Privacy Policy

The short version

Your recipes, your ingredient prices, and your customer records are yours. We don’t sell your data, we don’t run ads, and we don’t use advertising or tracking cookies. We collect the minimum we need to run the app, you can delete everything at any time, and you can ask us for a copy whenever you want one.

Who we are

CakeSheet is operated by an independent sole trader based in Bulgaria, acting as the data controller for the account data described below. For any privacy question, or to exercise any of the rights listed further down, email us at info@cakesheet.app.

What we collect

Your account

Your email address and a securely hashed password. We never see or store your password in readable form. If you sign in with a magic link or reset your password, we process the associated email.

What you put into CakeSheet

Everything you enter: recipes, ingredients, materials, suppliers, prices, orders, business settings, and any images you upload. This also includes the customer records you create — see the next section, because that data belongs to other people.

Technical data

Aggregate, cookieless page-view and performance measurements, so we can see which pages are slow or broken. These are not tied to your identity and are not used to profile you or to target advertising. Our hosting provider also processes standard server logs, including IP addresses, for security and reliability.

About your customers’ data

When you add a customer, you may store their name, email address, phone number, postal address, date of birth, preferred contact method, and free-text notes. Those people are not CakeSheet users and have no relationship with us.

For that data you are the controller and we are your processor. You decide what to collect and why; we only store and process it to provide the service to you, and we act on your instructions. That means a few practical things:

• You are responsible for having a lawful basis to record your customers’ details, and for telling them you do.
• We do not contact your customers, market to them, or use their details for any purpose of our own.
• If one of your customers asks you to correct or delete their data, you can do that yourself in the app at any time.
• If you need a written data processing agreement, email us and we’ll provide one.

Cookies

We use only the cookies required to keep you signed in and to check that your session is still valid. There are no advertising cookies, no third-party tracking cookies, and no cross-site profiling. Our analytics are cookieless by design. Clearing these cookies signs you out; it does not delete any of your data.

Who processes data on our behalf

We keep this list short on purpose. Each of these providers is bound by contract to process data only as instructed:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting, cookieless analytics, and performance measurement.
• Resend — sending transactional email such as confirmation and password-reset messages.

Some of these providers operate infrastructure outside the European Economic Area. Where that happens, transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

We do not sell personal data, and we do not share it with advertisers or data brokers. We will disclose data only where we are legally required to.

How long we keep your data

We keep your data for as long as your account is open. When you delete your account, your recipes, ingredients, orders, customers, and uploaded images are permanently deleted — not hidden or archived. Backups roll off within 30 days. We may retain a minimal record of the deletion itself where we need it to meet a legal obligation.

Your rights

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Most of this you can do yourself from your account settings, including permanent deletion. For anything else, email us and we’ll respond within one month.

If you think we’ve handled your data badly, please tell us first — we’d rather fix it. You also have the right to complain to the Bulgarian Commission for Personal Data Protection, or to the supervisory authority in the EU country where you live.

Changes to this policy

If we change anything meaningful, we’ll update the date at the top of this page and let account holders know by email before the change takes effect. Our Terms of Service explain the rest of the arrangement.