FoodCost is a service operated by [LEGAL_ENTITY_NAME], established in Québec, Canada ([LEGAL_ADDRESS]) (“we”). This policy describes what personal information we collect, why, how we use and protect it, and your rights. It is designed to comply with Québec’s Law 25 and, where applicable, the GDPR (European Union).
1. Information we collect
Account data: email address, name (optional), preferred language — provided when you create an account. Business data you enter: ingredient names, purchase prices, recipes, technical sheets, menu prices, and related workspace data. This data belongs to you. Billing data: processed by our payment provider Stripe. We never store your card number; we only keep Stripe customer and subscription identifiers. Support data: the content of your support requests and related emails. Usage data: aggregated audience measurement of our pages (pages visited, referrers). We prefer cookieless measurement; if a tool requiring consent is used, a consent banner will be shown first.
2. Purposes and legal bases
We use your information to: provide the service (contract performance); process payments and prevent fraud (contract performance, legal obligation); send essential transactional emails — sign-in, billing, trial end, support replies (contract performance); improve the product from aggregated statistics (legitimate interest); send marketing communications only if you have explicitly consented (consent, withdrawable in one click).
We never sell your personal information. We do not use it for targeted advertising.
4. Retention
Your workspace data is retained while your account is active. If you delete your account or workspace: immediate deactivation, then permanent purge from our systems within 30 days (except where a legal retention duty applies, including accounting). Generated export files are removed from storage after 30 days. Audit logs are retained for 24 months.
5. Your rights
You may at any time: access your information; correct it; delete it; obtain a portable copy of all your data (full export available directly in Settings → Data, including after your trial expires); withdraw consent to marketing communications; request that dissemination of information cease. To exercise these rights: [CONTACT_EMAIL]. You may also lodge a complaint with the Commission d'accès à l'information du Québec (Québec's privacy regulator) or, where applicable, the competent authority in your jurisdiction.
6. Privacy officer
Under Law 25, the person responsible for the protection of personal information is: [PRIVACY_OFFICER_NAME], reachable at [CONTACT_EMAIL].
7. Security and incidents
We apply reasonable measures: encryption in transit, workspace access control (strict isolation), administrative access logging, regular backups. In the event of a confidentiality incident presenting a risk of serious harm, we will notify you and the Commission d'accès à l'information as required by law, and will keep an incident register.
9. Minors
The service is intended for professionals and is not directed at persons under 18.
10. Changes
Any material change to this policy will be notified by email or by an in-app notice at least 30 days before it takes effect.
In case of discrepancy, the French version prevails.