Privacy Policy

The short version

Shalotte helps you cook smarter using what's already in your kitchen. To do that, we store your kitchen inventory, equipment, meal history, and preferences. We use AI (Anthropic's Claude, plus OpenAI for turning voice recordings into text) to generate recipes and parse voice input. Your data is sent to their API but never used to train AI models. We don't sell your data. Ever. You can delete your account and all your data at any time.

What we collect and why

Account information

Email address, name, password (encrypted by Supabase Auth). If you use Sign in with Apple, we keep an encrypted server-side revocation credential so Apple access can be disconnected when you delete your account.

Used to create your account and authenticate you. Legal basis: contract performance.

Kitchen data

Inventory items (food, zones, quantities, expiry dates), kitchen equipment (names, brands), dietary preferences, cuisine preferences, household size, cooking skill level.

This is the core of Shalotte: we need to know what's in your kitchen to suggest what to cook. Legal basis: contract performance.

Diet choices that reveal health or religion

Gluten-free, dairy-free, nut-free, halal and kosher, if you choose them, and the date and time you gave your explicit consent to us keeping them.

These can reveal health information (an allergy or intolerance) or your religion or beliefs, which the law treats as special category data. We keep them only with your explicit consent. Legal basis: explicit consent (Art. 9(2)(a) UK GDPR / GDPR), alongside contract performance for the rest of your kitchen data. We use them only to filter your recipes, and send them to Anthropic as a filtering rule when suggesting meals. They are never sent to our analytics. Without your consent we do not save them. You can withdraw consent at any time in Settings, under Dietary needs, by unticking the consent line: the choices and the consent record are then deleted. Vegetarian, vegan and pescatarian are ordinary preferences and need no separate consent.

Cooking activity

Meal history (what you cooked, when, ratings, portions), planned meals, meal reservations, shopping lists and items.

Used to avoid repeating meals, learn your preferences over time, and manage your shopping list. Legal basis: contract performance.

Food preferences

Purchase patterns, preferred zones, quantities, units, frequently bought items.

Used to personalise suggestions and speed up adding items. Legal basis: legitimate interest (improving your experience).

Voice data

Audio recordings from voice input, the transcripts they produce, and the parsed results.

Used to convert your speech into inventory items. The audio is sent to OpenAI for transcription and is not stored by us; the resulting transcripts are logged temporarily for debugging and accuracy improvement. Legal basis: consent (you choose to use voice input).

Usage data

API call logs (which features you use, token counts, timestamps). No IP addresses stored in our database.

Used to monitor costs, detect abuse, and improve the service. Legal basis: legitimate interest.

Error reports

If a page in Shalotte breaks, a report of the error: the error message and the place in our code it came from, the page address without anything after it, your browser, operating system and device type, and your account ID if you are signed in. Before a report leaves your device we remove email addresses, tokens, web-address parameters and any quoted text, so nothing from your kitchen, your recipes or what you typed is in it.

Used only to find and fix what broke. Sent to PostHog (EU), and only if you accepted analytics: decline or withdraw that consent and no error report is ever sent. Kept for 12 months. Legal basis: consent.

Feedback

Any messages you send us through the app.

Used to improve Shalotte. Legal basis: consent.

Signup attribution

If you arrive from a link carrying campaign parameters (utm_source, utm_medium, utm_campaign, and for search ads utm_term and utm_content: the search keyword and ad group), an advertising click identifier such as fbclid (Meta) or gclid (Google), or a referral code, we store those values and the page you landed on against your account, once, at signup.

Used to understand which channels bring people to Shalotte. They are stored first-party, are never sent back to the ad network, and are never used to build a profile of you. Legal basis: legitimate interest (measuring how people find us). Email us and we will remove them from your account.

Household sharing

If you create or join a household: the household name, who its members are and in what role, and the invite code used to join.

A household exists so the people you cook with share one kitchen. While you are a member, your inventory, shopping list and meal plan are visible to — and editable by — every other member of that household. Leaving the household returns you to your own kitchen. Legal basis: contract performance.

Consent and legal records

Whether you accepted the terms at sign-up and when, the state of your analytics consent and when it last changed, when you consented to us keeping diet choices that reveal health or religion, and whether you have unsubscribed from lifecycle email.

We keep these so we can show that consent was actually given or withdrawn, and so your email choice is honoured. Legal basis: legal obligation (Art. 7(1) GDPR — we must be able to demonstrate consent). They are deleted along with your account.

How we use AI

Shalotte uses Anthropic's Claude API to generate recipe suggestions, parse voice input, and power the Sous Chef feature. When you use these features:

• Your inventory, equipment, preferences, and recent meal history are sent to Claude's API to generate personalised results.
• Anthropic automatically deletes API inputs and outputs from its systems within 30 days. Content its automated trust-and-safety systems flag as a policy violation can be kept longer.
• Your data is never used to train AI models. Anthropic's API terms explicitly exclude training on API customer data.
• Voice input is a two-step process. The audio is first sent to OpenAI (gpt-4o-mini-transcribe) to be turned into text; OpenAI processes API audio without using it to train their models and does not retain it for training. The resulting transcript is then sent to Claude (Haiku model) for parsing into inventory items. Shalotte never stores the audio itself.
• Photos you take for photo inventory are sent to Claude to recognise the food items in them, processed transiently in memory, and never stored by Shalotte.
• Recipes you import are sent to Claude to read the recipe: a recipe photo is processed transiently in memory and never stored; for a recipe video link, Shalotte fetches the video's spoken transcript and one still frame and sends those. You review the result before anything is saved.
• When you tap Cook Now, Shalotte may draw a small picture of the dish. Only the dish name and a few of its main ingredients are sent to fal.ai (Features & Labels, Inc.), which draws it and hands it straight back without storing it; nothing about you or your kitchen goes with it. Claude then checks the picture really shows that dish, and if it does not, no picture is shown. Shalotte keeps each dish's picture under the dish name and main ingredients only, so the next cook of that dish gets the same picture.
• None of this is sent until you allow AI features, and you can withdraw that at any time in Settings, under Privacy and data.

We also use OpenWeatherMap to fetch weather data for weather-appropriate meal suggestions. We do not collect or process your location: the lookup uses one fixed set of coordinates for everyone, and no personal data of any kind is sent to OpenWeatherMap.

Who we share data with

We use a small number of trusted service providers to run Shalotte. We don't sell, rent, or trade your personal data with anyone.

All providers are GDPR-compliant or operate under adequate safeguards for international data transfers.

Data storage and security

• Your data is stored in Supabase (hosted on AWS in the EU, region eu-west-1).
• All data is encrypted in transit (TLS) and at rest.
• Row-Level Security (RLS) is enabled on every table. You can only access your own data.
• Passwords are hashed by Supabase Auth (bcrypt). We never see or store plaintext passwords.
• We don't store payment card details. Stripe handles all payment processing directly.

Your rights (GDPR)

You have the right to:

• Access your data: your profile and preferences are visible in Settings. For a full copy of everything we hold — inventory, meal history, voice logs, email logs — email us and we will send it.
• Correct your data: edit your profile, inventory, and preferences at any time in the app.
• Delete your data: use the "Delete Account" button in Settings. This permanently removes all your data from our systems within 24 hours. Backup retention: Supabase backups containing deleted data expire within 7 days.
• Export your data: email us and we'll provide a copy. (Self-service export is planned for a future release.)
• Object to processing: email us to discuss.
• Withdraw consent: for optional features like voice input, simply stop using them. For marketing (if any), unsubscribe at any time.

To exercise any right, email privacy@shalotte.com or use the in-app controls.

We respond to all requests within 30 days as required by GDPR.

Cookies and local storage

Shalotte uses:

• Authentication cookies: to keep you signed in (essential, no consent needed).
• sessionStorage: to cache recipes temporarily for instant loading (cleared when you close the tab).

Product analytics cookies (PostHog, EU-hosted) and advertising measurement tags (Meta, Reddit, Pinterest, Google Ads) are set ONLY if you opt in. You're asked first, and declining carries the same weight as accepting. Decline, and none of them loads at all: no analytics cookie, no advertising tag, and nothing about you is sent to any ad network from our servers either.

What the advertising tags do when you accept: they let the network that showed you an ad know that the click became a sign-up, or a first cook. We send a hashed (irreversible) form of your email address so the network can match its own click, and nothing else — no inventory, no recipes, no meal history. We do not use Google Analytics.

Data retention

• Account data, including any encrypted Apple revocation credential: Kept while your account is active. Deleted within 24 hours of account deletion.
• Voice parse logs: Retained for 90 days for debugging, then automatically purged.
• API usage logs: Retained for 12 months for cost monitoring, then purged.
• Product analytics events and error reports (PostHog, EU): Retained for 12 months, then removed by PostHog. Only collected at all if you opt in.
• Anthropic API inputs and outputs: deleted within 30 days (managed by Anthropic, not us); longer if flagged for a policy violation.
• fal.ai: nothing. Each dish picture is returned directly and fal does not store it. Shalotte keeps the picture under the dish name and main ingredients only, with no link to any person.
• Vercel server logs: 30 days (managed by Vercel).
• Supabase backups: Rolling 7-day window. Deleted data falls out of backups within 7 days.

Children's privacy

Shalotte is for adults only: you must be 18 or older to create an account. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has created an account, please contact us and we'll delete it immediately.

International data transfers

Your account and app data itself stays in the EU: the Supabase database is hosted in AWS eu-west-1, and product analytics run on PostHog's EU instance.

Some of our service providers are US-based, so data sent to them leaves the UK/EEA:

• Anthropic: kitchen context for the AI features.
• OpenAI: voice recordings, for transcription only.
• fal.ai (Features & Labels, Inc., San Francisco): dish names and main ingredients, to draw the meal picture. This is not personal data, and its data processing addendum incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Agreement.
• Vercel: server requests and log data.
• Resend: your email address, for every sign-up, password-reset and lifecycle email. Resend is operated by Plus Five Five, Inc. (San Francisco). Its data processing agreement makes transfers under the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, and Resend is certified under the EU-U.S. Data Privacy Framework and its UK Extension.
• Stripe: payment processing, once subscription billing is switched on.
• Cloudflare: DNS queries and traffic metadata, as infrastructure sitting in front of every request.

• Meta, Reddit, Pinterest and Google Ads: a hashed email address and the fact that a sign-up or first cook happened — only if you accepted the advertising measurement described under “Cookies and local storage”.

Because we are a UK controller, each of these transfers runs on that provider's own data processing agreement, which incorporates the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum (or the International Data Transfer Agreement). Anthropic, OpenAI, fal.ai, Vercel, Supabase, PostHog, Resend, Stripe and Cloudflare all provide one.

Changes to this policy

We'll update this policy if our data practices change. Material changes will be communicated via email or an in-app notice. The "last updated" date at the top always reflects the current version.

Contact

Data controller:

SHALOTTE LTD 71-75 Shelton Street Covent Garden London WC2H 9JQ United Kingdom

Registered in England and Wales, company number 17441325.

Email: privacy@shalotte.com

Shalotte is established in the United Kingdom, so the UK GDPR and the Data Protection Act 2018 are our primary regime and our supervisory authority is the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk. You have the right to complain to it.

We also offer Shalotte to people in the EU and the EEA, so the EU GDPR applies to us as well (Art. 3(2)). If you live there, you can complain to the supervisory authority of your own country instead.

Our representative in the EU (Art. 27 GDPR):

Günther Wolf Dieselstraße 10 61118 Bad Vilbel Germany

Email: privacy@shalotte.com

We have no establishment in the EU, so we have appointed this representative under Art. 27 GDPR. People in the EU and the EEA, and supervisory authorities, can contact the representative in addition to us, or instead of us, on any question about how we process personal data.