Privacy Policy

We collect the following categories of information:

• Account information: full name, email address, password (hashed)
• Organisation data: organisation name, membership, role
• Usage data: recipes, specifications, ingredients, and formulation drafts you create
• Payment data: M-Pesa transaction references for subscription billing (we do not store full payment credentials)

We use cookies only for session management and authentication. These are secure, httpOnly cookies used to keep you signed in and verify your identity across requests. We do not use cookies for advertising, tracking, or analytics purposes.

• To provide and maintain the Service, including authentication and session management
• To process subscription payments via M-Pesa
• To send verification emails, password reset links, and important account notifications
• To improve the Service and troubleshoot issues

We do not sell your personal data. We may share information with third-party service providers strictly necessary to operate the Service, including:

• Email delivery providers (for verification and notification emails)
• Payment processors (for M-Pesa transaction processing)
• Hosting and infrastructure providers

We may also disclose information where required by law or to protect our legal rights.

Your data is stored on secure cloud infrastructure with encryption in transit. Passwords are hashed and never stored in plaintext. Authentication uses signed JSON Web Tokens for better security.

We retain account and organisation data for as long as your account is active. If you close your account, we may retain certain records as required for legal, accounting, or legitimate business purposes.

You may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Withdraw consent where processing is based on consent

To exercise these rights, contact us via the details provided within the Service.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors.

We may update this Privacy Policy periodically. Material changes will be communicated via the Service or by email where appropriate.

For privacy-related questions, please reach out via the contact details provided within the Service.