Legal

Privacy Policy

Last updated: 29 October 2026

This policy describes how we process personal data in GEPYR, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

Data controller

Adrián Velasco Sánchez, Spanish tax ID (NIF) 03930757B, domiciled in Toledo (Spain), email [email protected].

Data we process

• Account data: email address, name and password (stored irreversibly encrypted, never in plain text).
• Business data entered by the user: ingredients, recipes, orders and customers. These may include third parties’ personal data (for example, the names and contact details of your customers); see “Third-party data” below.
• Queries to the AI assistants: the text of the questions you send them.
• Billing data: handled through Stripe; we do not store your card details.
• Technical data: IP address and access logs for security purposes, and aggregated, anonymous usage metrics for the public website (cookieless analytics).

The data requested at sign-up are necessary to create the account and provide the service; if they are not provided, it is not possible to register.

Purposes and legal bases

• Providing the service and managing your account — performance of a contract (Article 6(1)(b) GDPR).
• Managing subscription payments — performance of a contract (Article 6(1)(b) GDPR).
• Providing the artificial intelligence (AI) assistants you request — performance of a contract (Article 6(1)(b) GDPR).
• Handling your queries, support requests and suggestions — performance of a contract (Article 6(1)(b) GDPR).
• Complying with tax and accounting obligations — legal obligation (Article 6(1)(c) GDPR).
• Security and the prevention of fraud and abuse — legitimate interest (Article 6(1)(f) GDPR).

Recipients (processors)

Stripe (payment gateway), Supabase (authentication and database), Google Cloud (application hosting), Cloudflare (public website hosting and cookieless analytics), Anthropic (Claude) (provider of the AI model behind the assistants) and Resend (delivery of transactional emails, such as activation codes), which process the data on our behalf under data processing agreements pursuant to Article 28 GDPR. We do not sell or disclose your data to third parties for commercial purposes. Data will only be disclosed to public authorities where there is a legal obligation to do so.

International transfers

Some of these providers are established in the United States or may process data outside the European Economic Area. These transfers are based on the adequacy decision for the EU-U.S. Data Privacy Framework, in which providers such as Stripe, Google and Cloudflare participate, or on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You can request more information about these safeguards at [email protected].

Artificial intelligence (AI) assistants

The application includes assistants based on artificial intelligence. When you use them, the text of your queries and, in the case of your recipe book assistant (Atlas), the preparations and recipes needed to answer you are sent to the model provider (Anthropic, Claude service) solely to generate the response. Please note that you are interacting with an AI system (Article 50 of Regulation (EU) 2024/1689, the Artificial Intelligence Act): its responses are generated automatically, are for guidance only and may contain errors, so you must verify them before making decisions (especially regarding allergens, costs or prices).

Retention periods

We keep your data while your account is active. If you stop paying or cancel, your business data are kept for a 30-day grace period so that you can reactivate the account; once that period has passed without reactivation, they are deleted or anonymized. Invoices and tax data are kept, blocked, for the mandatory statutory periods (4 years under Article 66 of Spanish Law 58/2003, the General Tax Law, and up to 6 years under Article 30 of the Spanish Commercial Code). You can request early deletion of your account from the settings; data subject to a legal retention obligation will remain blocked until the end of that period. In addition, if you delete your account without having become a paying customer, we keep your email address in dissociated form (not linked to the rest of your data) as an anti-abuse measure for the free trial, on the basis of legitimate interest (Article 6(1)(f) GDPR), for as long as is strictly necessary for that purpose.

Third-party data: processing on your behalf

With regard to third parties’ personal data that you enter into the application (for example, your customers’ data), you are the controller and GEPYR acts as processor, in accordance with Article 28 GDPR and clause 8 of the Terms and Conditions. If you record a customer’s allergies or intolerances, you are processing data concerning health (a special category, Article 9 GDPR): do so only with that person’s explicit consent or another basis that permits it, and record only what that person has told you.

Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction and portability (Articles 15 to 22 GDPR) at any time by writing to [email protected]. You can also export your data and delete your account directly from the application settings. You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you consider that the processing does not comply with the law.

Security

We apply encryption in transit and at rest, secure authentication, isolation of each user’s data and access controls, in accordance with Article 32 GDPR.