Privacy Policy

Last updated: 2026-05-26

AreaCacao processes your personal data with the safeguards required by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).

1. Data controller

Controller: AreaCacao · contact: support@areacacao.com.

2. Data we collect and purpose

• Account and service (email, name, password hash, 2FA secret) — legal basis: performance of the contract (GDPR Art. 6(1)(b)).
• Payment data (Stripe Customer ID, subscriptions, billing history) — legal basis: performance of the contract. Your card number NEVER passes through our servers: it is entered directly in Stripe Checkout (PCI-DSS SAQ-A).
• Recipe / AI processing (product description, ingredients, wizard parameters) — sent to Google Cloud to generate recommendations. Legal basis: performance of the contract.
• Third-party sensory data (external panelists who evaluate your tastings) — only if you enable the Sensory module. Legal basis: the panelist's consent (collected via a digital form).
• Technical data (IP, user agent, error logs in Sentry) — legal basis: legitimate interest (security and service improvement). Sentry is configured to scrub PII.

3. Providers that process your data (sub-processors)

• Stripe (USA) — payments. DPA + SCCs signed. They retain billing history for 7 years as required by tax law.
• Backblaze B2 (USA, region us-east-005) — storage of attachments (PDFs, images). DPA. Transfer Impact Assessment pending.
• AWS SES (eu-west-1, Ireland) — delivery of transactional emails. Standard DPA.
• Google Cloud — AI processing of recipe descriptions. Google Cloud DPA.
• Sentry — error capture. DPA + SCCs.
• Hetzner Cloud + Contenfo (EU) — hosting of the backend cluster and database. DPA.
• Firebase App Hosting (Google, EU) — hosting of the frontend. Google Cloud DPA.
• PostHog (EU, eu.posthog.com) — product analytics, with your consent only. Data hosted in the EU. DPA.

4. Retention periods

• Active account: for the duration of the contract.
• After cancellation: 30 days for the cancellation itself + 7 years for billing.
• External panelist data: until they withdraw their consent.
• Technical and error logs: 90 days.

5. Your rights (GDPR Arts. 15–22)

You have the right to access, rectify, erase, object to, and restrict the processing of your data, and to request its portability. To exercise these rights, write to support@areacacao.com from the email associated with your account. Response time: 30 days.

6. International transfers

Some sub-processors (Stripe, Backblaze, Google) process data in the USA. The transfer is covered by the European Commission's Standard Contractual Clauses (SCCs).

7. Changes to this policy

We will publish any change on this same page with a new last-updated date. If the change is substantial, we will notify you by email.

8. Invited panelists (Sensory module)

If you take part as an invited panelist through an evaluation link, the workshop that invited you processes, through AreaCacao, your name, your tasting responses, and minimal technical data (a technical identifier for your device) in order to analyze the product or train its sensory panel. The legal basis is your consent, which we collect before the evaluation begins. You can request access to or erasure of your data by contacting the workshop that invited you or by writing to support@areacacao.com.

See also: Terms and Conditions · Cookie Policy.