Privacy and cookies notice for people in the UK

1. Who we are

CestaChef is a meal planning app and website. This notice explains what personal data we collect, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The controller is identified in our legal notice (in Spanish). You can reach us at info@cestachef.es.

2. Data we collect

• Account data: your name and email address when you sign in with Google or with an emailed link.
• Plan preferences: the supermarket you choose, your budget, your diet and the kitchen appliances you have.
• Saved plans: the recipes and shopping lists you choose to save.
• Allergies and intolerances: this is health data, a special category under Article 9 of the UK GDPR. We only process it with your explicit consent, which you give when you select an allergy, and you can withdraw it at any time by clearing your choices. It is used to remove dishes from your plan.
• Usage analytics: only if you accept analytics. You can change your choice at any time with the Analytics button in the footer.
• Purchase records: if you buy a subscription, the transaction details that Apple or Google share with us. We never receive your card details.

3. Why we use it, and our lawful basis

• To build and save your plans and keep your account working: performance of our contract with you.
• To keep the service secure and answer your messages: our legitimate interests.
• To process your allergies and, if you accept it, usage analytics: your consent.

5. Who we share it with, and international transfers

We use service providers that process data on our behalf, such as our database and authentication provider (Supabase), our hosting provider, and Apple and Google for app store purchases. Some of them process data outside the UK. Where they do, we rely on a transfer mechanism approved for UK GDPR, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission's standard contractual clauses. We do not sell your personal data.

6. Your rights

You have the right to:

• be informed about, and access, your personal data;
• have inaccurate data corrected and ask for it to be erased;
• restrict or object to some processing, and ask for your data in a portable format;
• withdraw your consent at any time, without affecting what was done before.

To exercise them, email info@cestachef.es. If you are not happy with our answer, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

7. Retention and changes

We keep your data while your account is active and delete it when you delete your account, except where the law requires us to keep some records. If we change this notice we will update the date above.