Privacy Policy

This Privacy Policy explains how Free From ("we", "us") collects, uses and protects your personal data when you use www.free-from.cc. We are committed to handling your data lawfully and transparently in accordance with the UK GDPR and the Data Protection Act 2018.

1. Who we are

Free From is operated by Tatiana Bakharevskaya, based in Berkshire, United Kingdom. For data-related queries, please use the contact form.

2. What data we collect

• Account data — first name, last name, email address, and a hashed password when you register.
• Allergen and dietary profile — the allergens and dietary preferences you choose to save. This is health-related data (special category under UK GDPR); we collect it only on the basis of your explicit consent.
• Household and cooking preferences — household size, cooking frequency, cuisine preferences.
• Usage data — anonymised analytics events (page views, search queries, recipe interactions) used to improve the service. These do not identify you personally.
• Contact submissions — name, email address and message if you use the contact form.
• Technical data — IP address (used for geolocation to show regional recipes; not stored permanently), browser type, approximate location.

3. How we use your data

• To provide and personalise the Free From service, including allergen-safe recipe filtering, meal planning, and shopping lists.
• To send email verification codes when you register or log in.
• To respond to contact form submissions.
• To improve the platform through aggregated, anonymised analytics.
• To comply with legal obligations.

4. Legal basis for processing

• Contract performance — processing your account data to provide the service you signed up for.
• Explicit consent — processing your allergen and dietary profile (special category health data). You can withdraw this consent at any time by deleting your profile data.
• Legitimate interests — anonymised analytics and platform security.
• Legal obligation — retaining certain records as required by UK law.

5. Cookies

We use two types of cookies:

• Essential cookies — a session cookie required to keep you logged in. This cookie is strictly necessary for the service to function.
• Preference cookies — a localStorage entry (ff_cookies) that stores your cookie consent choice. No advertising or tracking cookies are used.

You can withdraw cookie consent at any time using the cookie banner.

6. Data sharing

We do not sell your personal data. We share data only with:

• Resend (email delivery) — your email address is passed to Resend solely to send authentication codes and account emails.
• MaxMind GeoLite2 — IP-based approximate location lookup for regional recipe filtering. IP addresses are not transmitted to MaxMind; the lookup runs locally using a downloaded database.
• Hetzner (hosting) — our servers run on Hetzner infrastructure in the EU.

7. Data retention

• Account data is retained for as long as your account is active. You can delete your account at any time from your profile page.
• Anonymised analytics events are retained for up to 24 months.
• Contact form submissions are retained for up to 12 months.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erasure ("right to be forgotten") — request deletion of your account and all associated data.
• Withdraw consent for allergen/dietary data processing at any time.
• Portability — receive your data in a machine-readable format.
• Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any right, please use the contact form.

9. Security

Passwords are stored as bcrypt hashes. All traffic is encrypted via HTTPS. Allergen filtering operates at the database level to prevent misconfiguration exposing unsafe recipes. We apply the principle of least privilege to all internal services.

10. Children

Free From is not directed at children under 13. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this policy from time to time. Significant changes will be communicated via a notice on the site. The date at the top of this page reflects the most recent update.

12. Contact

For any data-related questions or to exercise your rights, please use the contact form.