Privacy Policy

Last updated: October 22, 2026

1. Who we are

ANNA che PASTRY (annachepastry.com, the “Platform”, “we”) is operated by Anna Chernii pr Beograd, a sole proprietor registered in the Republic of Serbia, Belgrade. We are the controller of your personal data.

We process personal data in accordance with the Serbian Law on Personal Data Protection and, for users in the European Union and the European Economic Area, the General Data Protection Regulation (GDPR).

Contact for any privacy question or request: support@annachepastry.com.

2. What data we collect

Account data: your email address and password (stored only as a secure hash). If you sign in with Google, we receive your email address and the basic profile data Google shares (name and profile picture).
Your content: recipes, drafts and settings you save in your account.
Text and photos you submit for recipe recognition: they are sent to our AI provider to extract the recipe. We do not store the photos; we keep only the resulting recipe if you save it (signed-in users get a draft in “My recipes”).
AI assistant chat (signed-in users only): your messages and the assistant’s replies, a note that a photo was attached, and the page the question was asked from (for example, a recipe). A photo is sent to our AI provider together with the question, and we do not store it. To answer, the assistant receives the recipe from the page you are on; for a personal recipe, only one that belongs to you.
Assistant settings: the unit system, experience level and kitchen equipment you choose. We store dietary restrictions (allergies, vegetarian diet and similar) only if you tick a separate consent box. Information about allergies may count as health data.
Credits: your credit balance and history (when and for what a credit was used or returned, including assistant messages), linked to a record of the AI call (model, number of tokens, duration), without the recipe text, messages or photos.
Messages to us: your name, email address and message when you use the feedback form, and technical error reports (page, error message, browser).
Technical data: IP address, browser and device type, pages requested. We use the IP address to limit abuse (for example, the number of free recognitions for guests) and our hosting keeps standard server logs.
Analytics data — only with your consent: pages visited, visit source, approximate location by IP, device and browser, collected by Google Analytics (see section 6).

3. Why we process data and on what legal basis

To provide the service — accounts, saving recipes, recipe recognition, calculators, credits (performance of a contract).
To answer your questions in the assistant chat and remember the conversation, using your chat history and assistant settings (performance of a contract).
To let the assistant take your dietary restrictions into account — only with your explicit consent. You can withdraw it at any time by unticking the box in the assistant settings; the restrictions are deleted immediately.
To answer your messages and fix errors you report (our legitimate interest in supporting users; your request).
To keep the Platform secure and prevent abuse — request limits, protection against automated misuse, server logs (our legitimate interest).
To understand how the Platform is used and improve it — Google Analytics (your consent, which you can withdraw at any time); anonymous page-view statistics of Vercel Web Analytics on calculator pages, which use no cookies (our legitimate interest).
To comply with legal obligations, for example accounting and tax rules once paid plans are available (legal obligation).

4. Service providers we use

We share data only with providers that help us run the Platform and only to the extent they need it. They act as our processors under data processing agreements, except where stated otherwise.

Supabase — database and sign-in; data is stored in the EU (Ireland).
Vercel — website hosting, server logs and Vercel Web Analytics (cookieless) on calculator pages.
Google — the Gemini API for recipe recognition and the AI assistant (text and photos you submit, chat questions, the page recipe, assistant settings and, only with your consent, dietary restrictions). Under Google’s paid API terms, this data is not used to train Google’s models; Google may keep it for a limited time to detect abuse. Also Google Sign-In and Google Analytics (only with your consent).
Resend — delivery of feedback-form messages to us.
Upstash — storage of request counters (IP address or account ID) used for abuse limits.
Cloudflare — Turnstile checks that the sign-up, sign-in, password reset and feedback forms are submitted by a person, not a program. For this, Cloudflare receives your IP address and technical browser data; the data is not used for advertising.

5. Transfers outside Serbia and the EU

Some providers are located outside Serbia and the EU/EEA, mainly in the United States. Such transfers rely on safeguards provided by law, such as the EU–US Data Privacy Framework or standard contractual clauses.

6. Cookies and similar technologies

Necessary: sign-in session cookies (Supabase) and browser storage for your cookie choice, unit preference and an unsaved recipe draft. They are required for the Platform to work and do not need consent. On the sign-up, sign-in, password reset and feedback forms, a Cloudflare Turnstile check (bot protection).

Analytics — only after you click “Accept”: Google Analytics (_ga, _ga_*). If you click “Reject”, this script is not loaded.

You can change your choice at any time: (also at the bottom of every page). When you withdraw consent, analytics cookies are deleted and the page reloads.

7. How long we keep data

Account, recipes, drafts and credits — until you delete your account.
Assistant chat history — 90 days after the last message in the conversation, then deleted automatically; earlier if you press “Clear history” or delete your account.
Assistant settings and dietary restrictions — until you change them, withdraw consent or delete your account.
Feedback messages and error reports — 180 days; deleted earlier together with your account.
IP-based request counters — from a few minutes up to 30 days (the free-recognition limit for guests).
Records of AI calls (recognition and the assistant) — kept for cost accounting; they contain no recipe text, messages or photos.
Analytics data — according to the retention settings of Google Analytics.

8. Your rights

Access — get a copy of your personal data.
Rectification — correct inaccurate data.
Erasure — delete your account and related data; you can do this yourself in your account (“Delete account”) or ask us.
Restriction and objection — limit or object to processing based on our legitimate interest.
Data portability — receive the data you provided in a machine-readable format.
Withdrawing consent — at any time: for cookies via , for dietary restrictions by unticking the box in the assistant settings. This does not affect processing before the withdrawal.

To exercise your rights, write to support@annachepastry.com. We reply within 30 days.

You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs) or, if you live in the EU/EEA, with the data protection authority of your country.

9. Children

The Platform is not intended for children under 16. We do not knowingly collect personal data of children under 16; if you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

We will update this page when our data practices change and show the date of the last update at the top. If changes are significant, we will notify signed-in users by email or on the Platform.