1. Controller and contact

Data controller: [CONTROLLER DETAILS TO BE COMPLETED: legal name, registered address, VAT/tax ID].

For any privacy, data or support request write to support@piattami.com. No Data Protection Officer has been appointed; should one be appointed, this policy will be updated.

2. Account and sign-in

Email and password sign-up: we collect your name, email address and password, stored only as a cryptographic hash (we cannot read it). We also handle password recovery through a code sent by email.

Sign in with Google: if you choose "Continue with Google" the authentication service gives us your email address, name and, if available, profile picture. We never receive your Google password.

Sign-in security: we keep active sessions and failed login attempts (with IP address) for as long as needed to limit abuse and brute-force attacks.

Legal acceptance: we record the date on which you accepted the privacy policy and the terms.

3. Your kitchen data

Pantry, fridge and freezer: ingredient names, quantities, units, category, storage location and expiry dates, including the "used up" state.

Shopping list: items added manually or generated from recipes, category grouping and items ticked as purchased.

Recipes and app usage: generated and saved recipes, favourites, feedback (liked / not liked), the "I cooked this" history with the quantities deducted from your pantry, the meal planner and anti-waste features (expiry alerts and suggestions to use things up).

Preferences and settings: household size, dietary preferences (e.g. vegetarian, vegan, gluten-free), allergies and intolerances, disliked ingredients, cooking skill level, typical time available, language, measurement system and notification preferences.

Allergy and intolerance information is handled with particular care because it may relate to your health: we use it exclusively to exclude ingredients from the recipes we suggest, based on the consent you give when entering it.

4. Photos, receipts, barcodes and QR codes

Barcode and QR scanning: we process the scanned code to identify the product and, for a shared shopping list, the sharing code/link.

Receipt scanning and recognition of foods, expiry dates and fridge contents from a photo: when you use one of these features, the picture you take is sent to our systems and to the AI provider performing the recognition, in order to return the foods, quantities and dates it detected.

Photos and receipts may contain information about the food you bought and, on receipts, details such as store, date, prices and other printed elements. We use these images only to provide the recognition feature you requested, never for profiling or advertising.

Images are not published and are never shared with other users. Please avoid photographing documents, payment cards or any information not needed for food recognition.

5. AI recipe generation

To generate recipes, menus, nutrition values and estimated calories we send the AI provider only what is necessary: the list of available ingredients and their expiry dates, the filters you chose (meal type, time, difficulty, servings), your dietary preferences, allergies and disliked ingredients, your language and, for photo features, the image to analyse.

We never send your name, email address or payment data to the AI provider.

AI-generated content is a suggestion: always check ingredients if you have allergies or intolerances, and treat nutrition information as an estimate with no medical value.

6. Notifications and reminders

If you enable expiry reminders we show in-app alerts and, with your browser or device permission, notifications about ingredients about to expire. You can turn them off at any time in your profile or in your device settings.

We send service emails: welcome on sign-up, password recovery and account deletion confirmation.

7. Pro plan and payments

Piattami may offer a paid Pro plan with features beyond the free tier. Payments on the web are handled by Stripe; in the mobile stores purchases are handled by the Apple App Store and Google Play, with RevenueCat as the subscription management service.

We never process or store your card details: they are collected directly by the payment provider. We only receive the technical subscription identifiers and its state (plan, active/expired/cancelled, validity period, free trial already used), which we need to unlock Pro features on your account.

Subscriptions are managed and cancelled from the billing portal available in the app (web) or from your App Store / Google Play subscription settings (mobile).

8. Purposes and legal bases

Performance of a contract (Art. 6.1.b GDPR): creating and running your account, pantry, recipes, shopping list, planner, favourites, Pro features and support.

Consent (Art. 6.1.a and Art. 9.2.a GDPR): allergy and intolerance data, photo and scanning features, notifications. You can withdraw consent at any time by turning the feature off or removing the data.

Legitimate interest (Art. 6.1.f GDPR): service security, abuse prevention, technical diagnostics and improving features in aggregate form.

Legal obligations (Art. 6.1.c GDPR): tax and accounting duties related to any payments.

9. Providers and third parties

Infrastructure and hosting providers for the application and the database.

AI providers for recipe generation and image recognition (receipts, foods, expiry dates, fridge contents).

Transactional email provider (welcome, password recovery, confirmations).

Payment and subscription providers: Stripe (web), Apple App Store and Google Play with RevenueCat (mobile).

Authentication service for Google sign-in.

These providers act as processors, only to deliver the service and under agreements that forbid using your data for their own purposes. We do not sell your personal data.

10. International transfers

Some providers (notably AI, email, payments and infrastructure) may process data outside the European Economic Area, for example in the United States. Such transfers rely on GDPR safeguards, such as the European Commission's standard contractual clauses or an adequacy decision.

11. Data retention

We keep your account data and content (pantry, recipes, shopping list, history, preferences) for as long as your account is active.

Images sent for recognition are processed for as long as needed to return the result and are not kept as a personal gallery.

Technical security data (sessions, login attempts) is kept for a short period, only as long as needed to protect the service.

Payment data is retained by the payment providers under their own legal obligations; we keep the subscription state for as long as required for administrative purposes.

12. Deleting your account and data

You can delete your account in the app: Profile → Support & legal → "Delete account". We ask for a double confirmation (the word DELETE and your account password) and, if you have an active Stripe Pro subscription, it is cancelled immediately.

Deletion removes your account and its data: pantry, recipes, menus, favourites, shopping list, planner, history and preferences. This is irreversible and we keep no courtesy copies.

Before deleting you can download a copy of your data as JSON from Profile → "Download your data".

If you have trouble with the in-app flow, write to support@piattami.com.

13. Sharing your shopping list

If you create a shopping-list sharing link, whoever has the link can see and tick the items on that list without accessing your account and without seeing any of your other data. The link stays valid until you revoke it in the app: share it only with people you trust.

14. Security

We use encrypted connections (HTTPS), hashed passwords, sessions with protected cookies (HttpOnly and Secure), login rate limiting and strict data separation between users: the backend always checks that you can only reach your own data.

Provider keys and technical secrets are stored server-side only, never in the application running in your browser or on your phone.

15. Your rights

You have the right to access your data, rectify it, erase it, restrict or object to its processing, receive it in a portable format and withdraw any consent you gave.

You can exercise these rights in the app (editing your profile, downloading your data, deleting your account) or by writing to support@piattami.com. You also have the right to lodge a complaint with your competent supervisory authority — in Italy, the Garante per la protezione dei dati personali.

16. Children

Piattami is not intended for children under 16. Alcoholic cocktail features require an age confirmation and can be disabled.

17. Changes to this policy

If we change this policy we update the date at the top and, for material changes, we tell you in the app or by email.