1. Data controller
The controller of the processing of personal data is the publisher of Spuma, who can be reached at [email protected].
2. Data collected
2.1 Account data (registered users)
| Data | Source | Purpose |
|---|---|---|
| Sign-up / Google OAuth | Authentication, transactional communication | |
| Password (hashed) | Email/password sign-up | Authentication |
| Google name / editable first name and last name | Google OAuth / Onboarding | Personalisation of the interface |
| Date of birth (optional) | Onboarding | Birthday promotion (coming in Phase 3) |
| Country (optional) | Onboarding | Market statistics, default units (g/oz) |
| Experience level (optional) | Onboarding | Educational adaptation of the app |
| Acquisition source (optional) | Onboarding | Marketing analytics |
| Language + preferred unit | Preferences in My Account; the interface language, sent to the account at sign-up and then whenever you change it | UX personalisation (the interface language is also stored at Supabase, in your account data, so that we can send you the emails relating to your account in your language) |
| Saved recipes | Created by the user | Multi-device synchronisation |
| Joining the waitlist for the Pro and Premium plans (optional) | “Notify me when available” button on the plans page, from your account | To let you know when these plans open, at your account’s email address |
2.2 Technical data (all visitors)
- IP address (anonymised by Cloudflare): abuse protection, traffic statistics.
- Browser type, OS, language: adaptation of the display.
- Supabase connection data: timestamps, session ID (security).
2.3 Data stored locally (localStorage)
- Chosen language: to keep your choice between visits.
- Recipe in progress: so that you do not lose your work if you close the tab.
- Saved recipes (anonymous User): stored 100% locally in your browser.
2.4 Technical error reports (all visitors)
When a technical error occurs in the application (a screen that does not display, an operation that fails), a report is automatically sent to our database so that we can fix the fault. It contains only:
- the error message and the place in the code where it occurred, truncated, with web addresses cut off before their parameters, and any email address or login token masked;
- the version of the application, the open screen, the browser family (for example Firefox), the interface language and the page path.
The report contains no account identifier, no email address and no IP address, and it is sent without your session token, even when you are logged in to your account. No cookie is set. At most three reports are sent per tab, never twice for the same error: for as long as the tab is open, your browser keeps short hashes of the errors already reported (see the Cookie Policy). Reports are deleted after 30 days. Legal basis: our legitimate interest in ensuring the proper functioning of the Service (Art. 6(1)(f)). Like any request, the report is sent through Supabase’s infrastructure, which logs the IP address of the request and keeps it for its own retention period (row “Connection logs (Supabase)” in section 4).
2.5 Exit questionnaire (account deletion)
When you delete your account, a questionnaire asks why you are leaving. Answering is optional: you can delete your account without ticking anything, in which case nothing is recorded. If you answer, we record the reasons you ticked and, where applicable, your free text, together with the plan, the language, the country (if you provided it) and the age of your account at the time of deletion, without any account identifier or email address. These answers help us understand why people leave and improve the Service. Do not write anything in the free text that could identify you. The ticked reasons are kept without time limit; the free text is automatically erased after 12 months. Legal basis: our legitimate interest in improving the Service (Art. 6(1)(f)).
3. Legal bases for processing (GDPR Art. 6)
- Consent (Art. 6(1)(a)): registration for the Service, joining the waitlist for the Pro and Premium plans.
- Performance of the contract (Art. 6(1)(b)): authentication, provision of the Service.
- Legitimate interest (Art. 6(1)(f)): improvement of the Service, security, technical error reports, aggregated and anonymised statistics.
4. Retention period
| Data | Period |
|---|---|
| Active account data | As long as the account exists |
| Data after account deletion | Immediate erasure (DB cascade), except the answers to the exit questionnaire, kept with no link to the account (section 2.5), and the emails sent to the account’s email address, which Resend, our processor, keeps for up to 30 days, then 7 days in its backups (section 5) |
| Exit questionnaire: ticked reasons | No time limit (no link to the account) |
| Exit questionnaire: free text | 12 months (automatic erasure) |
| Connection logs (Supabase) | 90 days maximum |
| Technical error reports | 30 days (automatic erasure) |
| Technical data (IP anonymised by Cloudflare) | 30 days |
| Data in localStorage | Until manually erased by the user |
5. Processors and recipients
Spuma uses the following processors, all GDPR-compliant:
- Supabase Pte. Ltd. (Singapore, hosting in the European Union, in Ireland; standard contractual clauses of the European Commission) — database, authentication.
- Cloudflare Inc. (USA, standard contractual clauses of the European Commission) — front-end hosting, CDN, DNS, abuse protection, and Cloudflare Web Analytics (cookieless, anonymised audience measurement, without creating any individual profile — details in the Cookie Policy).
- Resend (USA, standard contractual clauses of the European Commission) — service for sending the emails relating to your account (sign-up confirmation, sign-in link, password reset, email address change, code to change your password, account deletion confirmation); it keeps sent emails and their logs for 30 days, then 7 more days in its backups.
- Google Cloud (USA, standard contractual clauses of the European Commission) — OAuth provider for Google sign-in (if chosen by the user).
No data is sold to commercial third parties. No data is used for advertising purposes.
6. Your rights (EU GDPR, US CCPA, UK GDPR, Brazil LGPD)
You have the following rights regarding your personal data:
- Right of access: obtain a copy of all your data.
- Right to rectification: correct inaccurate data (can be edited directly in My Account).
- Right to erasure (“right to be forgotten”): complete deletion of your account and its data.
- Right to data portability: export of your recipes in a standard format (CSV/JSON).
- Right to object: refuse processing for analytics or communication purposes.
- Right to restriction of processing: temporarily restrict the use of certain data.
- Right to withdraw your consent: at any time, for processing based on your consent, without affecting the lawfulness of that processing before the withdrawal (GDPR, Art. 7(3)).
- For people residing in California (CCPA): right to know, right to deletion, right not to be discriminated against.
- For people located in Brazil (LGPD): rights equivalent to those of the GDPR, contact via the same email address.
To exercise your rights: send an email to [email protected] stating the subject of your request. You will receive a reply without undue delay and in any event within one month of receipt of your request. This period may be extended by two further months where necessary, taking into account the complexity and number of the requests. In that case, we will inform you of the extension, together with the reasons for the delay, within one month of receipt of your request (GDPR, Art. 12(3)).
In the event of a dispute or an unsatisfactory reply, you may lodge a complaint with the competent supervisory authority:
- France: CNIL (the French data protection authority)
- EU: the national data protection authority of your country
- UK: ICO
- USA / California: California Attorney General
- Brazil: ANPD
7. Security
Spuma implements appropriate technical and organisational measures to protect your data:
- HTTPS encrypted connection (TLS 1.3) across the entire Service.
- Password hashing (bcrypt via Supabase Auth).
- Postgres Row-Level Security (RLS): each user can access only their own data.
- Standard OAuth 2.0 authentication for Google (the Google password is not stored).
- Daily automatic Supabase backups (recovery possible in the event of an incident).
8. Data of minors
Spuma is intended for people of legal age: cold-process soapmaking involves handling caustic soda, a corrosive product. We do not knowingly collect data relating to minors. If you think a minor has created an account, write to us: we will delete it.
9. Changes to this policy
Spuma reserves the right to amend this policy. Substantial changes will be notified by email to registered Users. The date of the update appears in the header.
10. Contact
For any questions: [email protected]