Privacy Policy

We take the protection of your personal data seriously and treat your data confidentially and in accordance with the statutory data protection regulations, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications-Digital-Services Data Protection Act (TDDDG, formerly TTDSG).

1. Controller

The controller within the meaning of the GDPR is:

Markus Springer
c/o Postflex #12345
Emsdettener Straße 10
48268 Greven
Deutschland
Phone: +49 123 4567890
E-mail: info@thermify.ai

A data protection officer does not have to be appointed pursuant to § 38 BDSG, as the requirements (in particular the minimum number of employees) are not met. If you have any questions regarding data protection, please contact the e-mail address listed above directly.

2. Overview of Processing Activities

We process personal data only insofar as this is necessary for the provision of the Service or another legal basis under Art. 6 (1) GDPR exists. Below you will find a detailed overview of all processing operations.

3. Provision of the Website (Server Logs)

When you access our website, your device's browser automatically transmits information that is temporarily stored in a log file:

• IP address (truncated before storage)
• Date and time of access
• Content of the request (specific page/endpoint)
• HTTP status code
• Volume of data transferred in each case
• Referrer URL
• Browser type and operating system

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in the operation and security of the Service).
Retention period: A maximum of 14 days, unless longer retention is required for security analyses following an incident.
Recipients: Hosting provider (see Section 13).

4. Registration and Account

Registration is required in order to use the Service. It takes place either via Google, Apple or via an e-mail magic link through Firebase Authentication. The following data is processed:

• E-mail address
• Display name and, where applicable, profile picture (insofar as provided by the IdP)
• Firebase User ID (UID)
• Registration timestamp

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract).
Retention period: For the duration of the contract plus commercial law retention periods (usually 6 years).
Recipients: Google Ireland Limited (Firebase Authentication).

5. Recipe Processing

When you upload a recipe photo, recipe text or a URL, this content is transmitted to our server and analyzed there by an AI model (Google Gemini, brokered via OpenRouter). The uploaded image is stored only for the duration of processing and deleted afterwards. The recipe generated from it is stored in our database (Firebase Firestore, Google Cloud region europe-west) for permanent availability. When you delete a recipe, it disappears from your cookbook; we keep a copy so we can trace conversion errors and improve the service.

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract).
Retention period: Until deleted by you or until your account is deleted. Uploaded original images are deleted immediately after successful processing; the generated representation is retained.
Recipients: Google Ireland Limited (Firestore, Cloud Run), OpenRouter Inc. (USA), Google LLC (Gemini API, USA).

6. Payment Processes (Stripe)

Payments for the Plus subscription and top-up are processed exclusively via Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). Stripe is an independent controller for the processing of payment data; we receive the following information from Stripe:

• Stripe Customer ID
• Stripe Subscription ID and status (active, past_due, cancelled)
• last four digits of the card and card brand (for display in the customer area)
• billing timestamps and amounts

Complete payment data (card number, CVV, bank details) is never transmitted to us. Stripe's privacy notice: stripe.com/de/privacy.

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract) as well as Art. 6 (1) lit. c GDPR (compliance with legal obligations, in particular commercial bookkeeping obligations).
Retention period: 10 years (commercial law retention obligations, § 257 HGB, § 147 AO).
Recipients: Stripe Payments Europe Ltd. (Ireland) and downstream credit card networks (Visa, Mastercard, American Express).

7. E-mails, Tips and News (Resend)

Transactional e-mails (confirmation of recipe conversion, VIP invitation, payment confirmations) and occasional e-mails with tips and news about Thermify are sent via Resend Inc. (2261 Market Street, San Francisco, CA 94114, USA). The following is transmitted: e-mail address, name (if provided), content token (e.g. recipe ID) as well as sending and delivery status (Delivered, Bounce, Open).

We send newsletters and e-mails with tips and news to existing customers on the basis of § 7 (3) UWG (advertising to existing customers for our own, similar services). You can object to the use of your e-mail address for advertising purposes at any time and free of charge - either via the one-click unsubscribe link in every e-mail (RFC 8058) or by e-mail to info@thermify.ai.

Legal basis: Art. 6 (1) lit. b GDPR (transactional e-mails), Art. 6 (1) lit. f GDPR in conjunction with § 7 (3) UWG (advertising to existing customers), or Art. 6 (1) lit. a GDPR (express consent, where given).
Retention period: Until objection or termination of the contract; sending logs for a maximum of 90 days.
Recipients: Resend Inc. (USA).

8. AI Processing (OpenRouter / Google Gemini)

For recipe conversion, image and text content is transmitted to OpenRouter Inc. (San Francisco, USA), which forwards the request to Google Gemini (Google LLC, USA). In doing so, we transmit only the recipe content as well as an internally generated processing ID. Personal data (e-mail, name) is not transmitted. The model operators are contractually prohibited from using the content for training purposes.

Legal basis: Art. 6 (1) lit. b GDPR.
Retention period at the recipient: Pursuant to their API terms, a maximum of 30 days for abuse detection, after which deletion.
Recipients: OpenRouter Inc. (USA), Google LLC (USA).

9. Cookidoo® Integration (Vorwerk)

The converted recipe is created as "My Creation" via the official Cookidoo® API of Vorwerk International AG (Verenastrasse 39, 8832 Wollerau, Switzerland) and stored in your Cookidoo® account. For this purpose, we transmit the recipe content as well as the Cookidoo® access credentials you provide to Vorwerk. We store your Cookidoo® access credentials exclusively in encrypted form for the duration of the process and not permanently. The subsequent data processing is the sole responsibility of the Vorwerk group in accordance with its data protection provisions.

Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract).
Retention period for access credentials: Only transient during processing.
Recipients: Vorwerk International AG (Switzerland, adequacy decision of the EU Commission).

10. Cookies, Local Storage and Tracking

We use the following storage and tracking technologies on our website. We obtain consent for the use of non-essential technologies pursuant to § 25 TDDDG before they are activated. You can revoke your consent at any time via the cookie settings .

10.1 Essential Storage Access (no consent required)

• Firebase auth token (localStorage): Login session, remains active until logout.
• Cookidoo® session: Encrypted session token for connecting to Vorwerk.
• Consent status (`thermify.consent.v2`): Stores your consent per category. Without this entry, we could not hide the cookie banner.
• Recipe history (localStorage): Stores the last 50 recipe IDs locally for quick display.

Legal basis: § 25 (2) No. 2 TDDDG (technically necessary) in conjunction with Art. 6 (1) lit. b GDPR.

10.2 Statistics (only with consent)

• Google Analytics 4 (GA4): Reach and usage measurement. IP anonymization is active; cookies (`_ga`, `_ga_*`) are stored for 14 months. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
• PostHog (EU): Session recording, heatmaps and product analytics. We transmit your user ID, your e-mail address and your display name so that analyses can be attributed to a person, along with the associated usage events. Free-text content such as support messages or feedback comments is not transmitted. Input fields and images are masked in recordings. Provider: PostHog BV, Amsterdam, Netherlands (EU hosting).

Legal basis: § 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR (consent).
Retention period: 14 months; until consent is revoked.
Third-country transfer: yes, USA - safeguarded by the EU-US Data Privacy Framework (adequacy decision EU 2023/1795) and standard contractual clauses.

10.3 Marketing (only with consent)

• Meta Pixel: Conversion measurement and audience building for campaigns on Facebook/Instagram. Provider: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.
• Server-side mirroring: We additionally mirror certain conversions (e.g. completed purchases) server-side via the Meta Conversion API (CAPI) and the Google Measurement Protocol. For this purpose, hash values (SHA-256) of the e-mail address and Stripe Customer ID are transmitted. This processing only takes place if marketing consent has been given.

Legal basis: § 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR (consent).
Retention period: Cookies up to 90 days; server-side mirror events 25 months at the recipient.
Third-country transfer: yes, USA - safeguarded as under 10.2.

11. Newsletter and Advertising to Existing Customers

We use your e-mail address to send information about our own, similar services, provided you have not objected to this use (§ 7 (3) UWG). You may object at any time without incurring any costs. Any advertising communication beyond this only takes place with your express consent in a double opt-in procedure.

12. Recipients and Processors

We use the following processors. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with all of them.

13. Data Transfer to Third Countries

Some of the recipients listed above (Resend, OpenRouter, Google LLC, Netlify) are based in the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023, ref. 2023/1795) and additionally on the basis of EU standard contractual clauses (Art. 46 (2) lit. c GDPR). Despite these protective measures, it cannot be ruled out that US authorities may access the data within the scope of their national access rights (e.g. FISA 702).

14. Retention Period and Deletion

Personal data is stored only for as long as is necessary for the respective purposes. After termination of the contract, the data is deleted or anonymized, unless statutory retention obligations (in particular § 257 HGB and § 147 AO) exist. Invoice records and accounting data are retained for ten years.

15. Your Rights

You have the right at any time to:

• Access to the data processed about you (Art. 15 GDPR)
• Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
• Erasure of your data ("right to be forgotten", Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR) - in particular to direct marketing
• Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)
• Lodging a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, contact us informally at info@thermify.ai. We will respond within the statutory time limits (usually within one month).

16. Right to Lodge a Complaint with the Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority with local jurisdiction for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Phone: +49 981 180093-0
Web: https://www.lda.bayern.de

17. Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR with legal effect concerning you, does not take place.

18. Data Security

Our website and API use exclusively TLS 1.2 or higher (HTTPS). Data at rest is encrypted on Google Cloud and Stripe infrastructure. Access to production data is restricted to the Provider and secured by multi-factor authentication.

19. Amendments to this Privacy Policy

We reserve the right to amend this Privacy Policy if the legal situation, the technology stack used or the processing activities change. The respective current version is available on this page.

Last updated: 2026-05-25