Fuxet Olivier EI, a French sole proprietor trading as “Twist Labs”, registered under SIREN number 807437645 and SIRET number 80743764500037, located at 8 Bis Rue Abel, 75012 Paris, France, is the operator of Cookping and the data controller identified in this policy (“Cookping”, “we”, “us”). This policy explains what personal data we process, why, and what rights you have over it. It covers the marketing site, the creator dashboard, public recipe and recipe-book pages, recipe-book purchases, and the Instagram comment-to-DM delivery service.
1. Data we collect about creators
- Account data — your name, email address, and authentication identifiers, managed through our sign-in provider, Clerk.
- Content you create — recipe and recipe-book content, cover image files, recipe page and creator page settings (bio, links and featured recipes), automation configuration (keywords, messages, button labels, links), and any custom URLs you configure.
- Instagram data — when you connect an Instagram account: account and profile metadata, your posts and Reels metadata, comments on those posts, and message delivery events, received through the official Meta APIs and webhooks.
- Billing and selling data — your plan, subscription status, payment history, and the status of your Polar connection (the organization you sell books through, and encrypted access tokens). Card and bank-account details are handled by Stripe and Polar; we never store full card or bank-account numbers.
- Creator code — if you enter one, the code, when you entered it, and the share of each of your payments it earns the creator who shared it. That creator only receives totals (how many accounts used the code, how many pay, the amounts), never who you are.
- Usage and diagnostics — product analytics events (pages viewed, features used) and error and performance diagnostics, as described in section 4.
2. Data we process about followers, public visitors, and book buyers
When someone interacts with a creator's automation, public page, or paid book, we process a limited set of data so the service can work:
- comments containing a trigger keyword, and the Instagram-scoped user ID of the commenter;
- direct-message events and their timestamps — we keep the time of the last inbound message so we never send outside Instagram's allowed 24-hour messaging window;
- when a creator enables follow-gating, the result of Instagram's follow-status check;
- recipe page visits, public book-preview visits, and link clicks, aggregated into creator analytics without a persistent browser identifier;
- for a book purchase: the order reference, amount, tax and refund status that Polar reports to us. The purchase itself, the buyer's email address, the receipt and the file download are handled by Polar, the seller of record; Cookping stores no buyer identity.
We process this data to provide the service to the creator whose account or page the person interacted with and, for buyers, to fulfil and support the purchase. Followers, visitors, and buyers can exercise the rights in section 9 with us or with that creator.
3. How we use data
- operating the service: publishing recipe pages and books, delivering automated messages, mirroring book sales reported by Polar;
- enforcing Instagram's messaging rules, plan quotas, and abuse limits, and sending service emails such as quota alerts (via our email provider, Resend);
- parsing recipes you import: the text or caption you submit is sent to our AI provider (OpenAI) solely to structure it into a recipe;
- billing, the creator's Polar connection, sales reporting, and account management;
- measuring, debugging, and improving the product;
- security, fraud and abuse prevention, and compliance with legal obligations.
We do not sell personal data. With your consent — or, for visitors in the United States, unless you opt out — we measure the results of our own Instagram and Facebook ads with Meta (see section 4); we do not use your data to show you other companies' advertising.
4. Cookies and analytics
- Authentication cookies — Clerk sets cookies required to keep you signed in.
- Product analytics — we use PostHog, hosted in the EU, to understand how the product is used. Its browser identifier is stored in local storage rather than an analytics cookie.
- Error monitoring — we use Sentry to collect errors and performance data. Session replays are masked: text, inputs, and media are blocked from capture.
- Advertising measurement — we use the Meta Pixel to learn whether people who saw our Instagram and Facebook ads visit our site and sign up. It sets the
_fbpand_fbccookies and reports the marketing and sign-up pages you view; it does not run in the logged-in dashboard, except to report the account milestones below. When you create your account, connect Instagram for the first time, or activate your first automation, we also send that event to Meta from our servers (the Conversions API), with your email address and Cookping account ID in hashed form, your IP address, your browser's user agent, and the Pixel's identifiers, so Meta can match it to an ad. We delete the IP address, user agent, and Pixel identifiers from our systems as soon as the event is sent, and after seven days at most. Meta Platforms Ireland processes this data as a controller under its own privacy policy.
PostHog and client-side Sentry (analytics and diagnostics) and the Meta Pixel and Conversions API (advertising) are optional, and the consent panel asks about each purpose separately. They remain disabled until you accept the purpose they serve. Refusing them does not limit the site or product. You can change or withdraw your choices at any time through the Cookie preferences control. We retain your choices for six months before asking again.
Visitors in the United States. If you visit from the United States (as estimated from your IP address), analytics, diagnostics, and advertising measurement are on by default and no consent panel is shown. You can turn each of them off at any time through the Your privacy choices control; we keep that choice until you change it. We treat a Global Privacy Control signal from your browser as an opt-out of advertising measurement. Under some US state laws, sending advertising measurement data to Meta may count as “sharing” personal information; the Your privacy choices control and Global Privacy Control are how you opt out of it.
Campaign links. When you reach Cookping through one of our ads or a link tagged with campaign parameters (utm_…), we carry those parameters in the page address up to sign-up — without cookies or browser storage — and record the campaign with your new account, so we know which campaigns bring new creators. This record stays with Cookping, whatever you answer in the consent panel. The ad click identifier that comes with Meta ads (fbclid) is passed to Meta only if you accepted advertising.
Public recipe pages, public book pages and public creator pages do not activate Clerk, PostHog, client-side Sentry, or the Meta Pixel, and do not store an analytics or advertising identifier in your browser. We record page visits without a persistent browser identifier so creators can see aggregate counts. For recipe books, only a visit to the public preview is counted; opening or downloading a book's PDF is never counted as a public preview view.
5. Service providers
We share data with processors only as needed to run the service: Clerk (authentication), Meta/Instagram (messaging and webhooks), Stripe (subscription payments), Polar (recipe-book sales, as seller of record), OpenAI (recipe import parsing), Resend (transactional email), Sentry (error monitoring), PostHog (analytics, EU-hosted), Meta Platforms Ireland (advertising measurement, as described in section 4), Render (cloud hosting in the Frankfurt region), and our database (PostgreSQL) and object storage providers for recipe images and private book PDFs. Each provider is bound by its own data-processing terms.
We may also disclose data if required by law, to protect our rights or users, or as part of a merger, acquisition, or sale of assets.
6. Instagram platform data
Data received from Meta's APIs is used only to provide the features you asked for, in line with Meta's Platform Terms. Disconnecting an Instagram account stops the connection and clears its access credentials. A verified Meta data-deletion request also removes our copies of the matched account profile, media metadata and thumbnails, comments, messaging events, delivery records, contacts, and credentials. It does not delete accounts, posts, Reels, comments, or messages held by Meta, and a message already delivered to another person's inbox cannot be recalled.
Once an Instagram caption has been successfully imported and converted into a Cookping recipe, the recipe and its Cookping-hosted recipe image are treated as content you created in Cookping. They remain after Meta-only deletion, while the original Instagram URL, caption, account identifier, and other Meta source metadata are removed from the import record. Deleting your full Cookping account also deletes those imported recipes and images. You can request deletion at any time using the dashboard or the contact below.
7. Legal bases
Where the GDPR applies, we rely on: performance of a contract (running your account and automations), legitimate interests (security, abuse prevention, product analytics, service communications), consent for optional cookies, analytics, and advertising measurement — or, for visitors in the United States, who can opt out at any time, legitimate interests — and legal obligations (accounting and tax records).
8. Retention
We keep personal data for as long as your account is active and as long as needed for the purposes above. A valid deletion request starts immediately. We delete active-system data as soon as reasonably possible and no later than 30 days, except for narrow records we are legally required to retain. Inaccessible backups expire on a rolling schedule of no more than 30 days. A temporary, pseudonymous deletion request reference is retained for 30 days to prevent account recreation and support safe retry or backup recovery, then removed.
The share a creator earned from each of your payments through a creator code, and the Stripe invoice it came from, are accounting records: we keep them for 10 years, without your account once you delete it.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise these rights, email hello@cookping.app. If you are in the EU/EEA, you can also lodge a complaint with your supervisory authority (in France, the CNIL).
10. Security
Data is encrypted in transit, access is restricted to what operating the service requires, and provider credentials are stored as secrets. No system is perfectly secure, but we work to protect your data and will notify you of breaches as the law requires.
11. International transfers
Some of our providers process data outside the EU/EEA (for example in the United States). Where they do, transfers rely on safeguards such as the EU Standard Contractual Clauses or an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified).
12. Children
Cookping accounts are for adults (18+). The service is not directed at children, and we do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the service evolves. If a change is material, we will give notice (for example by email or an in-app notice) before it takes effect. The date at the top shows the latest revision.
14. Contact
For any privacy question or request, email hello@cookping.app or write to Fuxet Olivier EI, 8 Bis Rue Abel, 75012 Paris, France.