Effective: June 18, 2026 · v4

Privacy Policy

1. Introduction

Rouxbarb ApS ("Rouxbarb ApS," "we," "us," or "our") operates the Rouxbarb application and related services (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Service.

Rouxbarb ApS is a company registered in Denmark and acts as the data controller for personal data processed through the Service.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Data We Collect

2.1 Information You Provide

• Account information: name, email address, and password when you create an account.

• Profile information: profile photo, and other optional details you choose to share.

• User-generated content: recipes, reviews, ratings, comments, photos, and meal plans you create or upload.

• Communications: messages you send to us through support channels or feedback forms.

2.2 Information Collected Automatically

• Usage data: pages viewed, features used, search queries, recipes saved, and interaction patterns.

• Device information: device type, operating system, browser type, language settings, and unique device identifiers.

• Log data: IP address, access times, referring URLs, and crash reports.

• Location data: approximate location derived from your IP address (we do not collect precise GPS location unless you explicitly enable it).

2.3 Information from Third Parties

• Social login providers: if you sign in using a third-party account (e.g., Google or Apple), we may receive your name, email address, and profile picture as permitted by your settings with that provider.

3. How We Use Your Data

We process your personal data for the following purposes and legal bases under the GDPR:

Purpose | Legal Basis (GDPR Art. 6)

Providing and maintaining the Service | Performance of a contract

Personalizing recipe recommendations and content based on your in-app activity and preferences | Consent (Art. 6(1)(a)) — collected via in-app preference settings at the point of onboarding; may be withdrawn at any time through account settings.

Communicating with you about your account or support requests | Performance of a contract

Sending promotional emails and push notifications (with your consent) | Consent

Analyzing usage trends to improve the Service | Legitimate interest

Detecting and preventing fraud or abuse | Legitimate interest

Complying with legal obligations | Legal obligation

4. Cookies and Similar Technologies

We use cookies to operate and maintain the Rouxbarb platform. All cookies we use are strictly necessary — they are essential for core functionality such as maintaining your session and protecting against cross-site request forgery. We do not use analytics, advertising, preference, or any other non-essential cookies.

Because we use only strictly necessary cookies, we do not require your consent to place them under the ePrivacy Directive. No cookie banner is displayed.

You can manage or delete cookies through your browser settings. Please note that blocking strictly necessary cookies may impair the functionality of Rouxbarb. For full details of the cookies we use, including names, purposes, and durations, see our Cookie Policy.

5. Third-Party Service Providers

We share personal data with the following categories of third-party processors, who process data on our behalf under appropriate data processing agreements:

Category | Provider | What they process

Cloud infrastructure, database, authentication, AI processing, push notifications & AI language model | Google (GCP, Firebase, Vertex AI, Gemini, FCM) | All user data, content, logs, identity tokens, usage behaviour, user photos, recipe text, voice sessions, device tokens, conversational query text

Error monitoring | Sentry | Crash reports, session state, user IDs

Payment processing — in-app | Apple (App Store IAP) | Transaction data, Apple ID

Stripe | Creator payout processing via Stripe Connect | Creator identity and bank account data collected for KYC verification and payout disbursement. Stripe processes Creator payout data only. Stripe does not process End-User payment card data — all End-User purchases are handled by Apple IAP. Data transferred to the US under SCCs

Voice AI — Kitchen Assistant (STT & TTS) | ElevenLabs | Voice input, synthesised voice output

Wake-word detection for the Kitchen Assistant ("Hey Rouxbarb") is performed entirely on your device using a local model. No audio is transmitted to Rouxbarb ApS, ElevenLabs, Google, or any other third party unless and until the wake word is detected on your device. Once activated, your spoken input is transmitted to ElevenLabs for transcription and to Google (Gemini) for generating a response, and the response is converted to speech by ElevenLabs and streamed back to your device.

These providers are contractually obligated to process your data only as instructed by us and in compliance with applicable data protection laws.

6. Data Sharing and Disclosure

We do not sell your personal data. We may disclose personal data in the following circumstances:

• With your consent: when you direct us to share information with a third party.

• Service providers: as described in Section 5 above.

• Legal requirements: when required by law, regulation, legal process, or governmental request.

• Business transfers: in connection with a merger, acquisition, or sale of assets, in which case you will be notified of any change in data controller.

• Safety and rights: to protect the rights, property, or safety of Rouxbarb ApS, our users, or others.

7. International Data Transfers

Rouxbarb ApS is based in Denmark (EU/EEA). We transfer personal data to processors located in the United States, including Google, ElevenLabs, Sentry, Stripe, and Apple. We ensure an adequate level of protection for all such transfers through Standard Contractual Clauses (SCCs) approved by the European Commission under Commission Implementing Decision (EU) 2021/914 of 4 June 2021, incorporating Module 2 (controller to processor). A copy of the applicable SCCs is available on request by contacting us at privacy@rouxbarb.com.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Account data: retained for the lifetime of your account and deleted within 30 days of account deletion, unless legal obligations require longer retention.

• Usage and analytics data: retained in an aggregated or anonymized form for up to 26 months.

• Communications: retained for up to 24 months after the inquiry is resolved.

• Payment and payout records (Creator transaction history, payout records, Stripe Connect data) | 5 years from the end of the relevant financial year | Required under the Danish Bookkeeping Act (Bogføringsloven). This retention period applies regardless of account deletion and overrides any shorter preference expressed by the Creator.

9. Your Rights Under the GDPR

If you are in the EU/EEA, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.

• Rectification: request correction of inaccurate or incomplete data.

• Erasure: request deletion of your data ("right to be forgotten").

• Restriction: request that we limit how we process your data.

• Data portability: receive your data in a structured, machine-readable format.

• Objection: object to processing based on legitimate interest or direct marketing.

• Withdraw consent: withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at the address provided in Section 14. We will respond within 30 days. You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet) or another relevant supervisory authority.

10. Your Rights Under the CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights:

• Right to know: you may request details about the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.

• Right to delete: you may request that we delete the personal information we have collected from you, subject to certain exceptions.

• Right to opt out of sale: Rouxbarb ApS does not sell personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.

• Right to non-discrimination: we will not discriminate against you for exercising any of your CCPA rights.

To exercise these rights, contact us at the address provided in Section 14. We will verify your identity before processing your request and respond within 45 days.

11. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. Creators who apply to receive payouts through the platform must be at least 18 years of age. Payout-related identity verification is processed by Stripe under Stripe's own terms and privacy policy. Stripe's KYC process requires Creators to provide government-issued identification; this data is collected and held by Stripe directly and is not stored by Rouxbarb ApS. If you believe we may have collected data from a child under 16, please contact us.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit and at rest, access controls, regular security assessments, and employee training. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Changes to This Privacy Policy

Where we make material changes to this policy — including changes to what data we collect, how we use it, or who we share it with — we will update the "Last updated" date at the top of this policy and post the revised version at rouxbarb.com/legal/beta-privacy. We may also post a notice on the Platform to draw your attention to significant changes. We encourage you to check this page periodically. Your continued use of the Platform following any update constitutes your acceptance of the revised policy.

14. Beta Signup Privacy Notice

If you applied to join the Rouxbarb closed beta program, your signup data was collected and processed separately under our Beta Signup Privacy Notice, available at rouxbarb.com/legal/beta-privacy. That notice governs data collected during the beta application process only. This Privacy Policy applies once you become a registered user of the Platform, whether through beta conversion or direct signup at full launch. If you converted from a beta tester to a registered user, your data handling transitions to this Privacy Policy from the date your account was activated on the live Platform.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

Rouxbarb ApS | privacy@rouxbarb.com | rouxbarb.com

Njalsgade 21F, 2300 København S, Denmark | CVR: 46028244

For complaints, you may also contact the Danish Data Protection Agency (Datatilsynet) at datatilsynet.dk.