Privacy policy

1. Who is responsible for your information

The Fricot service is operated by Mataba Corp, [FILL: operator postal address].

Our person in charge of the protection of personal information is [FILL: privacy officer name or title]. You can write to them at [FILL: contact email] with any question about this policy or to exercise your rights.

2. Information we collect

We collect only the information the service needs to work:

• Account: your email address and your password, which we never see: it is stored in an encrypted form that cannot be reversed. If you sign in with Google, Google sends us your email address and the basic information of your Google profile (name and photo).
• Profile: your chosen language, your postal code, the grocery stores you choose and their order, how recipes are split between them, the number of people, the days and times of your meals, the speed and type of recipes, your budget per serving if you set one, the kitchen equipment you have, and the foods you want to avoid.
• Allergies: the allergens you declare. This is health information, and therefore sensitive: we only collect it with your express consent (see "Your consent").
• Use of the service: your weekly plans, the ingredients you check off and your notes for the following week.
• Billing: your subscription, its status, its dates and the identifiers of your customer record and subscription at Stripe. We never receive your card number: you enter it directly on Stripe's payment page.
• Technical data: IP address, browser type, pages requested, date and time, processed by our hosting providers to run and secure the site; IP address and browser signals analyzed by Cloudflare Turnstile when you sign up, sign in or reset your password, to block bots.

We do not use your device's location: only your postal code is used to find nearby grocery stores.

3. Why we use it

• To provide the service: find the grocery stores near your postal code, build your weekly plan according to your preferences and rule out recipes that contain your allergens or the foods you avoid.
• To manage your account: sign-up, sign-in, confirmation of your address and password reset.
• To manage the free trial, subscriptions, payments and invoices.
• To protect the service: prevent fraud and abuse, limit repeated attempts and fix technical problems.
• To write to you about the service: address confirmation, password reset and change, and important notices about your account or our terms.
• To help you along: to send you useful emails about your use of the service (welcome, profile to finish, end of the trial). You can unsubscribe at any time, in your account or with the link in each email.
• To understand how the service is used, in order to improve it: our servers record the main steps of your journey (sign-up, profile screens, plan ready, payment) with your profile.

We do not use your information for advertising and we do not sell it to anyone.

4. Your consent

By creating an account and using the service, you consent to the use of your information for the purposes described in this policy.

Your allergies require separate, express consent: before you save an allergy, you check a box that describes how we use it. We keep the date and the version of the text you accepted.

You can withdraw this consent at any time in your preferences. Your allergies are then erased in the same step, and your recipes stop taking them into account. You can also end all processing by asking us to close your account (see "Your rights").

By creating an account, you also agree to receive helpful emails about the service. You can unsubscribe at any time, in your account or with the link in each email.

5. Cookies and browser storage

We only use what the site needs to work:

• session cookies, which keep you securely signed in;
• a cookie that remembers your chosen language;
• the browser's local storage, which remembers your theme (light, dark or your device's);
• a PostHog audience measurement cookie, which recognizes your browser from one visit to the next to count visits and page views.

We use no advertising cookies. The pages you visit are measured by PostHog, through our own domain: page address, where you came from, device and browser type, approximate region. We record neither your clicks nor your screen. The steps of your journey are recorded by our servers (see "Who we share your information with"). The payment page, hosted by Stripe, and the Cloudflare Turnstile security check follow their own policies.

6. Where your information is kept

Your account, profile, allergies, plans and billing data are kept in Canada, in the Montréal region, by Supabase (database and authentication). The site's pages are served by Vercel, whose functions also run in the Montréal region.

Some providers process information outside Quebec and Canada, as explained in the next section.

7. Who we share your information with

We only share information with the providers that help us offer the service, to the extent their mandate requires. Each is bound by contract and may only use it for our purposes. Several are located outside Quebec:

• Trigger.dev (task automation, United States and Europe): to assemble your plan, reads your profile criteria, including your allergies, linked to a technical identifier, never to your name or email address. This link is only used in memory, during the calculation, and is never written to its logs.
• Google, Gemini API (creation of recipes and their photos, United States): receives only anonymous criteria (flyer and week, speed, recipe type, budget per serving, kitchen equipment, allergens and foods to avoid), with no identifier or link to you.
• Google Maps Platform, Geocoding and Places APIs (search for nearby grocery stores, United States): receives your postal code when you enter or change it. The only Google data we keep is each store's identifier.
• Google (sign-in with Google, if you choose it): authenticates you and sends us your email address and basic profile.
• Stripe (payments, United States and Canada): receives your email address, your subscription and the payment information you give it directly.
• Resend (sending the service's emails, United States): receives your email address and the content of the address confirmation, password reset and password changed emails.
• PostHog (analysis of how the service is used, United States): receives your email address, your profile (including your postal code, your allergies and the foods you avoid), your subscription, the steps of your journey and the pages you visit, as well as a copy of your plans and of your billing data, to help us understand how the service is used and improve it.
• Loops (sending the helpful emails, United States): receives your email address, your profile (including your postal code, your allergies and the foods you avoid), your subscription and the steps of your journey, to send you relevant emails.
• Flipp and Apify (retrieval of flyers, United States): receive the postal codes of the areas served, to get the grocery stores' flyers, with no identifier or link to any person.
• Cloudflare Turnstile (bot protection): receives your IP address and browser signals on the sign-up, sign-in and reset forms.
• Supabase (database, authentication and recipe photos, in Canada) and Vercel (site hosting, functions in Canada): host the service. Vercel, an American company, may process technical data, such as your IP address, in its global network.

Before sharing personal information outside Quebec, we assess the privacy-related factors, including the sensitivity of the information, the purpose of its use, the protection measures and the applicable legal framework, and we govern the sharing with a written agreement.

We may also share information when the law requires it, for example at the request of a competent authority.

8. How long we keep it

We keep your information only as long as needed:

• past plans (meals, checked ingredients and notes): deleted once the second week has passed;
• profile and preferences: kept as long as your account exists;
• inactive account: deleted after 2 years without signing in;
• account closed at your request: entirely erased, including at PostHog and Loops, except the billing records the law requires us to keep;
• billing records: kept as long as tax rules require, about 6 years.

Recipes, flyers and deals are not personal information: they are not linked to anyone and serve all users.

9. How we protect it

We apply security measures suited to the sensitivity of the information: encrypted connections (HTTPS), access to your data limited to your account by rules enforced in the database, passwords never stored in plain text, access keys kept on our servers only, and our team's access limited to what is necessary.

10. Your rights

At any time, you can:

• ask to see the information we hold about you;
• have inaccurate or incomplete information corrected (most of it can be changed directly in your preferences);
• withdraw your consent, in particular to the use of your allergies;
• ask us to close your account and erase your information;
• receive your information in a structured, commonly used technological format;
• find out how your information is used and who it is shared with.

To exercise these rights, write to [FILL: contact email]. We will reply in writing within 30 days. We may need to verify your identity before acting on your request.

If you are not satisfied with our answer, you can file a complaint with the Commission d'accès à l'information du Québec.

11. Confidentiality incidents

If a confidentiality incident occurs (unauthorized access, use or disclosure, or loss of information), we promptly take the necessary steps to reduce its consequences. If it presents a risk of serious injury, we notify the Commission d'accès à l'information and the people concerned. We keep a register of all incidents.

12. Minimum age

The service is intended for adults: you must have reached the age of majority to create an account.

13. Changes to this policy

We may update this policy. The date of the last update appears at the top of the page. If there is a significant change, we will let you know by email or in the service before it takes effect.

14. Contact us

For any question about this policy or your information: [FILL: privacy officer name or title], Mataba Corp, [FILL: operator postal address], [FILL: contact email].