Privacy policy

We only collect the data necessary for the service to work:

• User account: first name, email address, password (stored as a secure hash) or Google, Apple or Facebook login identifier, profile photo (optional), language, time zone, plan (free or Pro) and subscription identifiers (Stripe, App Store, Google Play) where applicable.
• Cooking preferences: units, diets and allergies that you choose to provide. Allergies and some diets may reveal information about your health: they are only used to flag allergens on your recipes and to exclude them from suggestions, and you can remove them at any time from your profile.
• Recipes and planning: recipes (titles, ingredients, steps, times, estimated nutritional values, source URL, photos), cookbooks, weekly meal plan, shopping list, pantry, wine cellar (photos of labels and bottles), ratings and photos added after cooking.
• Household, friends and messages: members of your household, friends list, recipes sent and received, messages exchanged with your friends or with the Zeste team, invitations and referrals.
• Imports: technical logs (import type, date, source link) to apply the free plan limits and provide support.
• Payment: if you subscribe to Zeste Pro, payment is processed by Stripe (on the website) or by Apple and Google (in the app); we receive the status of the subscription, never your card number.
• Content sent to AI: texts, images, audio or video metadata needed to extract recipes, and your messages to Chef Zeste (see section 7).
• Imported photos: the image as sent to the AI during a photo import, kept for support and to improve recipe reading.
• Conversations with Chef Zeste: your messages and the recipes suggested, to display your history and provide support.
• Device: notification token (if you allow notifications), app model and version, and technical error reports in the event of a crash.
• Local data (browser): cooking mode preferences, timers and PWA installation — stored on your device, not sent to our servers unless stated otherwise.

Your data is used exclusively to:

• create and manage your account;
• import, structure, translate and display your recipes;
• share recipes, cookbooks, meal plan and shopping list with your household and your friends, or via a link;
• send you notifications and emails related to the service (meal reminders, recipe ready, invitations), which you can unsubscribe from;
• manage Pro subscriptions, the free trial and billing;
• provide technical support, security and protection against abuse;
• measure website traffic anonymously (see section 8).

No data is sold, transferred to data brokers or used for advertising or profiling purposes.

Only Robin Couet, director of EI Start-Win, accesses operational data for support and administration of the service. The strictly necessary technical processors are:

• OVH — hosting of the application, the database and photos (France);
• OpenAI and Anthropic — recipe extraction, translation and generation, audio transcription, Chef Zeste and Magic Fridge; Google (Gemini) as a fallback for reading some videos;
• SocialKit — metadata and transcripts for some Instagram imports;
• Video providers (extraction via yt-dlp) — technical access to the URLs you submit for import;
• Stripe — payment for subscriptions taken out on the website; Apple and Google — payment for subscriptions taken out in the app; RevenueCat — tracking of the subscription status between the website and the apps;
• Google, Apple and Facebook (Meta) — sign-in to your account if you choose this method (we receive your email address, your name and, where applicable, your profile photo);
• Brevo — sending emails (confirmation, password, reminders, newsletter);
• Expo, Apple and Google — delivery of notifications to your phone;
• Sentry — technical error reports; Cloudflare Turnstile — anti-bot protection for forms; Discord — internal administration alerts.

Some of these providers are located outside the European Union, in particular in the United States. Transfers rely on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses. Each processor is chosen for its GDPR compliance. A data processing agreement (DPA) can be provided on request.

Data is hosted in France, by OVH. Communications are encrypted (HTTPS/TLS). Passwords are hashed and never stored in plain text. Access to recipes is limited to your account, unless explicitly shared via a link.

• Account and recipes: kept as long as the account is active; deleted on request or after the account is closed, subject to temporary technical backups.
• Import cache (SourceCache): technical content reused between users for the same source URL; may be purged by the administrator.
• Billing: data kept for 10 years in accordance with French accounting obligations.
• Imported photos: 30 days, then deleted automatically.
• Conversations with Chef Zeste: kept as long as the account is active; you can delete each conversation from the history.
• Import logs: kept for as long as needed for the weekly quota and internal usage statistics.

In accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the right to access, rectify, delete, restrict, object to and port your data.

To exercise these rights, contact our Data Protection Officer: robin@start-win.fr.

You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Automatic recipe extraction sends the content you provide (text, image, audio, link metadata) and your messages to Chef Zeste to artificial intelligence models from OpenAI and Anthropic, and from Google as a fallback. This processing is necessary to provide the service. Content goes through the business APIs of OpenAI and Anthropic, which do not use it to train their models. Nor do we use your recipes to train our own models.

Always check the extracted information (allergens, quantities, cooking times) before using it in the kitchen.

Zeste uses cookies that are strictly necessary for authentication and for the session to work (signing in to your account).

We also use Umami (a self-hosted instance at https://analytics.start-win.fr), an anonymized audience measurement tool (page views, country, device, traffic source). Umami does not set advertising tracking cookies and does not collect data that could identify you personally. Statistics are aggregated.

You can block the measurement script with your browser extensions; this does not affect your use of the service.

For the full legal notice, see the Legal notice page. For the terms of use: Terms of use and Terms of sale.

Website concerned: https://zeste.cooking