Privacy Policy

Last updated: March 2026

This Privacy Policy explains how Dual Alliance Tech, LLC, doing business as KiWi Recipes ("KiWi Recipes," "we," "us," or "our") collects, uses, shares, and protects your personal data when you use the KiWi Recipes mobile application, browser extension, website, and related services (collectively, the "Service"). We are committed to transparency and to protecting your privacy across every jurisdiction in which we operate.

1. Who We Are

Dual Alliance Tech, LLC is a California limited liability company. We are the data controller (GDPR) and business (CCPA) responsible for your personal data.

For privacy inquiries: privacy@kiwirecipes.app

2. Data We Collect

We collect different types of data depending on how you use the Service. You can use many features without creating an account.

a) Account Data

• Email address (if you sign in with email, Google, or Apple)
• Display name (if provided by your sign-in provider)
• Authentication method and provider identifiers
• Subscription tier (free or subscriber)

b) Content You Create

• Recipes you create, import, save, or modify (including ingredients, instructions, notes, and images)
• Meal plans and weekly schedules
• Shopping lists, grocery items, stores, and shopping trip history
• Recipe collections and organization
• Chat conversations with the AI assistant (KiKi)

c) Preferences & Dietary Data

• Food allergies and dietary restrictions (e.g., nut-free, halal, vegan)
• Disliked ingredients and texture preferences
• Unit system (metric or imperial), language, and theme preferences
• Notification preferences and calorie targets

d) Usage & Analytics Data

• Login events (timestamp, platform, authentication method)
• Recipe view events (which recipes you view, source, timestamp)
• AI recipe generation events (title, model used, generation time)

e) Device & Technical Data

• Device platform (iOS, Android, macOS)
• App version and build number
• Crash reports and error logs (release builds only, via Firebase Crashlytics)

f) Location Data

• Store locations you save (latitude/longitude), only when you explicitly use the store location feature
• We do not track your location in the background or for any purpose other than store distance sorting

g) Photos & Images

• Recipe photos you take or select from your photo library (only when you explicitly upload or photograph)
• Photos of dishes or cookbook pages submitted for AI recognition (processed and stored temporarily for up to 3 days)

h) Push Notification Data

If you enable push notifications, we store your device notification token and basic app presence state (foreground/background) to avoid sending unnecessary notifications while you are actively using the app.

3. How We Use Your Data

We use your data for the following purposes:

• Provide, operate, and maintain the Service, including recipe storage, meal planning, shopping lists, and AI features
• Synchronize your data across your devices when you sign in
• Enable family sharing features so household members can share recipes, meal plans, and shopping lists
• Generate AI-powered recipe suggestions, modifications, and translations based on your preferences and dietary needs
• Filter and flag recipes for allergen safety based on your dietary settings
• Send push notifications you have opted into (e.g., recipe timer completions, cooking reminders)
• Analyze aggregated, de-identified usage patterns to improve the Service (e.g., which recipe categories are most popular)
• Diagnose and fix technical issues using crash reports
• Respond to your support requests

4. Legal Bases for Processing (EEA/UK Users)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

5. Data Sharing & Third-Party Processors

We share your data only with the service providers necessary to operate the Service. We have Data Processing Agreements (DPAs) with each processor listed below.

We do not sell, rent, or trade your personal data to third parties. We do not share your data with advertisers. We do not use your data for third-party marketing.

6. International Data Transfers

Your data is stored and processed on Google Cloud infrastructure located in the United States (us-central1 region). If you are located outside the United States, your data will be transferred to and processed in the United States.

We rely on the following safeguards for international transfers:

• EU/EEA: The EU-U.S. Data Privacy Framework (DPF), under which Google is certified. Where the DPF does not apply, we rely on Standard Contractual Clauses (SCCs) incorporated into Google's Data Processing Addendum.
• United Kingdom: The UK Extension to the EU-U.S. DPF, and the UK International Data Transfer Agreement as a fallback.
• Japan: We inform you pursuant to Article 28 of the APPI that your data is transferred to the United States, a country that the PPC has not designated as having equivalent data protection. Google maintains data protection measures described in its Data Processing Addendum.

7. Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

8. Security

We take the security of your data seriously and implement the following measures:

• All data in transit is encrypted using TLS/HTTPS
• All data at rest is encrypted on Google Cloud infrastructure
• Sensitive credentials (API keys, auth tokens) are stored using platform-native encrypted storage (iOS Keychain, Android EncryptedSharedPreferences)
• Firebase Security Rules enforce that users can only access their own data (or their family's shared data)
• Firebase App Check validates that requests originate from authentic app installations

9. Children's Privacy

We do not knowingly collect personal data from children under 13 (or under the applicable age of digital consent in your jurisdiction, such as 16 in the Netherlands and Germany). If you are under 13, please do not use the Service or provide any personal data.

Our family sharing features are designed so that a parent or guardian (who must be at least 13 years old) creates and manages the account. Family members access shared recipes, meal plans, and shopping lists through the account holder's family group. Children do not create their own accounts.

If we learn that we have collected personal data from a child under 13 without verifiable parental consent, we will delete that data promptly. If you believe we have collected data from a child under 13, please contact us at privacy@kiwirecipes.app.

10. Your Rights

Regardless of where you live, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data and account
• Data portability: Request your data in a structured, machine-readable format
• Withdraw consent: Where processing is based on consent, withdraw it at any time (this does not affect processing before withdrawal)

To exercise any of these rights, email us at privacy@kiwirecipes.app. We will respond within 30 days (or sooner if required by applicable law). We may ask you to verify your identity before fulfilling your request.

11. Additional Rights for EU/EEA/UK Residents

If you are in the European Economic Area or the United Kingdom, you have the following additional rights under the GDPR / UK GDPR:

• Right to restrict processing: You can ask us to limit how we use your data while a complaint is being resolved
• Right to object: You can object to processing based on our legitimate interests; we will stop unless we demonstrate compelling legitimate grounds
• Automated decision-making: We do not make decisions based solely on automated processing that produce legal effects concerning you. Our AI features generate recipe suggestions, not decisions about you.
• Data portability: You can request your data in a commonly used, machine-readable format and have it transmitted to another controller

You also have the right to lodge a complaint with your local data protection authority. For the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). For the United Kingdom, this is the Information Commissioner's Office (ico.org.uk). For other EU member states, you can find your authority at edpb.europa.eu.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

• Right to know: You can request the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes, and the categories of third parties with whom we share it
• Right to delete: You can request deletion of your personal information, subject to certain exceptions
• Right to correct: You can request correction of inaccurate personal information
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights (e.g., by charging different prices or providing a different level of service)

Categories of personal information we collect (as defined by the CCPA): Identifiers (email, name, account ID); internet or electronic network activity (usage analytics, recipe views); geolocation data (store locations you save); sensory data (photos you upload); inferences drawn from dietary preferences to personalize recipes. We collect these categories for the business purposes described in Section 3.

We do not sell or share your personal information as defined by the CCPA/CPRA. We do not use or disclose sensitive personal information for purposes other than providing the Service. Because we do not sell personal information, we do not offer a "Do Not Sell" opt-out — there is nothing to opt out of.

13. Rights for Users in Japan (APPI)

If you reside in Japan, the Act on the Protection of Personal Information (APPI) grants you the following rights:

• Disclosure: You may request disclosure of the personal information we hold about you and the purpose for which it is used
• Correction: You may request correction, addition, or deletion of your personal information if it is inaccurate
• Cessation of use: You may request that we stop using or delete your personal information if it was acquired improperly or is no longer necessary
• Cessation of third-party provision: You may request that we stop providing your personal information to third parties

Cross-border transfer notice: Your personal data is transferred to and processed in the United States by Dual Alliance Tech, LLC and its service providers (Google Cloud). The United States has not been recognized by Japan's Personal Information Protection Commission (PPC) as a jurisdiction with an equivalent level of data protection. We ensure appropriate measures are in place through Google's Data Processing Addendum and contractual safeguards. You may contact the PPC (ppc.go.jp) with questions or complaints.

14. Rights for Users in South Korea (PIPA)

If you reside in South Korea, the Personal Information Protection Act (PIPA) grants you the following rights:

• Access: You may request access to your personal information and details of how it is processed
• Correction and deletion: You may request correction of inaccurate information or deletion of your personal information
• Suspension of processing: You may request that we suspend processing of your personal information
• Right to be notified: You have the right to be notified of the collection, use, and provision of your personal information to third parties

Specific items of personal information collected: email address, display name (if provided), user ID, dietary preferences and allergies, recipe content you create, store locations you save, recipe view events, device platform, and crash reports. These items are collected for the purposes described in Section 3 and retained for the periods described in Section 7. Personal information is provided to the third-party processors listed in Section 5 for the stated purposes only.

Data Protection Officer: For PIPA-related inquiries, contact privacy@kiwirecipes.app. You may also file a complaint with the Personal Information Protection Commission (PIPC) at pipc.go.kr.

15. Rights for Users in Brazil (LGPD)

If you reside in Brazil, the Lei Geral de Proteção de Dados (LGPD) grants you the following rights:

• Confirmation and access: You may request confirmation of whether we process your data and access to it
• Correction: You may request correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion: You may request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the LGPD
• Portability: You may request portability of your personal data to another service provider
• Deletion: You may request deletion of personal data processed with your consent
• Information about sharing: You may request information about which public and private entities we have shared your data with
• Revocation of consent: You may revoke your consent at any time, without affecting the lawfulness of processing carried out prior to revocation

We process your personal data under the following LGPD legal bases: performance of a contract (core Service features), legitimate interests (analytics, crash reporting), and consent (push notifications, optional features). You may contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd with questions or complaints.

16. Rights for Users in Turkey (KVKK)

If you reside in Turkey, the Kişisel Verilerin Korunması Kanunu (KVKK, Law No. 6698) grants you the following rights:

• Learn whether your personal data is being processed
• Request information about the processing if your data has been processed
• Learn the purpose of processing and whether it is being used in accordance with its purpose
• Know the third parties to whom your personal data is transferred domestically or abroad
• Request correction of incomplete or inaccurate personal data
• Request deletion or destruction of your personal data under the conditions set forth in the KVKK
• Object to any result arising exclusively from the analysis of your personal data by automated systems that is to your detriment

Your personal data is transferred to the United States for processing. We rely on your explicit consent and contractual necessity as the legal basis for this cross-border transfer under the KVKK. You may file a complaint with the Personal Data Protection Authority (KVKK Board) at kvkk.gov.tr.

17. Rights for Users in India (DPDPA)

If you reside in India, the Digital Personal Data Protection Act, 2023 (DPDPA) grants you the following rights:

• Right to access information about your personal data and how it is processed
• Right to correction and erasure of your personal data
• Right of grievance redressal: You may contact us at privacy@kiwirecipes.app and we will respond within 30 days
• Right to nominate: You may nominate another person to exercise your rights in the event of your death or incapacity

You may file a complaint with the Data Protection Board of India once it is operational. Until then, contact us at privacy@kiwirecipes.app for any data protection concerns.

18. Rights for Users in Canada (PIPEDA / Quebec Law 25)

If you reside in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Law 25) grant you the following rights:

• Access: You may request access to the personal information we hold about you
• Correction: You may request correction of inaccurate or incomplete personal information
• Withdrawal of consent: You may withdraw your consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions
• Complaint: You may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca)

Quebec Law 25 additional requirements: We collect and use your personal information only for the purposes described in Section 3. We conduct privacy impact assessments for systems that process personal information. You have the right to data portability in a commonly used technological format. We will notify you and the Commission d'accès à l'information of any confidentiality incident that presents a risk of serious injury.

19. Rights for Users in Australia and New Zealand

If you reside in Australia, the Privacy Act 1988 and the Australian Privacy Principles (APPs) govern how we handle your personal information. If you reside in New Zealand, the Privacy Act 2020 applies.

• Access and correction: You may request access to and correction of your personal information (APP 12 and 13)
• Complaint: You may file a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or with the New Zealand Office of the Privacy Commissioner at privacy.org.nz
• Cross-border disclosure: Your personal information is disclosed to Google Cloud in the United States for processing (APP 8). We take reasonable steps to ensure Google complies with the APPs through its Data Processing Addendum

We do not use or disclose your personal information for the purpose of direct marketing unless you have consented. You may opt out of analytics data collection at any time through the app settings.

20. Rights for Users in Thailand (PDPA)

If you reside in Thailand, the Personal Data Protection Act B.E. 2562 (PDPA) grants you the following rights:

• Right of access: You may request access to and a copy of your personal data
• Right to data portability: You may request your personal data in a machine-readable format
• Right to object: You may object to the collection, use, or disclosure of your personal data
• Right to erasure: You may request deletion of your personal data when it is no longer necessary
• Right to restrict processing: You may request restriction of the use of your personal data

You may file a complaint with the Personal Data Protection Committee (PDPC) or the Office of the Personal Data Protection Committee at pdpc.or.th.

21. Rights for Users in Indonesia (PDP Law)

If you reside in Indonesia, Law No. 27 of 2022 on Personal Data Protection (PDP Law) grants you the following rights:

• Right to obtain information about the processing of your personal data
• Right to access and obtain a copy of your personal data
• Right to correct inaccurate or incomplete personal data
• Right to terminate processing, delete, and destroy your personal data
• Right to withdraw consent at any time

You may file a complaint with the supervising authority once established by the government of Indonesia. Until then, contact us at privacy@kiwirecipes.app.

22. Rights for Users in Mexico (LFPDPPP)

If you reside in Mexico, the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) grants you the following ARCO rights:

• Access (Acceso): You may request access to your personal data and information about how it is processed
• Rectification (Rectificación): You may request correction of inaccurate or incomplete personal data
• Cancellation (Cancelación): You may request deletion of your personal data when it is no longer necessary
• Opposition (Oposición): You may oppose the processing of your personal data for specific purposes

To exercise your ARCO rights, contact us at privacy@kiwirecipes.app. We will respond within 20 business days. You may file a complaint with the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) at home.inai.org.mx.

23. Rights for Users in Taiwan (PDPA)

If you reside in Taiwan (Republic of China), the Personal Data Protection Act (PDPA) grants you the following rights:

• Right to inquire and request access to your personal data
• Right to request a copy of your personal data
• Right to request supplementation or correction of your personal data
• Right to request cessation of collection, processing, or use of your personal data
• Right to request deletion of your personal data

Your personal data is transferred to the United States for processing. Taiwan's PDPA permits cross-border transfers unless restricted by the relevant central government authority. Contact us at privacy@kiwirecipes.app to exercise your rights.

24. Rights for Users in Israel

If you reside in Israel, the Protection of Privacy Law, 5741-1981 and its regulations grant you the following rights:

• Right to review your personal data held in our database
• Right to request correction or deletion of inaccurate data
• Right to object to the use of your personal data for direct marketing

You may file a complaint with the Privacy Protection Authority (PPA) at gov.il/en/departments/the_privacy_protection_authority. Israel has been recognized by the European Commission as providing an adequate level of data protection.

25. EU/EEA Data Protection Authorities

If you are in the EU/EEA, you may lodge a complaint with your local data protection authority. Key authorities for our primary markets:

• Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl)
• Germany: Bundesbeauftragte für den Datenschutz und die Informationsfreiheit — BfDI (bfdi.bund.de), or your state-level authority (Landesdatenschutzbeauftragter)
• France: Commission Nationale de l'Informatique et des Libertés — CNIL (cnil.fr)
• Spain: Agencia Española de Protección de Datos — AEPD (aepd.es)
• Italy: Garante per la protezione dei dati personali (garanteprivacy.it)
• United Kingdom: Information Commissioner's Office — ICO (ico.org.uk)
• A full list of EU/EEA data protection authorities is available at edpb.europa.eu

26. AI-Generated Content Disclosure

The Service uses artificial intelligence (Google Vertex AI) to generate, modify, and translate recipes. In accordance with the EU AI Act and applicable transparency requirements, we disclose that: recipe content marked as AI-generated or modified by KiKi (our AI assistant) is produced by an AI system, not a human author.

AI-generated content may contain inaccuracies. We do not use AI to make automated decisions that produce legal or similarly significant effects concerning you. The AI features are tools that generate recipe suggestions for your review — you decide whether to use, modify, or discard them.

Your interactions with the AI assistant (prompts, dietary preferences, ingredient requests) are processed by Google Vertex AI. These inputs are used solely to generate recipe content and are not used to train AI models. Google's Vertex AI data processing terms apply.

27. Cookies & Tracking Technologies

The KiWi Recipes mobile application does not use cookies. The app does not collect advertising identifiers (IDFA on iOS or GAID on Android) and does not participate in any advertising or cross-app tracking frameworks.

Our website (kiwirecipes.app) does not use cookies, analytics, or any third-party tracking technologies. All fonts are self-hosted — no requests are made to external font services. The website makes no third-party requests beyond what your browser requires to load the page.

The in-app analytics described in Section 2(d) are first-party only — collected by us, stored in our own database, and never shared with third-party analytics or advertising services.

28. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date, and where feasible, through an in-app notification. We encourage you to review this page periodically. Your continued use of the Service after changes constitutes your acceptance of the updated policy. For material changes that affect your rights under GDPR, we will seek renewed consent where required.

29. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: privacy@kiwirecipes.app

Dual Alliance Tech, LLC, 3866 Northwood Ct, Pleasanton, CA 94588, United States. For EU/UK inquiries, we can be reached at the same email address. If we are required to appoint a representative in the EU or UK in the future, their details will be published here.