Privacy Policy

1. Controller

The controller of personal data processed through PrepProfit is a private trader registered in Finland (Business ID 3399953-5, VAT FI33999535), operating under the name "PrepProfit". Contact: info@prepprofit.com.

This policy explains what personal data we process when you visit prepprofit.com or use the PrepProfit application, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

2. Data we process

Account data: name, email address and authentication identifiers, managed through our authentication provider (Clerk).

Workspace data: the business data you and your team enter — recipes, ingredients, prices, financial transactions, invoices (which may contain your customers' names and contact details), employee records for payroll summaries, suppliers and similar.

Photos you upload for AI extraction: images of recipes or supplier invoices you choose to submit. They are processed to produce a draft for your review; we store extraction metadata (provider, cost, status), not the image as a permanent record.

Billing data: subscription plan, invoices and payment status. Card details are processed by Stripe and never touch our servers.

Usage data (only with your consent): pageviews, product interactions and session replays via PostHog, hosted in the EU.

Support data: messages you send us by email or through the support chat (Crisp).

Technical logs: IP addresses and request logs kept short-term for security and error diagnosis (Vercel, Sentry).

3. Why and on what legal basis

• Providing the Service, including hosting your workspace data and processing payments — performance of a contract (GDPR Art. 6(1)(b)).
• Security, abuse prevention, audit logging and error monitoring — legitimate interest (Art. 6(1)(f)).
• Product analytics and session replay — your consent (Art. 6(1)(a)), given through the cookie banner and withdrawable at any time.
• Transactional email (receipts, trial reminders, reports you opt into) — performance of a contract; optional report emails are opt-in.
• Legal obligations such as bookkeeping — compliance with law (Art. 6(1)(c)).

4. Your customers' and employees' data

When you store personal data about your own customers or employees in your workspace (for example on invoices or payroll records), you are the controller of that data and PrepProfit processes it on your behalf as a processor, only to provide the Service. Contact us at info@prepprofit.com if you need a data processing agreement.

5. Cookies

Strictly necessary (always on): authentication and security cookies (Clerk), your cookie-consent choice, theme preference, and the support chat session (Crisp).

Analytics (opt-in only): PostHog cookies for pageviews, product analytics and session replay. These are set only after you click Accept in the cookie banner, and you can withdraw consent at any time via "Cookie settings" in the footer.

Session replays are used to diagnose usability problems. PostHog is configured on EU servers, and keystrokes in sensitive fields are masked by default.

6. Processors and recipients

We use the following service providers as processors:

• Vercel (USA/EU) — application hosting and logs.
• Neon (EU region) — PostgreSQL database hosting.
• Clerk (USA) — authentication and organization management.
• Stripe — payment processing.
• Resend — transactional email delivery.
• Google (Gemini API) — AI extraction of the photos you submit for that purpose.
• PostHog (EU) — product analytics and session replay, only with your consent.
• Crisp (EU) — support chat.
• Sentry — error monitoring.

Where a provider processes data outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses and, for US providers, the EU-US Data Privacy Framework where certified. We do not sell personal data.

7. Retention

Account and workspace data is kept while your account is active. Items you delete in the app go to a trash area and are purged on a schedule or when you purge them manually.

If you delete your account, we delete or anonymize your personal data within a reasonable wind-down period, except where law (for example bookkeeping rules) requires longer retention.

Technical logs and analytics data are kept for shorter, provider-standard periods.

8. Your rights

Under the GDPR you have the right to access, rectify and erase your personal data, restrict or object to processing, data portability, and to withdraw consent at any time without affecting prior processing.

You can export your workspace data and request account deletion directly in Settings, or contact us at info@prepprofit.com.

You also have the right to lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

9. Security

Workspace data is isolated per organization with database-level row security, access is role-based, connections are encrypted in transit, and sensitive operations are audit-logged. No system is perfectly secure, but we design for tenant isolation first.

10. External data sources

PrepProfit's nutrition estimates draw on public food databases. No personal data is sent to these sources — only the generic food term or product barcode you look up.

• USDA FoodData Central — U.S. Department of Agriculture, released into the public domain (CC0).
• Open Food Facts — a collaborative product database, made available under the Open Database License (ODbL, https://opendatacommons.org/licenses/odbl/). Individual product data from Open Food Facts is shown with attribution and a link to the source product; product images are not used.

Nutrition figures from these sources are estimates for planning, not a substitute for laboratory analysis or a claim of regulatory compliance.

11. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced by email or in-app notice. The date at the top shows the latest revision.