Privacy notice
Recipy holds family material that can be deeply personal. This notice explains what AB & GL Nexus Global Partners Limited collects, why it uses it, who helps provide the service, and the choices and rights available to you.
The short version is that Recipy uses your information to turn material you choose into Recipys and books, provide your account, take payment, fulfill orders, support you, protect the service, and meet legal duties. Recipy does not sell your personal data. Mixpanel and configured Google Analytics browser measurement remain off unless you accept analytics. Vercel Web Analytics measures aggregate page visits only after analytics consent. Private route identifiers, query strings and fragments are removed. Do Not Track and marked internal or test traffic are excluded. Speed Insights measures aggregate page performance with the same consent and URL protection. Session replay remains disabled.
1. Who is responsible
AB & GL Nexus Global Partners Limited is the controller for the main Recipy service.
Private company limited by shares, registered in Ireland
Company number: 764964
VAT number: IE4314254UH
Registered office: Valclusa, Church Avenue, Killiney, Ireland, A96 Y072
Privacy contact: support@recipy.to
Recipy is a trading name used by the company. References to Recipy, we, or us in this notice mean AB & GL Nexus Global Partners Limited.
2. Who this notice covers
This notice covers:
- visitors to recipy.to;
- optional newsletter subscribers;
- anonymous and signed-in users;
- customers and delivery recipients;
- people who contact support or report public content;
- people whose voice, image, name, Recipy, memory, or other information a user chooses to include; and
- people who view a deliberately public Recipy or book page.
The service is for account holders and purchasers aged 18 or over. An adult may preserve material about a child only with appropriate authority and care.
3. Information Recipy handles
Account and identity
- anonymous and signed-in Recipy account identifiers;
- email address and authentication records;
- identity-provider information needed for Google sign-in, such as the email and name returned under the approved scopes;
- optional profile name, username, language, and measurement-unit preference; and
- terms, content-policy, privacy, and consent records.
Optional newsletter
If you submit the dedicated newsletter email form beside its description, we collect your email address and selected language to send Recipy news. We record the displayed consent text and version, language, source, request and confirmation events, timestamps and subscription status. Encrypted email addresses, keyed email identifiers, delivery records and hashed IP rate-limit keys support delivery, withdrawal and abuse prevention.
We send a confirmation email with a link valid for 24 hours. Only after you confirm do we subscribe you and queue a welcome email. The launch subscriber list stays in Recipy’s database; Resend sends the emails. Newsletter consent is separate from account creation, terms acceptance and browser analytics consent. Refusing or withdrawing it does not prevent use of the core service.
You can unsubscribe through the email link or your email provider’s one-click unsubscribe. Local withdrawal cancels pending newsletter emails immediately. Signed delivery feedback for bounces, complaints and suppressions blocks further newsletter sends. A message already in flight may still arrive. The launch does not enroll contacts in provider-managed campaigns or track newsletter opens or clicks.
Family and Recipy content
- voice recordings and uploaded audio;
- machine and edited transcripts;
- Recipy titles, ingredients, quantities, steps, timings, notes, stories, tips, categories, and source hints;
- photos, captions, names, dedications, cover material, and book choices;
- imported text, images, or webpage content you ask Recipy to structure;
- public-sharing choices, audio-visibility choices, and public tokens; and
- PDFs, print artifacts, locked-edition snapshots, QR destinations, and family archive files.
This content can contain personal data about relatives or other people who do not have a Recipy account. It can also reveal sensitive matters, depending on what a user chooses to say or show. Recipy does not ask you to add health diagnoses, religious beliefs, ethnicity, political opinions, sexual information, or similarly sensitive details unless they are genuinely necessary for the private family material you choose to preserve.
Do not submit sensitive information about another person unless you have their clear permission or another lawful basis. If sensitive information appears incidentally in material you ask Recipy to preserve, Recipy limits its use to providing the chosen private service, protecting rights, and meeting legal duties. A person shown or mentioned may contact us directly even if they do not have an account.
Book, payment, and delivery information
- book size, Recipy limit, expansion, quantity, upgrades, price version, discounts, and totals;
- full delivery name, address, postcode, country, email, and a carrier telephone number only when required for that shipment;
- Stripe customer, checkout, payment-intent, refund, and reconciliation identifiers, status, and limited payment metadata;
- Lulu print-job, product, production, delivery, tracking, and issue details; and
- invoices, cancellation requests, remedy evidence, correspondence, and accounting records.
Recipy does not receive your full card number or card security code. Stripe collects and handles card details.
Support, safety, and legal information
- contact-form and email messages;
- reports about content, the reported URL, evidence, decision, and review history;
- account-security, rate-limit, access, and fraud signals;
- error, processing, and fulfillment logs needed to diagnose a request; and
- information required for a legal claim, lawful request, safety report, or regulatory duty.
Device, usage, and browser information
When needed to deliver and secure the site, Recipy and its hosting providers receive normal request information such as IP address, date and time, route, browser or device details, and error data.
If you accept analytics, Recipy processes sanitised Mixpanel feature events, safe screen/route views, device category, locale, classified acquisition and approved campaign attribution, approximate country code, visitor-local hour/day, named clicks, visible recently active page time and pseudonymous identity. Anonymous use is linked to your opaque account ID when you register or sign in. A signed, short-lived receipt distinguishes a new account from returning sign-in. We do not send family content, emails, names, audio, transcripts, access tokens, private links or page titles. Mixpanel IP-based enrichment, profile updates, automatic click capture and session replay stay disabled. No pre-consent events are backfilled. Google Analytics separately measures consented website views and engagement with sanitised route templates and fixed titles, known public referrer domains, allowlisted campaigns, device and approximate geography. It uses browser/session identifiers, not your Recipy account ID. Advertising storage, Google Signals, ad personalization and enhanced measurement are disabled. Details and historical data are described in the Cookies and Browser Storage Policy.
4. Where information comes from
Most information comes directly from you. We also receive information:
- from a family member or other user who includes you in private or public content;
- from Google when you choose Google sign-in;
- from Stripe about a payment or dispute;
- from Lulu and carriers about production and delivery;
- from an analytics provider after you accept browser analytics;
- from a person who reports content or makes a rights request; and
- from public authorities or professional advisers where lawful and necessary.
If another person has included your information and you want to understand or object to Recipy's use, contact us. We will consider the rights and interests of everyone involved rather than assuming the uploader can make every decision for you.
5. Why Recipy uses information and the legal basis
| Purpose | Information | Main GDPR basis |
|---|---|---|
| Create and run an anonymous or signed-in workspace; transcribe and structure material; save, edit, export, and support Recipys and books | Account, content, preferences, processing metadata | Contract or steps you request before a contract; legitimate interests for a limited anonymous trial and essential support where appropriate |
| Create the proof, take payment, lock the approved edition, print, deliver, replace, refund, and support an order | Content, proof, price, payment status, address, order and communication data | Contract; legal obligation for consumer, tax, and accounting duties |
| Provide deliberate public sharing | Selected content, public token, visibility and audio choices | Contract for the feature; legitimate interests in providing owner-directed sharing, balanced against people shown or mentioned |
| Authenticate and secure accounts and prevent misuse | Identity, session, IP, rate-limit, security and fraud data | Contract; legitimate interests in security, fraud prevention, and protecting users; legal obligation where applicable |
| Send sign-in, account, order, delivery, refund, safety, and support messages | Email, account, order and message data | Contract; steps requested by you; legal obligation; legitimate interests for essential service communication |
| Send the optional newsletter and its confirmation and welcome emails | Email, language, consent and subscription records, message and delivery data | Consent; legitimate interests in preventing abuse and retaining minimum consent and withdrawal evidence |
| Maintain minimum tax, accounting, company, consumer, dispute, and safety records | Transaction, remedy, complaint and legal data | Legal obligation; legitimate interests in establishing, exercising, or defending legal claims |
| Measure browser use, product experience, and performance | Analytics events, pseudonymous IDs, browser and device data | Consent |
Recipy does not use browser analytics consent as permission to process a Recipy, fulfill a contract, or secure an account. Rejecting analytics does not stop the core service.
Where Recipy relies on legitimate interests, you may ask about the balancing assessment or object. We will consider your situation and stop unless there are compelling lawful grounds or the processing is needed for legal claims.
Recipy does not make decisions that produce legal or similarly significant effects about you solely through automated processing. AI creates editable draft material, not an eligibility, credit, employment, insurance, or legal decision.
6. AI and transcription processing
Recipy currently sends selected material to:
- Deepgram for speech transcription;
- OpenAI GPT-6 Luna for Recipy structuring from transcripts, selected text, images and existing Recipy context when Luna processing is enabled; and
- Google Gemini for the retained processing configuration and public News translations. That processing configuration can also receive audio.
The exact material depends on what you submit. It can include audio, transcript, Recipy text, image, source hint, existing Recipy context, and language information. AI can return incorrect or invented information, so you must review the output.
Recipy does not train its own general-purpose AI model on your family content.
Production Deepgram requests use its EU processing endpoint and opt each request out of the Model Improvement Program. Gemini processing is permitted only through a project configured for business use with active Cloud Billing and the applicable data-processing terms. If an approved provider configuration is unavailable, Recipy must stop that processing path rather than send family content under consumer or model-training terms.
OpenAI processing uses the business API with response storage disabled and optional sharing for model training disabled. Luna receives no original audio. Standard abuse-monitoring logs may retain content for up to 30 days; temporary encrypted prompt caches can last up to 24 hours. Legal and safety exceptions can apply under the provider terms. Disabling response storage is not a promise of zero retention or European processing. See OpenAI's data controls. Recipy does not silently switch a failed Luna request to another AI provider.
To recover interrupted work, Recipy can keep private transcript and generated-content checkpoints for up to 24 hours. Terminal job metadata is eligible for deletion after seven days. Expired checkpoints cannot be reused; cleanup runs through the processing recovery job. These records are bound to your account and Recipy and are deleted with them. Original recordings follow the existing recording retention rules.
7. Service providers and other recipients
| Recipient | Why it receives data | Typical data | Role and location notes |
|---|---|---|---|
| Neon | Managed PostgreSQL database hosting | Account, content records, books, metadata, orders | Processor for hosted data under its service and data-processing terms. Recipy uses the Frankfurt region. |
| Deepgram | Speech transcription | Audio and language or request metadata | Processor using the EU endpoint and request-level model-improvement opt-out. Operational metadata can still be processed elsewhere under its terms. |
| Google Gemini | AI transcription and Recipy structuring | Audio, images, text, transcript, existing Recipy context | Processor under Paid Services and applicable data-processing terms. US or global subprocessors and transfers can be involved. |
| OpenAI | AI Recipy structuring | Transcripts, selected text and images, title hints, language and existing Recipy context; no original audio | Processor under API business and data-processing terms. Optional training sharing is disabled and requests use store:false. Global processing and the retention limits above can apply; European residency is not assumed. |
| Stripe | Payment, refund, tax tooling, fraud and compliance | Email, amount, currency, order, address where used, payment method data collected by Stripe | Processor for instructed services and separate controller for some regulated, fraud, and compliance activity. Irish and global entities may be involved. |
| Lulu | Print-on-demand production and fulfillment | Approved book files, order reference, delivery name, address, contact, tracking | Printer and fulfillment provider. US and other production or carrier locations may be involved. Recipy remains the seller. |
| Resend | Transactional and support email; optional newsletter confirmation, welcome and marketing delivery, confirmed-contact language preferences and opt-out synchronization | Recipient, language, subscription status, subject, message content, delivery logs | Processor. Resend states customer data and email logs/content are stored in the United States even when mail is sent from Ireland. |
| Vercel | Hosting, request delivery, private file storage, and consented aggregate Web Analytics and Speed Insights | Content and media files, print artifacts, request metadata, route, error, and aggregate traffic and performance measurements | Processor subject to the service terms. Recipy stores private files in the Frankfurt region; edge and non-EEA processing can still occur for other services. |
| Mixpanel | Product events after consent; direct server reliability telemetry and session replay disabled | Sanitised pseudonymous events, route templates, device, locale, classified attribution, approximate country, local hour/day, active time and named clicks; historical analytics data | Processor. Recipy uses the EU ingestion endpoints and applies the provider settings described in the Cookies Policy. |
| Google Analytics | Consent-gated website measurement when configured for production | Browser/session cookie identifiers, sanitised route templates, engagement, device, approximate geography, known public referrer domains and allowlisted campaigns; no account ID or family content | Google can process data globally under its service and data-processing terms. New event/user data retention is 2 months; standard aggregated reports can persist longer. |
| Google sign-in | Optional identity provider | Google account identity under approved scopes | Google acts under its own terms; Recipy handles the authentication connection through its application. |
| Professional advisers and authorities | Tax, audit, legal claims, safety, law enforcement, and regulatory duties | Minimum necessary records | Independent controllers where they use data for their own professional or legal duties. |
Recipy does not sell personal data. It does not share family content with advertising networks.
8. International transfers
Some recipients or their subprocessors process data outside the European Economic Area. Depending on the recipient and transfer, safeguards can include:
- an adequacy decision, including a valid EU-US Data Privacy Framework certification where it covers the transfer;
- the European Commission's Standard Contractual Clauses;
- contractual, security, and transfer-impact measures; or
- a limited legal exception where no other mechanism applies.
Recipy must keep the relevant DPA, subprocessor, transfer mechanism, and assessment records. You may ask for information about the safeguards, subject to protection of confidential or security information.
No statement in this notice means that all data stays in the EU.
9. Public sharing and printed books
Your editable family content is private by default. When you deliberately enable a public Recipy or book page, the selected content becomes available to anyone with the link. You control audio separately where that control is offered.
Public content may include personal data about people other than you. Before enabling it, make sure you have appropriate authority and consider whether publication is fair and expected. A person shown or mentioned may contact us even if they do not have an account.
Disabling a public page stops Recipy from intentionally serving it, but search engines, recipients, screenshots, downloads, and physical books may preserve copies. Printed QR codes cannot be recalled. Recipy does not promise permanent hosting of public pages or audio.
10. How long information is kept
Recipy keeps personal data only as long as needed for the stated purpose, a legal duty, security, dispute handling, or limited backup recovery.
For essential audio recovery, Recipy keeps browser copies in the IndexedDB database recipy-recording-recovery, keyed by owner and Recipy. Each copy expires seven days after its last checkpoint; expired entries are removed the next time Recipy uses this database, not automatically while the site is closed. Recipy clears the recovery copy after the server confirms upload. Clearing site data also removes these copies. Recovery requires the same owner account or anonymous session and a server check confirming ownership of the Recipy. Uploaded drafts and content records remain in Recipy's authenticated database and private object storage.
| Information | Retention rule |
|---|---|
| Signed-in account, editable Recipys, books, recordings, photos, and source material | Until you delete the item or close the account, subject to active orders, limited recovery backups, and legal records |
| Anonymous unfinished content | While the temporary session is active and for a limited recovery period afterward. Claim or export anything you want to keep. We do not promise permanent anonymous storage. |
| Public page and audio | Until the owner disables it or underlying content is deleted, subject to limited security records and copies outside Recipy's control |
| Locked-edition print artifacts and reprint record | While the owner keeps the edition available for exact reprint, or until deletion is requested and no active order or legal need prevents it |
| Order, invoice, refund, and Irish tax evidence | Normally six years, or longer only if a legal dispute, audit, or law requires it |
| Union OSS records, if Recipy uses OSS | Ten years as required by the scheme |
| Delivery address and support evidence | For the active order and a limited remedy or claim period; remove or minimise sooner than the core tax record where possible |
| Operational processing and error logs | For the shortest practical operational period, unless a security incident, support case, or legal claim requires longer |
| Consented analytics, including historical session replay | Under the provider settings described in the Cookies Policy, or sooner if deleted or no longer needed |
| Consent records | While relied on and for a limited period needed to demonstrate the choice |
| Rolling service backups | Until overwritten through the normal recovery cycle. A deleted item can remain inaccessible in a backup until that backup expires. |
Newsletter cleanup removes pending email addresses after seven days from the request and withdrawn or suppressed email addresses after 30 days from the status change, only when provider synchronization is no longer pending. Active subscriber addresses remain for the subscription. Frozen delivery payloads are cleared after seven days, webhook event IDs after 30 days, send-attempt records after 32 days, and rate-limit records after expiry. These are cleanup thresholds, not promises of deletion at an exact time. Keyed email identifiers, subscription status, consent evidence and suppression records remain to demonstrate consent and honor withdrawal; no automatic deletion period is currently implemented for those records or Resend contacts. Contact us for an erasure request.
When an account closes, Recipy separates content deletion from minimum transaction records. A tax record does not need to retain the voice recording, family photos, or full book.
11. Your data-protection rights
Depending on the circumstances, you may ask Recipy to:
- confirm whether it uses your personal data and give you a copy;
- correct inaccurate or incomplete data;
- delete data;
- restrict particular processing;
- provide portable data you supplied in a structured, commonly used, machine-readable format;
- stop processing based on legitimate interests;
- explain or review an automated process; or
- record that you withdrew consent.
You can change browser analytics consent through the Cookie settings control. Withdrawal does not make earlier lawful processing unlawful.
Contact support@recipy.to. We may need to verify identity and clarify scope. We normally respond within one month. A complex or numerous request may lawfully take longer, and we will explain if that happens.
Rights are not absolute. For example, Recipy may keep minimum transaction evidence required by tax law or information needed for a legal claim. We will explain a refusal or limitation and the available complaint route.
You may complain to the Irish Data Protection Commission or another supervisory authority available to you. We would appreciate the chance to address the issue first, but that is not a condition of complaining.
12. Security
Recipy uses technical and organisational measures intended to match the risk, including encrypted network connections, signed authentication sessions, database ownership rules, signed anonymous-account transfer, access controls, secrets kept outside source control, provider security terms, and review of sensitive routes.
No online service can promise perfect security. Tell us immediately if you suspect unauthorised access, a public link shared by mistake, or a security issue. Do not send passwords or full card details by email.
13. Children
Recipy accounts, content submission, and purchases are for adults aged 18 or over. We do not knowingly allow a child to run an account.
An adult may preserve a family Recipy, image, or memory involving a child only with appropriate legal authority and in the child's best interests. Public sharing needs particular care. If you believe a child is using an account or that a child's material is being handled inappropriately, contact us so we can investigate and take proportionate action.
14. Changes to this notice
We update this notice when processing, providers, retention, or law changes. The date and version at the top identify the current text. We will give appropriate notice of a material change and seek consent when the law requires it. A new notice does not create a new purpose that is incompatible with why data was collected.
15. Contact and related documents
Privacy questions and rights requests: support@recipy.to or the contact form at /legal.
Related documents: Terms of Use and Sale, Cookies and Browser Storage Policy, Cancellation and Refund Policy, Content and Safety Policy, and Accessibility Statement.