Last updated: 17 June 2026
This Privacy Policy explains how Cilantro collects and processes your personal data, in compliance with the EU GDPR (RGPD) and French data-protection law. Cilantro is currently a free beta operated by an individual; this policy is provided in good faith and is not a substitute for tailored legal advice.
1. Data controller
Clotilde Ecorcheville, Paris, France. Contact us via our contact form.
2. Data we collect
- Account data (via Google Sign-In): name, email, profile image.
- Content you create: recipes, shopping lists, comments, uploaded images.
- Usage data: anonymous, cookieless audience measurement.
We do not collect special-category data.
3. Purposes & legal basis (Art. 6)
- Provide your account, store and display your content — contract (6(1)(b)).
- Recipe import from a URL or photo (AI processing) — contract (6(1)(b)).
- Anonymous audience measurement — legitimate interest (6(1)(f)).
- Security and abuse prevention — legitimate interest (6(1)(f)).
4. Processors / sub-processors
- Google (authentication) — USA.
- Google Firebase / Google Cloud (database, file storage, hosting) — data stored in the EU (europe-west) where configured; company in the USA.
- Vercel Inc. (application hosting) — USA.
- Anthropic (AI recipe import; your recipe/image content is sent) — USA. Does not train its models on data sent through its API.
5. International transfers
US providers are safeguarded by the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
6. Retention
We keep your data while your account exists. Deleting your account (Settings → Delete account) permanently removes your recipes, shopping lists, comments and account record.
7. Your rights (Art. 15–22)
Access, rectify, erase, port (export), restrict, object, and withdraw consent. Export and erasure are available in Settings; other requests via our contact form. You may lodge a complaint with the CNIL (www.cnil.fr).
8. Cookies
Cilantro uses only essential sign-in cookies. Audience measurement is cookieless and anonymous, so no consent banner is required under CNIL guidance.
9. Security
Database and file access is restricted to server-side credentials with access rules. No system is 100% secure, but we take reasonable measures.
10. Children
Cilantro is not intended for children under 15 (the French digital age of consent).
11. Changes
Material changes are indicated by the “Last updated” date above.
12. Contact
Reach us through our contact form.