1. Introduction

Recete Ltd. (“we”, “our”, or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

2.1 Merchant Information

• Business name and contact information
• Email address and account authentication data handled by our authentication provider
• API keys and integration credentials
• Product information and knowledge base data

2.2 End User Information

• Phone numbers (encrypted at rest)
• Names and order information
• Conversation history
• Consent status

3. How We Use Your Information

• To provide and maintain our service
• To provide merchant-requested post-purchase support and WhatsApp messaging workflows
• To process customer conversations, delivery context, and product guidance
• To provide analytics, reporting, and operational tools to merchants
• To comply with legal obligations

4. Data Minimization and Purpose Limitation

We process the minimum personal data needed to provide merchant-requested functionality. We do not use merchant customer data for unrelated purposes, and we expect merchants to use the service only for lawful, consent-respecting customer communications.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption of sensitive data at rest and encryption in transit
• Multi-tenant data isolation (Row Level Security)
• Secure API authentication
• Role-limited internal access and operational logging

6. Your Rights (GDPR)

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Portability: Receive your data in a portable format
• Objection: Object to processing of your data
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, please contact us at privacy@recete.co.uk or use the data export/deletion features in your dashboard.

7. Data Retention

We retain your data for as long as necessary to provide our service and comply with legal obligations. When you request deletion, we will:

• Schedule deletion with a 30-day grace period
• Permanently delete data after the grace period
• Retain only limited backup copies according to our documented retention schedules

8. Third-Party Services (Sub-processors)

We use the following providers to run the service:

• Supabase: Database and merchant authentication (London, United Kingdom)
• DigitalOcean: Application hosting and message queues (London, United Kingdom)
• OpenAI: Generates AI replies from the customer's message and product information (United States)
• WhatsApp (Meta Platforms): Carries messages, end-to-end encrypted, between the merchant's own linked WhatsApp account and their customers
• PostHog: Website and dashboard analytics, only after cookie consent (European Union)
• New Relic: Error and performance monitoring (European Union)

8a. WhatsApp Messaging

Recete sends scheduled WhatsApp messages only to customers whose merchant has recorded marketing consent for them, and checks that consent again before each message. Customers can stop messages at any time by replying STOP. Messages are sent from the merchant's own WhatsApp number, which the merchant links to Recete as a device (like WhatsApp Web); the keys for that link are stored in our London database and deleted when the merchant unlinks the number or removes the app. Merchants can find a checklist and a privacy-notice paragraph on our WhatsApp & GDPR page.

9. Merchant Data Protection Terms

If you are a merchant using the service, our Data Processing Addendum forms part of our merchant terms and explains how we process customer personal data on your behalf.

10. Contact Us

If you have questions about this Privacy Policy, please contact us:

• Email: privacy@recete.co.uk
• Support: support@recete.co.uk
• Phone: +44 7915 922506
• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
• Company number: 17082027