Privacy statement

This is a translation of the Dutch text. If the English and the Dutch versions differ, the Dutch version applies.

Here you can read which data we keep about you, what we use it for, who we share it with and how long we keep it. If you have a question, email us at info@smaquli.com.

1. Who is responsible for your data

Smaquli is a sole proprietorship (eenmanszaak), registered under the trade name Smaquli with the Dutch Chamber of Commerce (number 81178298). The address is Ceintuurbaan 84-2, 1403 AE Bussum, the Netherlands. Smaquli is responsible for your data. The law calls this the data controller: we decide why and how your data is used. We do not have a phone number; you can reach us at info@smaquli.com.

2. Which data we keep

When you use the app

• Account: your name, your email address and your password. We only keep the password as a hash (argon2id): a scrambled version from which your password cannot be read back.
• Content: your recipes, photos, notes, ratings and your shopping list.
• What you have had imported: the links, text, videos and recordings you give Smaquli so it can turn them into a recipe.
• Use: how often you import something or have AI do something, so that your plan's limits and the safeguard against misuse can work, and when you last logged in.
• Payment: the status of your payments and of your subscription. We do not keep card or bank details; those go to Mollie.
• Cookie: the session cookie smaquli_session keeps you logged in (see the cookie statement).

When you visit the website

• What you enter in the contact form.
• Your email address and your language, if you join the waiting list. No IP address.
• A log of pages that do not exist (404). It contains no IP addresses.
• Measurement data, only if you give consent (see "The website" below).

3. What we use your data for, and the legal basis

The legal basis is the reason the law (the GDPR, in Dutch the AVG) gives us for being allowed to use your data.

• Making the app and your subscription work: your account, your recipes and lists, your imports and your household. Legal basis: performance of the contract you enter into with us.
• Having recipes read, translated, converted, swapped and checked, and recordings transcribed: for this, data goes to AI models (see "Who we share data with"). Legal basis: performance of the contract.
• Payments and bookkeeping: processing your payments and keeping our books. Legal basis: performance of the contract and a legal obligation (bookkeeping).
• Your plan's limits and the safeguard against misuse, and keeping the app secure and running: we count your imports and AI actions. Legal basis: legitimate interest (that Smaquli stays secure and fair for everyone).
• Clearing out dormant free accounts: we look at when you last logged in, so that we don't keep data of people who have stopped (see "How long we keep data"). Legal basis: legitimate interest.
• Answering your question: when you use the contact form or email us. Legal basis: legitimate interest.
• Putting you on the waiting list and telling you when the app opens: Legal basis: your consent. You give it by signing up, and you can withdraw it at any time.
• Measuring how the website is used, and whether an advertisement leads to a sign-up: Legal basis: your consent, through the cookie banner.

We do not use your data for any other purpose.

4. Who we share data with

We use other businesses for part of the work. These are they, and this is what they receive:

• OpenRouter and the model providers (Anthropic, OpenAI, Google and ElevenLabs): text, audio and images of a recipe go through OpenRouter to models from these providers. Transcribing a recording (speech to text) also goes through OpenRouter. We do not send your name or email address. In our OpenRouter account, training and storage are switched off.
• Apify: fetches Instagram posts for us. Our own server fetches TikTok and YouTube itself.
• Mollie: processes your payments. Mollie receives the name and email address of the owner of the household.
• Cloudflare: on app.smaquli.com, traffic to the app goes through Cloudflare.
• mijn.host (the Netherlands): hosting of the website and of our email.
• CookieConfirm: the cookie banner on the website. Keeps your cookie choice, with a random number as proof of that choice (see the cookie statement).
• Google: Tag Manager, Analytics and Ads, only if you give consent to measuring (see "The website" below).
• The people in your household: they see what you put in the shared recipe book and on the shared shopping list.

The app itself runs on our own server in the Netherlands.

We do not pass your data on to anyone other than these parties, unless the law obliges us to.

5. Transfers outside the EU

OpenRouter and the model providers may process data outside the EU. That is needed to create, analyse and organise your recipes. The transfer is covered by an adequacy decision of the European Commission (Article 45 GDPR), or by the standard contractual clauses approved by the European Commission (Article 46 GDPR). The same may apply to other parties in the list above, with the same safeguards.

6. How long we keep data

• Your account and what you save: for as long as your account exists. A recipe you delete stays in the bin for 30 days and is erased after that. Recipes in the vault (after Premium) are kept until you delete them or your account is deleted.
• A free account you no longer use: if you don't log in for 12 months, you get an email. If you still don't log in during the month after that, we delete the account and everything in it.
• Voice recordings: only until they have been transcribed.
• Videos: are not kept.
• Imports and voice conversations: we clear them out 30 days after the last change.
• Finished cooking sessions: 30 days.
• The session cookie smaquli_session: 90 days, and it is extended when you use the app.
• Backups: we keep 7 daily, 4 weekly and 3 monthly backups. So deleted data can stay in a backup for up to about three months.
• Payment and subscription data: for as long as your account exists, and after that for as long as the law requires for bookkeeping.
• Waiting list: until the app opens.
• Messages through the contact form or email: for as long as needed to deal with your question.
• Measurement data at Google (only with consent): 14 months.

7. The website

• Contact form: what you enter reaches us as an email at info@smaquli.com. We use it to reply to you.
• Waiting list: we keep your email address and your language, without an IP address, until the app opens. We use them to tell you the app is open. If you want to come off the list sooner, email us.
• 404 log: we note which pages do not exist, so that we can fix broken links. It contains no IP addresses.
• Measuring: only with your consent, through the cookie banner, we use Google Tag Manager (with a server-side container), Google Analytics 4 and Google Ads to measure how the site is used and whether an advertisement leads to a sign-up. Google's tags follow your choice (Consent Mode v2). Without consent we do not measure. You can read more in the cookie statement.

8. Security

• We only keep passwords as a hash (argon2id).
• The app runs on our own server in the Netherlands.
• We make an encrypted backup every day. The backups are kept on our own servers.
• We do not keep card or bank details.

If something does go wrong with your data, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and, where the law requires it, to you as well.

9. Your rights

You have the right to:

• Access: find out which data we hold about you.
• Export: take your data with you. In the app you can export your recipes and lists (JSON; photos are included as references).
• Correction: have incorrect data corrected.
• Erasure: have your data erased. There is no button to delete your account yourself; that goes by email.
• Restriction: ask us to pause the processing of your data.
• Objection: object to processing based on our legitimate interest.
• Withdrawing consent: you can always do this. For the waiting list, email us; for measuring, use the "Cookie settings" link at the bottom of the site. Withdrawing does not affect anything done before.

Email us at info@smaquli.com, preferably from the email address of your account so that we know it is you. We reply within a month.

10. Contact and complaints

If you have a question or a complaint about your data, email us at info@smaquli.com. We would like to hear from you first, so that we can sort it out. You can always complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). If you live in another EU country, you can also complain to the supervisory authority there.

If we change this statement, you can see it from the date of the last update.