1. Data Controller

The data controller responsible for your personal data is:

BakeWise

Website: https://bakewise.ai

If you have any questions about this Privacy Policy or our data processing practices, please contact us at the above email address.

2. Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Account Information

Full name
Email address
Phone number
Password (encrypted)
Account creation date
Last login information

2.2 Business Information

Business name (bakery name)
Business type
Business address
Tax identification number
Business license information

2.3 Usage Data

IP address
Browser type and version
Device information
Pages visited and features used
Time and date of access
Referring website addresses

2.4 Customer Data (If Applicable)

Customer names and contact information
Order history and preferences
Delivery addresses
Payment information (processed by Stripe, not stored by us)

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

Contract Performance (Art. 6(1)(b))

Processing necessary to provide our services, manage your account, and fulfill our contractual obligations to you.

Consent (Art. 6(1)(a))

For marketing communications, analytics cookies, and other optional data processing where you have provided explicit consent.

Legitimate Interests (Art. 6(1)(f))

For improving our services, security purposes, and fraud prevention, where our legitimate interests do not override your rights.

Legal Obligation (Art. 6(1)(c))

For compliance with legal obligations such as tax, accounting, and regulatory requirements.

4. How We Use Your Data

We use your personal data for the following purposes:

To provide, operate, and maintain our bakery management platform
To manage your account and provide customer support
To process transactions and send you related information
To send administrative information, updates, and security alerts
To improve and personalize your experience on our platform
To monitor and analyze usage trends and activities
To detect, prevent, and address technical issues and fraud
To send marketing communications (with your consent)
To comply with legal obligations and enforce our terms

5. Data Sharing and Third Parties

We may share your personal data with the following third parties:

5.1 Service Providers

Hetzner Online GmbH: Cloud infrastructure hosting and backups in the EU — Falkenstein, Germany and Helsinki, Finland
Cloudflare, Inc.: DNS, TLS termination and edge proxy for bakewise.ai. It sees request metadata and IP addresses in transit and stores no customer records
Stripe Payments Europe, Ltd.: Payment processing (PCI-DSS compliant). Card details are tokenised by Stripe and never stored by us
MailerSend (MailerLite, UAB): Outbound delivery of the transactional and marketing email sent from our own mail server
Meta Platforms Ireland Ltd. — WhatsApp Business Cloud API: WhatsApp notifications, only when your company enables that channel
Google LLC — Firebase Cloud Messaging: Mobile push notifications, only for users of the mobile app
Google LLC — reCAPTCHA: Bot protection on the public online-ordering forms

5.2 Data Processing Agreements

All third-party service providers are bound by Data Processing Agreements (DPAs) that ensure GDPR compliance and protect your data rights.

5.3 Legal Disclosures

We may disclose your data if required by law, legal process, litigation, or government authorities, or to protect our rights, property, or safety.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

Retention Periods:

Account data: Duration of account + 30 days after deletion request
Transaction records: 7 years (legal/tax requirements)
Audit logs: 1 year (anonymized after)
Marketing data: Until consent withdrawn + 30 days
Session data: 90 days

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right to Access (Art. 15)

Request a copy of your personal data in a structured, commonly used format.

Right to Rectification (Art. 16)

Request correction of inaccurate or incomplete personal data.

Right to Erasure (Art. 17)

Request deletion of your personal data ("right to be forgotten").

Right to Restrict Processing (Art. 18)

Request limitation of processing in certain circumstances.

Right to Data Portability (Art. 20)

Receive your data in a portable format and transfer it to another controller.

Right to Object (Art. 21)

Object to processing based on legitimate interests or for direct marketing.

Right to Withdraw Consent (Art. 7)

Withdraw consent at any time without affecting lawfulness of prior processing.

Right to Lodge a Complaint (Art. 77)

File a complaint with your local data protection authority.

How to Exercise Your Rights

You can exercise most of your rights directly from your account settings:

Download your data from Settings → Privacy → Export Data
Delete your account from Settings → Privacy → Delete Account
Manage consent from Settings → Privacy → Consent Preferences

For other requests, contact: [email protected]

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

Encryption in transit (TLS 1.2+) and at rest
Memory-hard password hashing (Argon2id)
Multi-factor authentication options
Documented internal adversarial security reviews, with every finding tracked to closure. No independent penetration test has been performed yet; we will say so here the day one is.
Access controls and role-based permissions
Tamper-evident audit logging of changes and exports
Regular backups, with point-in-time recovery and an add-only retained copy
EU data centres (Germany and Finland), with the subprocessor list published in section 5

9. International Data Transfers

Your data is primarily stored and processed in the European Union. If we transfer data outside the EU, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions for the receiving country
Binding Corporate Rules where applicable

10. Cookies and Tracking

We use cookies and similar tracking technologies. For detailed information, please see our Cookie Policy.

You can manage your cookie preferences at any time from the Cookie Preferences page.

11. Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

Posting the updated policy on our website
Updating the "Last Updated" date
Sending you an email notification (for significant changes)

Your continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

Privacy Questions or Concerns?

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact us:

Email: [email protected]

Response Time: Within 30 days of receipt

14. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

For Spain: Agencia Española de Protección de Datos (AEPD)
Website: www.aepd.es