Privacy Policy
1. Data Controller
The data controller is Plate Mate, an individual based in France. Contact: platemate.selected742@passinbox.com.
2. Data Collected
When using PlateMate, the following data is collected:
- First names, last names, or nicknames of household members, as entered by the user
- Color assigned to each member
- Dietary preferences per member (likes / dislikes each meal)
- Meals created by the household (name, category, speed, time preference)
- Generated plans and validated plan history
- Family code (access identifier)
- Aggregated and anonymous usage data via Vercel Analytics (page views, device type, approximate country — no cookies, no individually identifiable data)
3. Purpose of Processing
Data is collected and processed solely to provide the family meal planning service. The legal basis is the performance of the service requested by the user (legitimate interest / necessary for service provision).
4. Data Recipients
No data is transferred to third parties for commercial purposes. The following technical sub-processors have access to data strictly within the scope of their services:
- Vercel Inc. (USA) — frontend hosting. Vercel adheres to the EU-US Data Privacy Framework.
- Supabase (Ireland, EU) — database hosting.
5. Transfers Outside the European Union
The Supabase database is hosted in the EU West region (Ireland): user data (household members, meals, preferences, plans) remains within the European Union, with no transfer outside the EU for primary storage.
The frontend is hosted by Vercel Inc., based in the United States. Vercel adheres to the EU-US Data Privacy Framework, ensuring an adequate level of data protection in accordance with the European Commission's adequacy decision. This transfer concerns only the technical hosting of the site (page delivery), not the storage of personal data in the database.
6. Retention Period
Data is retained as long as the family account is active. After 12 months of inactivity, data is automatically deleted. Users may also request deletion at any time (see section 8).
7. Security
Access to household data is protected by a randomly generated family code. This code is stored as a bcrypt hash in the database and is never stored in plain text. Login attempts are rate-limited to prevent brute-force attacks.
Access to data in Supabase is restricted by Row Level Security (RLS) policies: each household can only access its own data.
8. User Rights
Under the GDPR, you have the following rights:
- Right of access: you may request to know what data is held about your household.
- Right to rectification: you may modify your household's data directly from the application.
- Right to erasure: you may delete all your household's data from the application settings, or by contacting us by email.
To exercise these rights, contact us at: platemate.selected742@passinbox.com.
You also have the right to lodge a complaint with the CNIL.
9. Cookies
This site does not use tracking cookies. Vercel Analytics, used for audience measurement, operates without cookies and without personally identifiable data. No consent banner is therefore required.