Privacy Policy

1. Who is responsible (data controller)

Redbit S.r.l.s. con socio unico ("Redbit", "we") Viale della Grande Muraglia 494, 00144 Rome, Italy VAT/Tax ID IT15237911001 Email: info@recipeup.fit

Redbit is the data controller for the processing described in this notice. Privacy requests are handled at the email above.

2. What we collect and why

We designed recipeup.fit to work without accounts, without newsletters and with as little data as possible. The processing activities are:

2.1 Server and security logs

When you visit, our hosting provider and our CDN/security provider (Cloudflare) record technical data: IP address, date and time, requested URL, referrer, browser and operating system, and country. This is used to deliver pages, defend against attacks and abuse, and diagnose errors. Legal basis (GDPR): legitimate interest (Art. 6(1)(f)) in operating a secure website. Retention: raw web server logs are kept for up to 90 days; Cloudflare keeps its own security logs for a limited period per its policy.

2.2 Analytics (Google Analytics 4) — only with your consent outside the United States

We use Google Analytics 4 (Google LLC, USA; Google Ireland Ltd for EEA users) to understand which pages are read and how the site is used. GA4 sets cookies (_ga, _ga_*, 2 years) and collects page views, approximate location (city level, from a truncated IP), device and browser type, and interaction events. We have enabled IP truncation, disabled Google Signals and advertising features, and set event data retention to the shortest available period (2 months). Legal basis (GDPR): consent (Art. 6(1)(a)), given in the consent panel (InMobi Choice, see 2.3). GA4 loads only with consent to TCF purpose 1, a measurement purpose (8 or 9), Google as a vendor and Google's analytics consent ("Google consents" section); accepting all gives them all. In the United States the panel works on an opt-out basis: analytics runs by default, the "Do Not Process My Personal Information" panel opens on the first visit, and you can opt out there or later (confirming without Google analytics consent also turns analytics off); we honor the Global Privacy Control (GPC) browser signal as an opt-out. Withdraw: at any time from "Cookie settings" in the footer or on Your privacy choices.

2.3 Consent management (InMobi Choice)

Consent is collected by InMobi Choice, a consent management platform provided by InMobi Technology Services Pte. Ltd. (Singapore), registered with IAB Europe, certified by Google and compliant with version 2.4 of the Transparency & Consent Framework (TCF). Your browser loads the panel from InMobi's servers. InMobi therefore receives your IP address, from which it derives your country (and US state) to apply the right rules. It also receives technical browser data and your consent choices, and it logs when the panel is shown. Your choices are stored in your browser for 13 months (see the cookie policy). The panel lists the vendors registered in the TCF, but RecipeUp loads no code from any of them except Google Analytics after consent. InMobi acts as an independent controller for the data it receives, as set out in its CMP data protection agreement, and processes it under its own privacy policy. Legal basis (GDPR): legal obligation to collect and demonstrate consent (Art. 6(1)(c) and 7(1)) and legitimate interest (Art. 6(1)(f)). Retention: your choices, 13 months in your browser; data received by InMobi, per its privacy policy.

2.4 Contact form and email

If you write to us we process your name, email address and the content of your message to reply to you. Legal basis: performance of pre-contractual steps at your request / legitimate interest in answering enquiries (Art. 6(1)(b) and (f)). Retention: as long as needed to handle the request, generally no more than 24 months.

2.5 Local storage (not cookies)

Your unit preference (US/metric, ru_units) and the state of the consent panel are stored in your browser's local storage. The unit preference never leaves your device; both are strictly necessary to remember your choices.

We do not knowingly collect data from children under 16 (or under 13 in the US). The site is not directed at children.

3. Who receives data (processors and third parties)

We do not sell personal data and we do not share it for cross-context behavioral advertising. We may disclose data if required by law or to protect our rights.

4. International transfers

Some providers process data in the United States. Transfers rely on the EU-US Data Privacy Framework (Cloudflare and Google are certified participants) and, as a fallback, the European Commission's Standard Contractual Clauses with supplementary measures. InMobi, which provides the consent panel, is based in Singapore; its data protection agreement provides for the Standard Contractual Clauses (Decision (EU) 2021/914) for transfers outside the EEA. You can request a copy of the relevant safeguards.

5. Your rights (GDPR and EU/UK residents)

You have the right to: access your data; obtain rectification or erasure; restrict or object to processing; data portability; withdraw consent at any time (without affecting prior processing); and lodge a complaint with a supervisory authority — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or the authority of your country of residence.

To exercise a right, email info@recipeup.fit. We respond within one month (extendable by two months for complex requests). We may ask for information to verify your identity.

6. Your rights (California and other US states)

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another US state with a comprehensive privacy law, you may have the right to: know what personal information we collect and how it is used; access and obtain a copy; delete; correct; opt out of sale, sharing or targeted advertising; and not be discriminated against for exercising these rights.

Notice at collection (CCPA/CPRA): categories collected — identifiers (IP address, cookie IDs), internet activity (pages visited, referrer, device information), approximate geolocation (city level), your privacy choices, and, if you contact us, name and email. Purposes — operating and securing the site, applying your privacy choices (through InMobi Choice), measuring audience, responding to enquiries. Retention — see section 2. We do not sell or share personal information as defined by the CCPA, and we have not done so in the preceding 12 months. We honor Global Privacy Control signals as a valid opt-out request. We do not use or disclose sensitive personal information.

To exercise a right, email info@recipeup.fit with "Privacy request" in the subject, or use the privacy choices page or "Cookie settings" in the footer for analytics opt-out. You may authorize an agent to act for you; we will ask the agent for proof of authorization. We will respond within 45 days. If we deny a request, you may appeal by replying to our decision.

7. Security

Traffic is encrypted (TLS 1.2+ with HSTS), the origin server accepts connections only from our CDN, access is limited to authorized personnel, and we keep the amount of data minimal by design.

8. Changes

We will post changes here and update the date at the top. Material changes to how we use data will be announced on the site before they take effect.

9. Contact

Redbit S.r.l.s. con socio unico · Viale della Grande Muraglia 494 · 00144 Rome · Italy · info@recipeup.fit