Privacy policy

Who is responsible

Bocalito is published by Samuel Jimenez, who is responsible for your data. For anything about it, write to [email protected].

What is stored

• Your account: email address, name, language, and your password — kept only as a one-way hash, never in readable form.
• Your cooking profile, if you fill it in: the country you live in, preferences, cooking skill, spice tolerance, disliked ingredients, kitchen equipment and allergies.
• What you create: the requests and notes you write, the menus and plans generated for you, your chat messages with the assistant, and any feedback you send.
• Usage records: when plans were generated, how many attempts they took and what they cost to produce.
• Security records: failed login attempts and the IP address they came from, kept for 30 days.

Allergies

Allergies are information about your health, and giving them is optional. By entering them you explicitly agree to Bocalito storing them and sending them to its AI provider, so they can be kept out of your plans. You can remove them at any time in Settings, which withdraws that agreement.

Why it is used

• To run the service you signed up for: your account, your plans, and the answers to your questions.
• To keep it secure and prevent abuse: login protection and usage limits.
• To send the emails the service needs: confirming your address and resetting your password. No newsletters.
• To understand how the service is used, with figures that do not identify you.

Who receives it

Bocalito relies on a few providers. Each receives only what it needs:

• Anthropic (United States), which runs the AI model: the content of your request — preferences, allergies, notes, chat messages and the plan being discussed. Your name and email address are not sent.
• Resend (United States), which delivers emails: your email address and the email itself.
• Cloudflare (United States), which protects and routes traffic to the site: technical connection data such as your IP address. It also counts visits to the site — pages viewed, the referring site, country and browser — without cookies and without identifying you, and stores encrypted copies of the database backups, in the European Union; they cannot be read without a key that only Bocalito holds.
• Sentry (United States), which records technical errors so they can be fixed, with the data stored in the European Union: what failed, where in the code, on which page and in which browser. Error reports carry nothing you typed — no allergies, notes or messages — and no IP address.
• OVH (France), which hosts the server where the database is kept.

These providers may process data outside the European Union, under the safeguards they provide for such transfers. Your data is never sold and never used for advertising.

How long it is kept

Your data is kept for as long as your account exists.

When you delete your account, everything that identifies you is erased straight away: your email, name, password, cooking profile and allergies, the notes and messages you wrote, and your written feedback.

What remains can no longer be linked to you and is kept as usage statistics: the plans that were generated, their size, and what they cost to produce.

The database is backed up every night, and each backup is deleted within 30 days — including the encrypted copy kept off the server. Providers keep what was sent to them according to their own retention rules.

Your rights

You can see and correct your data in Settings and delete your account there at any time. To get a copy of your data, or to object to how it is used, write to [email protected].

If you believe your data is being mishandled, you can complain to your data protection authority — in France, the CNIL (cnil.fr).

Cookies

Bocalito uses only the cookies needed to keep you logged in. Your language and your light or dark theme are remembered in your browser. There are no advertising or analytics trackers, which is why there is no cookie banner.

Age

Bocalito is not intended for anyone under 16.

Changes

If this policy changes in a way that matters, registered users will be told by email or in the app. The date at the top shows the current version.

Legal notice

Publisher: Samuel Jimenez. Contact: [email protected].

Hosting: OVH SAS, 2 rue Kellermann, 59100 Roubaix, France.