This document is a draft prepared for review. It describes how Palatis intends to work and is not legal advice.
Palatis B.V. runs the palate profiling service at palatis.app. To do that we hold something more personal than an email address: a record of how you taste, what you avoid, what is on your shelves and what you cooked last Tuesday. This policy sets out exactly what we hold, why we are allowed to hold it, how long we keep it and how you get it back or get rid of it.
It covers the website, the Palatis app, the flavor coach, the grocery hand-off and our support mailbox.
Who is responsible
The controller is Palatis B.V., Keizersgracht 271, 1016 ED Amsterdam, Netherlands, registered with the Dutch Chamber of Commerce under KvK 89 214 776, VAT NL004512882B01. Our data protection officer is Ines Kruger. Write to [email protected] for anything in this document; it reaches the DPO directly, not a support queue.
What we hold
- Account data. Email address, a hashed password or a sign-in token, display name, locale, plan and household membership.
- Palate profile. Your answers to the setup pairings and the scores derived from them across acid, umami, heat, fat and bitter edge, plus every recalibration.
- Dietary data. Allergens, intolerances, exclusions such as no pork or no alcohol, macro and sodium targets, and any free-text note you add about why.
- Pantry data. Items, quantities, purchase and best-before dates, and the photographs you upload for pantry sync.
- Build history. The meal builds we produced, which ones you cooked, skipped, swapped or rated, and the coach notes attached to them.
- Grocery hand-off data. The basket you approved, the partner you sent it to, and whether the hand-off succeeded.
- Billing data. Plan, billing country, VAT status, invoice history and the last four digits and brand of the card. We never see the full card number; our payment processor holds it.
- Support data. Your messages to us and any screenshot or photo you attach.
- Technical data. IP address, device and browser type, app version, crash reports, and first-party usage counts. See the Cookie Policy for the browser detail.
Dietary data and the special-category question
Most dietary information is a preference, not a medical record. Some of it is not. A gluten exclusion may reflect coeliac disease, a sodium ceiling may reflect a cardiac diagnosis, and a pregnancy setting is health data by definition. Where a field could reveal a health condition we treat it as special-category data under Article 9 GDPR and rely on your explicit consent, requested in plain language at the point you enter it.
Practical consequences: those fields are optional, they are excluded from every analytics and model-training dataset, they are never shared with a grocery partner, and withdrawing consent deletes them within 24 hours. Palatis will keep working without them — it will simply be less careful about what it suggests, and it will tell you so.
Why we use it, and on what legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Running your account and the app | Account, palate, pantry, build history | Performance of a contract (Art. 6(1)(b)) |
| Building meals that respect your allergens | Dietary data | Explicit consent (Art. 9(2)(a)) |
| Sending a basket to a grocery partner | Basket line items, delivery locale | Performance of a contract |
| Taking payment and issuing invoices | Billing | Contract and legal obligation |
| Keeping tax and accounting records | Billing | Legal obligation (Art. 6(1)(c)) |
| Answering support requests | Support, account | Contract and legitimate interest |
| Fraud, abuse and rate-limit enforcement | Technical, account | Legitimate interest (Art. 6(1)(f)) |
| Improving the palate model | De-identified build outcomes | Legitimate interest, with opt-out |
| Weekly build email and product news | Account, build history | Consent (Art. 6(1)(a)) |
| Measuring how the site is used | Technical | Consent (analytics cookies) |
Who we share it with
We do not sell personal data, we do not run behavioural advertising, and we never hand your palate profile or dietary flags to a grocery partner. Processors act only on our instructions, under a written data processing agreement, and only for the purpose named here.
| Processor role | What it touches | Location | Safeguard |
|---|---|---|---|
| Cloud hosting and managed database | All service data | Germany | EEA processing, DPA, encryption at rest |
| CDN, TLS and abuse filtering | Technical data in transit | EU edge nodes | DPA, EU-first routing |
| Language model for the flavor coach | Build prompts, pantry text | France | EEA processing, DPA, contractually excluded from vendor training |
| Subscription billing and card handling | Billing data | Ireland | EEA processing, PCI DSS, DPA |
| Transactional and newsletter email | Email address, send status | United States | Standard Contractual Clauses, transfer impact assessment |
| Privacy-first product analytics | De-identified usage counts | Estonia | EEA processing, no cross-site tracking |
| Support ticketing | Support data | Germany | EEA processing, DPA |
Grocery partners such as Freshcart or Umamiya receive the basket you approved and nothing else — no profile, no allergens, no build history. For that basket they act as their own controller under their own privacy policy. The current named sub-processor list is available on request from [email protected], and we give 30 days notice before adding one.
Automated decisions
The palate model ranks and generates suggestions. It does not make decisions with a legal or similarly significant effect on you, so Article 22 does not bite. Nothing it produces is binding: every build is a proposal you accept, edit or ignore, and you can ask the coach why it suggested something and get a plain answer.
How long we keep it
- Account, palate profile and dietary data: for as long as your account is open. Deleting the account removes them within 30 days, backups included.
- Pantry photographs: 90 days after processing, then deleted. The extracted item list stays until you remove it.
- Build history: 24 months rolling, or until you clear it from Settings.
- Grocery hand-off records: 12 months, for dispute resolution.
- Invoices and billing records: seven years, as Dutch tax law requires.
- Support conversations: three years from the last message.
- Technical logs: 30 days, then aggregated beyond recovery.
- Marketing consent and suppression records: until you unsubscribe, plus a permanent do-not-email record so we cannot re-add you.
Transfers outside the EEA
Service data is stored in the European Union. The one routine exception is our email provider in the United States, where we rely on the European Commission Standard Contractual Clauses together with a documented transfer impact assessment and encryption in transit. We will tell you before that picture changes.
Your rights
You can ask us for a copy of your data, correct it, delete it, restrict or object to a use, withdraw a consent, or receive your palate profile, pantry and build history as a machine-readable export. The export is self-serve in Settings and takes about a minute; everything else goes to [email protected].
We answer within 30 days, we do not charge, and we will not degrade your service because you asked. Where we refuse a request we say which exemption we are relying on.
Security
Traffic is TLS-encrypted, data is encrypted at rest, passwords are hashed with a memory-hard function, and staff access to production records requires multi-factor authentication, a stated reason and an audit log entry. Access to dietary data is restricted to the smallest group that can still support you. If a breach affects you and poses a risk, we notify you and the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it.
Children
Palatis is not directed at children under 16 and we do not knowingly hold their data. A Table plan may include a child as a palate managed by an adult account holder; in that case the adult supplies the information and is responsible for it, and we hold no direct account for the child.
Complaints
Talk to us first — the DPO reads every message. If you are still unhappy you can complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens in The Hague, or to the authority where you live if that is elsewhere in the EEA. You can also go to court.
Changes
If we make a material change we publish the new version here and email account holders at least 14 days before it takes effect. The date at the top of this page is always the version in force.