SpoonLab

Privacy Policy

Last updated: July 7, 2026

At SpoonLab ("we," "our," or "us"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website spoonlab.app (the "Service"). Please read this policy carefully.

1. Data We Collect

We collect information that you provide directly to us, as well as information that is automatically collected when you use the Service.

Information you provide

  • Account Information: When you create an account, we collect your name, email address, and password.
  • Subscription Data: When you subscribe to a paid plan, our payment processor (Stripe) collects your payment card details. We do not store full credit card numbers on our servers.
  • Recipe Interactions: We store your saved recipes, dietary preferences, cuisine selections, and AI swap history to personalize your experience.
  • Communications: When you contact us via email or our contact form, we collect your name, email address, and the content of your message.

Information collected automatically

  • Usage Data: Pages visited, time on site, recipe views, and feature interactions — collected via PostHog analytics.
  • Device Data: Browser type, operating system, device type, IP address, and approximate location derived from IP.
  • Cookies: See Section 5 below for our full cookie policy.

2. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, our legal basis for processing your personal data depends on the context:

  • Contractual necessity: We process your data to provide the Service you have requested (e.g., creating your account, processing your subscription).
  • Legitimate interests: We process usage data to improve the Service, prevent fraud, and secure our platform.
  • Consent: We rely on your consent for marketing emails and non-essential cookies. You may withdraw consent at any time.
  • Legal obligation: We may process data to comply with applicable laws and regulations.

3. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
  • Portability: Request a machine-readable export of your data for transfer to another service.
  • Objection: Object to processing based on legitimate interests, including direct marketing.
  • Restriction: Request that we limit processing of your data in certain circumstances.

To exercise any of these rights, contact us at hello@spoonlab.app. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

4. Third-Party Processors

We share data with the following service providers to operate the Service:

  • Vercel — Hosting and edge functions (US, global edge network).
  • Supabase — Database hosting and authentication (US, encrypted at rest and in transit).
  • Stripe — Payment processing. Stripe is PCI-DSS Level 1 compliant. Review their privacy policy.
  • Anthropic (Claude API) — AI-powered recipe swaps, ingredient substitutions, and recipe generation. Data sent to the API is not used for model training.
  • PostHog — Product analytics (EU-hosted option available).
  • Google AdSense — Display advertising for free-tier users. Google may use cookies to serve personalized ads. See their privacy policy.

5. Cookies

We use the following categories of cookies:

  • Essential cookies: Required for the Service to function — authentication sessions, CSRF tokens, and language preferences. These cannot be disabled.
  • Analytics cookies: PostHog cookies track anonymous usage patterns to help us improve the Service.
  • Advertising cookies: Google AdSense cookies serve personalized ads. Free-tier users can opt out via the cookie banner. Paid subscribers do not see ads.
  • Affiliate cookies: Amazon Associates cookies track referrals when you click product links in our shop.

You can manage cookie preferences at any time by clicking the "Cookie Settings" link in the footer.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service:

  • Account data: Retained until you delete your account. Upon deletion, personal data is removed within 30 days.
  • Analytics data: Retained for a maximum of 24 months in identifiable form, then aggregated and anonymized.
  • Payment records: Retained for the period required by applicable tax and accounting laws (typically 7 years).
  • Server logs: Retained for 90 days, then automatically purged.

7. International Transfers

SpoonLab is based in the United Kingdom. Your data may be transferred to and processed in the United States and other jurisdictions where our service providers operate. We ensure adequate safeguards — including Standard Contractual Clauses (SCCs) and data processing agreements — are in place for all international transfers.

8. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Email: hello@spoonlab.app

Our Data Protection Officer can be reached at the same address.