).

12. Data Security

Technical Measures

• Encryption of data in transit (TLS 1.2+) on all communications
• Encryption of data at rest in the database
• JWT token authentication with automatic expiry and secure refresh
• Anti-bot protection via Cloudflare Turnstile on sensitive forms
• API access protected by Bearer tokens
• API architecture separate from the application backend

Organizational Measures

• Data access limited to authorized personnel
• Subcontractors subject to DPAs (data processing agreements)
• Regular audits of access and permissions

Data Breach

In the event of a data breach likely to pose a risk to your rights and freedoms, we will notify:

• The competent supervisory authority within 72 hours;
• Affected users as soon as possible.

13. Minors

The Kisscooks application is intended for persons aged 13 and over (or the applicable digital age of consent in your country, up to 16 in certain EU Member States).

We do not knowingly collect personal data from children under 13. If you become aware that a child has provided us with data without parental consent, please contact us at privacy@Kisscooks.com.

14. Third-Party Content and External Links

The application allows saving links to external URLs (“Web Favorites” feature). These third-party sites are subject to their own privacy policies. Kisscooks is not responsible for the practices of these sites.

Links to external services (sharing, social networks) redirect you outside our application. We invite you to consult the privacy policies of these services.

15. Amendments to This Policy

In the event of a material change:

• A notice will be displayed in the application;
• A notification email will be sent to registered users;
• The “Last updated” date will be updated.

Continued use of the application after a change constitutes acceptance of the new policy.

16. Contact

• Email: support@Kisscooks.com
• In-app form: Settings > Help & Support
• Postal address: Le French Code, Bureau 326, 59 rue de Ponthieu, 75008 Paris

17. Supervisory Authority

France, CNIL

Commission Nationale de l’Informatique et des Libertés

3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07

www.cnil.fr (http://www.cnil.fr/)

This privacy policy was drafted in accordance with the GDPR (Regulation EU 2016/679), the amended French Data Protection Act (loi Informatique et Libertés), and the guidelines of the European Data Protection Board (EDPB).