Privacy Policy

Last updated: October 14, 2026 · Effective date: July 17, 2026

1. Who We Are

This Privacy Policy describes how Senza Agency, LLC (“Recimate”, “we”, “us”, “our”), a Delaware limited liability company, collects, uses, and shares information about you when you use the Recimate mobile application and any related services (the “Service”).

By using Recimate you accept this Privacy Policy. If you do not agree, do not use the Service.

2. Information We Collect

2.1 Information you give us directly

• Account information — email address, display name, password (stored as a salted hash by our authentication provider), and optionally a profile photo.
• Sign-in identifiers from third parties — if you sign in with Apple, Google or Facebook, we receive your name, email, and (for Google and Facebook) a link to your profile photo from the identity provider.
• Recipe inputs — ingredients, dietary preferences (such as vegetarian or keto), cuisine preferences, time/skill constraints, photos of ingredients (if you use the camera/photo features).
• Allergy information (optional) — the foods you tell us to avoid for allergy or intolerance reasons (gluten, dairy, egg, nuts, soy, seafood). This is health information. We ask for your explicit consent before saving or using it. We use it to tailor your recipes and meal plans, and to check that our AI works safely and correctly (an automated safety check of each request, and quality monitoring of AI requests and responses). For these purposes it is sent to the AI providers listed in Section 5.1 without your name, email or account identifier. You can remove it at any time in Food Preferences, which also withdraws your consent.
• Recipe outputs you save — generated recipes, bookmarks, weekly meal plans, shopping lists.
• Search and discovery activity — search queries, filter selections.
• Communications — messages you send to support, feedback, bug reports.

2.2 Information collected automatically

• Device and app information — operating system and version, app version, device model, device language, time zone, locale.
• Usage data — recipes you view, sections you visit, features you use, time of access. Used to power personalized “For you” sorting and to improve the Service.
• Push notification tokens — only if you opt in to notifications.
• Website request data — when you open recimate.app or a shared recipe link in a browser, our hosting provider processes your IP address and browser type to deliver the page.
• Diagnostics and crash reports — error stack traces and device metadata collected via Sentry to help us debug issues. Some reports include your pseudonymous user identifier; emails and tokens are removed before sending.
• Pseudonymous analytics — events collected via PostHog under a pseudonymous user identifier. We do not send your name or email address.

2.3 Information from third parties

• Subscription state from RevenueCat (active/trial/expired, plan identifier). We do not see or store your payment card or App Store/Play Store account number.
• App Store / Play Store transaction identifiers (anonymized) for purposes of verifying purchases and providing customer support.

2.4 Information we do not collect

• We do not collect government identification, financial account numbers, biometric identifiers, or precise location data.
• Apart from the optional allergy information described in Section 2.1, we do not collect special-category data (such as data about health, race, religion, political opinions or sexual orientation), and we ask that you not submit such data through free-text recipe inputs or support tickets.

3. How We Use Your Information

We use your information to:

• Create and maintain your account.
• Generate AI recipes based on the ingredients and preferences you provide.
• Save your recipes, bookmarks, meal plans, and shopping lists.
• Power personalized sort and recommendations (“For you”).
• Process and verify subscription purchases and trials.
• Send you transactional emails (account verification, password reset, billing receipts, subscription status changes).
• Send you product communications (only if you opt in) and respond to your support requests.
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
• Comply with legal obligations (tax, accounting, regulatory requests, court orders).
• Improve the Service, including improving prompt quality, content filters, and the safety of AI outputs.

4. Legal Bases for Processing (EEA / UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under GDPR / UK GDPR:

You may withdraw consent at any time. Withdrawal does not affect lawfulness of processing carried out before withdrawal.

EU/UK/Swiss Data Protection Representative. We have appointed Data Protection Representative Limited (trading as “DataRep”) as our Data Protection Representative under Article 27 GDPR in the EU/EEA, under the Data Protection Act 2018 / UK GDPR in the UK, and under Article 14 of the Swiss FADP in Switzerland. Contact details are in Section 8.2 below.

5. How We Share Information

We share information only as described below. We do not sell your personal information. We do not share it for cross-context behavioral advertising.

5.1 Sub-processors (vendors that process data on our behalf)

We sign Data Processing Agreements with each sub-processor that handles personal information.

5.2 Legal and safety disclosures

We may disclose information if we believe in good faith it is necessary to:

• Comply with a subpoena, court order, or other legal process.
• Enforce our Terms of Service.
• Protect the rights, property, or safety of Recimate, our users, or others.
• Investigate fraud, security incidents, or technical issues.

5.3 Business transfers

If Recimate or substantially all of its assets are acquired, merged, or sold, your information may be transferred to the acquirer, subject to this Privacy Policy.

5.4 Aggregated or de-identified information

We may create aggregated or de-identified information that cannot reasonably be used to identify you, and we may use and share such information for any purpose.

6. International Data Transfers

Our servers are located in the United States. If you access the Service from another country, your information will be transferred to and processed in the United States.

When we transfer personal data out of the EEA, UK, or Switzerland, we rely on:

• Standard Contractual Clauses (Module 2 — controller to processor) adopted by the European Commission.
• The UK International Data Transfer Addendum for transfers from the UK.
• Where applicable, sub-processor certifications under the EU–US Data Privacy Framework.

7. Data Retention

We retain personal information only for as long as needed:

8. Your Rights

8.1 Everyone

You may at any time:

• Access the personal information we hold about you.
• Correct inaccurate information through in-app settings or by emailing us.
• Delete your account — directly in the app (Profile → Delete Account) or by emailing privacy@recimate.app. We will delete your account within 30 days.
• Export a copy of your data in a portable format.
• Withdraw consent for any processing that relies on consent.
• Opt out of marketing by clicking the unsubscribe link in any marketing email or disabling notifications in your device settings.

To exercise these rights, email privacy@recimate.app. We may need to verify your identity. We respond within 30 days.

8.2 Residents of the European Economic Area, United Kingdom, and Switzerland

Under GDPR / UK GDPR you have:

• The right of access (Article 15)
• The right to rectification (Article 16)
• The right to erasure / “right to be forgotten” (Article 17)
• The right to restriction of processing (Article 18)
• The right to data portability (Article 20)
• The right to object to processing based on legitimate interests (Article 21)
• The right to withdraw consent (Article 7)
• The right not to be subject to automated decision-making with legal effect (Article 22) — we do not engage in such automated decision-making
• The right to lodge a complaint with your supervisory authority

Our Data Protection Representative (EU/EEA, UK, and Switzerland). We have appointed Data Protection Representative Limited (trading as “DataRep”) as our Data Protection Representative. If you are in the EU/EEA, the UK, or Switzerland, you may raise questions about our processing of your personal data, or exercise the rights above, through DataRep:

• Email: datarequest@datarep.com — please quote “Recimate” in the subject line
• Webform: www.datarep.com/data-request
• Post: DataRep has contact locations in each of the 27 EU countries, Iceland and Norway (EEA), the UK, and Switzerland. Key addresses: Ireland (HQ): DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland · United Kingdom: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom · Switzerland: DataRep, Leutschenbachstrasse 95, Zurich, 8050, Switzerland. The full list of local addresses is available at www.datarep.com/data-request.

When writing by post, it is essential to address your letter to “DataRep” (not “Recimate”), or it may not reach us. Please refer clearly to Recimate in your correspondence. On receiving your request, we may ask for evidence of your identity so personal data is not disclosed to anyone other than you. DataRep handles data-protection matters only — for questions about the app itself (recipes, subscriptions, technical issues), contact support@recimate.app.

Supervisory authority. As we have no establishment in the EU/EEA, no lead supervisory authority applies; you may lodge a complaint with the data protection authority of your country of residence or place of the alleged infringement. In the UK, this is the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

8.3 California Residents (CCPA / CPRA)

In the prior 12 months we collected the following categories of personal information about California residents:

We do not sell personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under the CPRA.

You have the right to:

• Know what we have collected, the sources, and the purposes
• Request deletion
• Request correction
• Opt out of sale or sharing (not applicable — we do neither)
• Limit use of sensitive personal information. The only sensitive personal information we process is optional allergy information, which we collect with your consent and use only to provide the recipes and meal plans you request and to check that our AI produces them safely and correctly
• Be free from retaliation for exercising your rights

You may designate an authorized agent to make a request on your behalf.

To exercise California rights: email privacy@recimate.app with the subject line “California Privacy Request.”

8.4 Other Jurisdictions

Residents of Brazil (LGPD), Canada (PIPEDA), and other jurisdictions with comprehensive privacy laws have substantially similar rights and may contact privacy@recimate.app to exercise them.

9. Children's Privacy

Recimate is intended for users aged 16 and over. We do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal information, contact privacy@recimate.app and we will delete it.

In jurisdictions that allow processing of children's data with parental consent at younger ages, you must still be at least 16 to use Recimate.

10. Security

We use industry-standard administrative, technical, and physical safeguards including:

• TLS 1.2+ encryption in transit
• Encryption at rest for primary databases and backups
• Salted password hashing via Supabase Auth
• Role-based access control with least-privilege principles
• Logging and monitoring of access to production systems
• Vendor security review before adding sub-processors

No system is perfectly secure. If you believe your account has been compromised, contact support@recimate.app immediately.

If we experience a personal data breach affecting your information, we will notify you and applicable regulators as required by law.

11. Mobile Permissions

The app may request the following device permissions, which are always optional and can be revoked in your device settings:

• Camera — to photograph ingredients for AI recognition.
• Photo library — to select existing photos of ingredients.
• Calendar / Reminders — to export shopping lists to your calendar or Reminders app.
• Notifications — to send you opt-in product notifications.

Denying any permission will limit the related feature but will not block access to the app.

12. Cookies and Similar Technologies

The mobile app does not use browser cookies. We use local device storage (AsyncStorage) to keep you signed in and remember your preferences. Our website at recimate.app and the public pages of recipes that users choose to share do not set advertising or analytics cookies. Like any website, they process standard web request data (IP address, browser type) to deliver the pages: through our hosting provider (Vercel) for the website, and through Vercel and Supabase for shared recipe pages. The website's own pages load their fonts from Google Fonts, so Google LLC also receives your IP address when one of those pages loads; shared recipe pages do not.

13. Marketing Communications

• Transactional emails (account verification, password reset, billing, subscription status, security alerts) — you cannot opt out of these while you have an account.
• Product / marketing emails — opt-in. Unsubscribe link in every message.
• Push notifications — opt-in via operating system permission. Disable in device settings at any time.

14. Account Deletion

You may close your account at any time — directly in the app (Profile → Delete Account) or by emailing privacy@recimate.app from the email address associated with the account. We will verify, delete, and confirm within 30 days.

Some information may be retained as described in §7 (e.g., billing records for tax purposes).

15. Automated Decisions and Profiling

We do not make decisions that produce legal or similarly significant effects on you using solely automated processing.

The “For you” personalized sort uses your own view history to rank content within the app. It does not score you, restrict access to features, or determine eligibility for anything.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will notify you by email or through the app at least 30 days before the changes take effect. The “Last updated” date at the top of this document reflects the latest revision.

17. Contact Us

Postal address
Senza Agency, LLC
1111B S Governors Ave, STE 29895
Dover, DE 19904
United States of America

Senza Agency, LLC. All rights reserved. Recimate is a product of Senza Agency, LLC.