Privacy policy
Last updated: 2 april 2026
1. Data controller
Galivora is responsible for the processing of personal data as described in this privacy policy. If you have questions, please contact us at [email protected].
2. What data do we collect
| Data | Purpose | Legal basis |
|---|---|---|
| Username | Account identification and login | Contract performance |
| Email address (optional) | Account recovery and communication | Consent |
| Display name (optional) | Display in the platform | Contract performance |
| Password | Authentication (stored as hash) | Contract performance |
| Recipes and recipe photos | Core functionality of the platform | Contract performance |
| Payment data | Subscription management via Stripe | Contract performance |
| Newsletter email address | Sending newsletters | Consent |
| Language preference | Display the interface in the correct language | Legitimate interest |
3. Processors and third parties
We work with the following third parties:
- OpenAI - For AI-powered features: OCR import of recipes, nutritional value estimation and text refinement. Only recipe content (ingredients, preparation, titles) is sent to OpenAI - no personal data is ever shared. OpenAI processes this data in accordance with their privacy policy.
- Stripe - For payment processing. When subscribing, your restaurant name and identification number are passed to Stripe. Stripe acts as joint data controller for payment data. Stripe Privacy Policy.
4. Cookies
We only use strictly necessary cookies for the functioning of the website. See our cookie policy for more information.
5. Retention periods
- Account data: as long as your account is active, plus 30 days after deletion.
- Newsletter data: until unsubscription, then immediately deleted.
- Payment data: 7 years after the last transaction (legal obligation).
- Session data: automatically deleted after the session expires.
6. Your rights
Under the GDPR you have the following rights:
- Right of access - You can request what data we process about you.
- Right to rectification - You can have incorrect data corrected.
- Right to erasure - You can have your account and all associated data deleted via your account settings.
- Right to data portability - You can download all your data in a machine-readable format (JSON) via your account settings.
- Right to object - You can object to processing based on legitimate interest.
- Right to restriction - You can request that the processing of your data be restricted.
To exercise your rights, contact us at [email protected] or use the options in your account settings.
7. File a complaint
If you have a complaint about how we handle your data, you can contact the Dutch Data Protection Authority.