Privacy Policy

1. Who we are

Umami Guru ("we", "us") operates the cooking platform at https://umami.guru and the Umami Guru mobile application. We are the data controller for the personal data described here.

Umami Guru is operated from the Netherlands. Data protection contact: umami.guru@outlook.com. Our servers are located in the Hetzner data centre in Germany (European Union).

2. What we collect

Account data. You sign in with Google, Apple or Pinterest. We receive and store your email address, your display name, and a link to your avatar. We never receive or store your password. If you sign in with Apple and choose to hide your email, we only ever see the relay address Apple gives us. Pinterest does not give us an email address at all: for a Pinterest sign-in we store your Pinterest account identifier, your Pinterest username and your profile picture, and we generate an internal placeholder address for your account.

Data you create in the Service. Interface language; cooking progress; personal notes on recipes; your adjustments to recipes such as servings; dish photos you upload; the country and city you set for the shopping-basket feature; your taste profile answers; and your assistant settings.

Purchase data. Which product you bought, the amount, the date, and the payment status. We do not collect or store card numbers or bank details — see section 5.

Usage data. A monthly counter of your AI actions, used to apply the free allowance and to bill paid plans correctly.

Technical data. A session cookie (section 8), and standard server logs containing your IP address and request time, kept for security and fault diagnosis. When advertising is shown, advertising networks also process technical data — see section 6.

3. Why we use it, and on what legal basis

• To provide the Service — your account, cooking progress, notes, photos and settings. Legal basis: performance of our contract with you.
• To run AI features — see section 4. Legal basis: performance of our contract.
• To process purchases and manage access to paid plans. Legal basis: performance of our contract, and our legal obligations for tax and accounting records.
• To show advertising to users on the free plan. Legal basis: your consent where consent is required (see section 6); otherwise our legitimate interest in funding a service that is otherwise free.
• To understand how the Service is used in aggregate. Legal basis: our legitimate interest in improving the Service. See sections 6a and 7.
• To keep the Service secure and stable and to prevent abuse. Legal basis: our legitimate interest.
• To answer your support messages. Legal basis: performance of our contract and our legitimate interest.

We do not sell your personal data. We do not carry out profiling that produces legal effects for you.

4. AI features

Several features — the kitchen assistant, ingredient substitutions, the shopping basket, smart search and image processing — are powered by large language models operated by third parties. To make them work, the content of your request is sent to those providers:

OpenRouter, Inc. (United States) — processing of text requests by language models.

Google Cloud (Google LLC) — image processing and generation.

We send only the content needed to fulfil the request. We do not send your name or email address alongside these requests. Transfers outside the European Economic Area rely on the Standard Contractual Clauses and equivalent mechanisms operated by these providers.

4a. Connecting your Pinterest account

You can connect your own Pinterest account, either by signing in with Pinterest or from your profile page. The connection uses Pinterest’s official OAuth 2.0 flow: you authorise us on Pinterest’s own screen, and Pinterest sends us an access token. We never ask for, see or store your Pinterest password, and we do not use Pinterest session cookies.

What we store. The access and refresh tokens Pinterest issues for you, your Pinterest account identifier, your username and profile picture, the permissions you granted, and a record of the recipes you saved to Pinterest through us (recipe, board and Pin identifier).

What we do with it. Only what you ask for in the moment: read the list of your boards so you can pick one, create a board when you ask us to, and save a recipe to your board as a Pin. We do not read your Pins, we do not post anything you did not ask for, and we do not use your Pinterest data for advertising or analytics.

How to disconnect. Use Disconnect in your profile — we delete the stored tokens immediately. You can also revoke our access on Pinterest under Settings → Security → Apps. If Pinterest sign-in is the only way you access your Umami Guru account, deleting the account (section 12) removes your data with it.

5. Payments

Purchases made on our website are processed by Lemon Squeezy, which acts as the merchant of record and seller of record. Lemon Squeezy collects the payment details and billing information necessary to take payment and to calculate and remit VAT and sales tax, and is an independent controller for that data. We receive only the confirmation that a payment succeeded, the product, the amount, and an order reference.

Purchases made inside our iOS application are processed by Apple under Apple's own privacy policy. We receive a validated receipt, not your payment details.

We never see, receive, or store your full card number.

6. Advertising

The Service may show advertising to users on the free plan. It is delivered by third-party advertising networks, which may process technical data such as your IP address, device and browser characteristics, an advertising identifier, the pages you view, and your interactions with advertisements.

If you are in the European Economic Area or the United Kingdom, we ask for your consent through a consent banner before any advertising that involves tracking or profiling. If you decline, you will still see advertising, but it will be non-personalised. You can change or withdraw your choice at any time via Privacy settings in the footer of every page.

On iOS, Apple's App Tracking Transparency prompt asks separately whether apps may track you across other companies' apps and websites. If you decline, we do not access the advertising identifier and advertising is non-personalised.

Paid plans remove advertising entirely. For customers on Premium or Lifetime we do not merely hide advertisements — the advertising code is never loaded, so those networks receive nothing at all.

6a. Ezoic

Advertising on this site is delivered by Ezoic, which also provides website optimisation and analytics services. Ezoic acts as an independent controller for the data it processes, and its own privacy policy applies alongside ours.

Through Ezoic and its advertising partners, the following may be collected and processed:

• Cookies, unique identifiers, web beacons, embedded scripts and similar tracking technologies.
• IP address and approximate geographic location derived from it.
• Device and browser characteristics, operating system and language settings.
• Pages viewed, time on page, referring pages, and interactions with advertisements.
• Where you consent, data used to build an interest profile so that advertising shown to you is relevant.

Ezoic may share this information with its advertising partners for the purposes of serving and measuring advertising, preventing fraud, and improving the site.

Your choices. Where consent is required in your region, you are asked for it before any tracking begins, and you can change or withdraw it at any time through the consent tool available from the footer of every page. Residents of California may exercise their rights under the CCPA, including the right to opt out of the sale or sharing of personal information, through the same tool.

The full details of Ezoic’s processing, its partners, and the choices available to you are set out in Ezoic’s privacy policy and in the vendor list shown inside the consent tool.

7. Analytics

We use Google Analytics to understand how the site is used — which recipes are popular, how visitors arrive, and where the experience breaks down. Google Analytics sets cookies and processes your IP address and device information on our behalf; we have IP anonymisation enabled and we do not use it to identify you personally. Where consent is required in your region, analytics runs only after you have given it.

Ezoic additionally provides its own analytics as part of the services described in section 6a.

You can opt out of Google Analytics entirely using Google's browser add-on, or by declining analytics in our consent tool.

8. Cookies and similar technologies

• Strictly necessary. A session cookie (httpOnly) that keeps you signed in for 7 days, and a cookie that remembers your consent choice. These cannot be switched off without breaking sign-in.
• Advertising. Set by advertising networks, and only where you have consented if consent is required in your region (section 6).
• Analytics. Set by Google Analytics and by Ezoic, and only where you have consented if consent is required in your region (sections 6a and 7).

You can block cookies in your browser settings, but signing in will stop working.

9. Who we share data with

We share personal data only with the processors and partners needed to run the Service: our hosting provider (Hetzner, Germany), our AI providers (section 4), our payment providers (section 5), our advertising and optimisation provider Ezoic (section 6a), our analytics provider Google (section 7), and our email provider for transactional messages.

If you connect your Pinterest account (section 4a), the recipe content you choose to save — its title, description, link and image — is sent to Pinterest, Inc. so that it can create the Pin in your account. Pinterest is an independent controller for what it then does with that data, under its own privacy policy.

We do not share your data with third parties for their own marketing.

We may disclose data if required by law, or to establish, exercise or defend legal claims.

10. Where data is stored and how it is protected

Data is stored in a database and file storage on our own servers at the Hetzner data centre in Germany. Access is restricted, and all connections are encrypted over HTTPS.

Dish photos you upload may, after moderation, be displayed publicly on the relevant recipe page. Please do not upload anything you would not want to be public.

11. How long we keep it

Account data and content you create are kept for as long as your account exists. If you delete your account, we delete them, except where we must keep something longer by law.

Payment records are kept for the period required by tax and accounting law, typically 7 to 10 years.

Server logs are kept for a limited period for security purposes.

Consent records are kept for as long as the consent is valid, plus the period needed to demonstrate compliance.

12. Your rights

You have the right to:

• obtain a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted and your account closed;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing carried out before withdrawal;
• lodge a complaint with a data protection authority — our lead authority is the Dutch Autoriteit Persoonsgegevens, and EU residents may also complain to the authority in their own country of residence.

To exercise any of these, write to umami.guru@outlook.com. We will respond within 30 days and we will not charge you for it.

13. Children

The Service is not intended for children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with data, contact us and we will delete it.

14. Changes to this policy

We may update this policy. If a change is material we will announce it on this page and update the effective date shown above, and where the change requires it we will ask for your consent again.

15. Contact

Umami Guru

Email: umami.guru@outlook.com

Website: https://umami.guru