Fuxet Olivier EI, a French sole proprietor trading as “Twist Labs”, registered under SIREN number 807437645 and SIRET number 80743764500037, located at 8 Bis Rue Abel, 75012 Paris, France, is the operator of Cookping and the data controller identified in this policy (“Cookping”, “we”, “us”). This policy explains what personal data we process, why, and what rights you have over it. It covers the marketing site, the creator dashboard, public recipe and recipe-book pages, recipe-book purchases, and the Instagram comment-to-DM delivery service.
1. Data we collect about creators
- Account data — your name, email address, and authentication identifiers, managed through our sign-in provider, Clerk.
- Content you create — recipe and recipe-book content, cover image files, recipe page and creator page settings (bio, links and featured recipes), automation configuration (keywords, messages, button labels, links), and any custom URLs you configure.
- Instagram data — when you connect an Instagram account: account and profile metadata, your posts and Reels metadata, comments on those posts, and message delivery events, received through the official Meta APIs and webhooks.
- Billing and selling data — your plan, subscription status, payment history, and the status of your Polar connection (the organization you sell books through, and encrypted access tokens). Card and bank-account details are handled by Stripe and Polar; we never store full card or bank-account numbers.
- Usage and diagnostics — product analytics events (pages viewed, features used) and error and performance diagnostics, as described in section 4.
2. Data we process about followers, public visitors, and book buyers
When someone interacts with a creator's automation, public page, or paid book, we process a limited set of data so the service can work:
- comments containing a trigger keyword, and the Instagram-scoped user ID of the commenter;
- direct-message events and their timestamps — we keep the time of the last inbound message so we never send outside Instagram's allowed 24-hour messaging window;
- when a creator enables follow-gating, the result of Instagram's follow-status check;
- recipe page visits, public book-preview visits, and link clicks, aggregated into creator analytics without a persistent browser identifier;
- for a book purchase: the order reference, amount, tax and refund status that Polar reports to us. The purchase itself, the buyer's email address, the receipt and the file download are handled by Polar, the seller of record; Cookping stores no buyer identity.
We process this data to provide the service to the creator whose account or page the person interacted with and, for buyers, to fulfil and support the purchase. Followers, visitors, and buyers can exercise the rights in section 9 with us or with that creator.
3. How we use data
- operating the service: publishing recipe pages and books, delivering automated messages, mirroring book sales reported by Polar;
- enforcing Instagram's messaging rules, plan quotas, and abuse limits, and sending service emails such as quota alerts (via our email provider, Resend);
- parsing recipes you import: the text or caption you submit is sent to our AI provider (OpenAI) solely to structure it into a recipe;
- billing, the creator's Polar connection, sales reporting, and account management;
- measuring, debugging, and improving the product;
- security, fraud and abuse prevention, and compliance with legal obligations.
We do not sell personal data, and we do not use it for third-party advertising.
4. Cookies and analytics
- Authentication cookies — Clerk sets cookies required to keep you signed in.
- Product analytics — we use PostHog, hosted in the EU, to understand how the product is used. Its browser identifier is stored in local storage rather than an analytics cookie.
- Error monitoring — we use Sentry to collect errors and performance data. Session replays are masked: text, inputs, and media are blocked from capture.
PostHog and client-side Sentry are optional. They remain disabled until you accept analytics and diagnostics in the consent panel. Refusing them does not limit the site or product. You can change or withdraw your choice at any time through the Cookie preferences control. We retain either choice for six months before asking again.
Public recipe pages, public book pages, and private book readers do not activate Clerk, PostHog, or client-side Sentry, and do not store an analytics identifier in your browser. We record page visits without a persistent browser identifier so creators can see aggregate counts. For recipe books, only a visit to the public preview is counted; opening a private full reader or downloading its PDF is never counted as a public preview view.
5. Service providers
We share data with processors only as needed to run the service: Clerk (authentication), Meta/Instagram (messaging and webhooks), Stripe (subscription payments), Polar (recipe-book sales, as seller of record), OpenAI (recipe import parsing), Resend (transactional email), Sentry (error monitoring), PostHog (analytics, EU-hosted), Render (cloud hosting in the Frankfurt region), and our database (PostgreSQL) and object storage providers for recipe images and private book PDFs. Each provider is bound by its own data-processing terms.
We may also disclose data if required by law, to protect our rights or users, or as part of a merger, acquisition, or sale of assets.
6. Instagram platform data
Data received from Meta's APIs is used only to provide the features you asked for, in line with Meta's Platform Terms. Disconnecting an Instagram account stops the connection and clears its access credentials. A verified Meta data-deletion request also removes our copies of the matched account profile, media metadata and thumbnails, comments, messaging events, delivery records, contacts, and credentials. It does not delete accounts, posts, Reels, comments, or messages held by Meta, and a message already delivered to another person's inbox cannot be recalled.
Once an Instagram caption has been successfully imported and converted into a Cookping recipe, the recipe and its Cookping-hosted recipe image are treated as content you created in Cookping. They remain after Meta-only deletion, while the original Instagram URL, caption, account identifier, and other Meta source metadata are removed from the import record. Deleting your full Cookping account also deletes those imported recipes and images. You can request deletion at any time using the dashboard or the contact below.
7. Legal bases
Where the GDPR applies, we rely on: performance of a contract (running your account and automations), legitimate interests (security, abuse prevention, product analytics, service communications), consent where required, and legal obligations (accounting and tax records).
8. Retention
We keep personal data for as long as your account is active and as long as needed for the purposes above. A valid deletion request starts immediately. We delete active-system data as soon as reasonably possible and no later than 30 days, except for narrow records we are legally required to retain. Inaccessible backups expire on a rolling schedule of no more than 30 days. A temporary, pseudonymous deletion request reference is retained for 30 days to prevent account recreation and support safe retry or backup recovery, then removed.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise these rights, email hello@cookping.app. If you are in the EU/EEA, you can also lodge a complaint with your supervisory authority (in France, the CNIL).
10. Security
Data is encrypted in transit, access is restricted to what operating the service requires, and provider credentials are stored as secrets. No system is perfectly secure, but we work to protect your data and will notify you of breaches as the law requires.
11. International transfers
Some of our providers process data outside the EU/EEA (for example in the United States). Where they do, transfers rely on safeguards such as the EU Standard Contractual Clauses or an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified).
12. Children
Cookping accounts are for adults (18+). The service is not directed at children, and we do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it.
13. Changes to this policy
We may update this policy as the service evolves. If a change is material, we will give notice (for example by email or an in-app notice) before it takes effect. The date at the top shows the latest revision.
14. Contact
For any privacy question or request, email hello@cookping.app or write to Fuxet Olivier EI, 8 Bis Rue Abel, 75012 Paris, France.