GDPR Compliance
Last updated: 23 July 2026
1. GDPR at a glance
The General Data Protection Regulation (GDPR) is EU law protecting the personal data of EU residents. ZRecipe is fully committed to GDPR compliance. This page summarises our obligations and your rights. For the full detail, see our Privacy Policy.
2. Who is the data controller?
Ziffera is the data controller for personal data collected through ZRecipe. Contact: hello@zrecipe.ie
3. Data Protection Officer
We have not appointed a formal Data Protection Officer as we are not required to under Article 37 GDPR. For any data protection matters, contact us at hello@zrecipe.ie.
4. What data we process — quick reference
| Category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data | Create and manage your account | Contract | Active account + 30 days |
| Business data (recipes, ingredients, invoices) | Provide the ZRecipe service | Contract | Active account + 30 days |
| Payment metadata | Process payments, manage subscriptions | Contract / legal obligation | 7 years |
| Support tickets | Respond to support requests | Contract / legitimate interest | 2 years |
| Server logs | Security, fraud prevention | Legitimate interest | 90 days |
| AI-processed uploads | Extract structured data from invoices/recipes | Contract | Not retained by AI provider beyond processing |
5. Your GDPR rights — how to exercise them
- Access: email hello@zrecipe.ie with “Access request” in the subject
- Rectification: edit your data directly in the app, or email us
- Erasure: request account deletion via hello@zrecipe.ie — processed within 30 days
- Portability: use the “Export data” button in Settings → Account
- Restrict processing: email hello@zrecipe.ie
- Object: email hello@zrecipe.ie
- Withdraw consent (for marketing): unsubscribe link on any marketing email, or email hello@zrecipe.ie
- Complain: contact the Irish Data Protection Commission at dataprotection.ie — you can also complain to your local supervisory authority in your EU country of residence
6. Data Processing Addendum (DPA) for business customers
If you are a business customer processing personal data of your own users, employees, or contacts through ZRecipe, you may need to sign a Data Processing Addendum with us. We provide a standard DPA on request — email hello@zrecipe.ie.
7. Sub-processors
The following sub-processors act under Article 28 GDPR on our behalf:
- Supabase (database + auth hosting) — EU region
- Vercel (application hosting)
- Stripe (payments)
- Resend (transactional email)
- Anthropic (AI processing)
- Zoho Mail (email inbox for support)
8. International transfers
Your data is stored in the EU. Some sub-processors (Anthropic, Vercel, Stripe) may process data outside the EU. Where this happens, transfers are protected by Standard Contractual Clauses or the EU-US Data Privacy Framework as applicable.
9. Data breach notification
In the unlikely event of a personal data breach affecting you, we will notify you and the Irish Data Protection Commission within 72 hours as required by Article 33 GDPR, providing details of the breach, its likely impact, and steps taken.
10. Contact
Ziffera
Kilmartin Grove, Dublin 15, D15R2NF, Ireland
Email: hello@zrecipe.ie
Data Protection Commission (Ireland): dataprotection.ie