SazónPrivacy Policy — Sazón It
Version 1.2 — Effective as of August 1, 2026
This Policy explains what personal data we process in Sazón It (the app and the website, the "Service"), for what purposes and on what legal basis, with whom we share it, how long we retain it, and what rights you have. The data controller is Sazón It (a Kyno product), with registered office at Montevideo, Uruguay ("Kyno", "we", "us").
Privacy contact: contact@kynodevs.com. Representative in the EU (Art. 27 GDPR), where applicable: not designated — Sazón It operates from Uruguay, which benefits from an EU adequacy decision (Decision 2012/484/EU).
We designed Sazón It local-first: it works without an account and much data stays only on your device. We collect the minimum necessary for the Service to function.
1. Quick summary
| Topic | In one line |
|---|---|
| Do I need an account? | No. Without an account, your profile and activity live on your device. |
| What do you collect with an account? | Email, name, language, country, year of birth (optional), avatar, and your recipe activity. |
| Do you sell my data? | No, we do not sell personal data. |
| AI? | With Premium, your query and the recipe are sent to a third-party AI provider (Anthropic, Google, or OpenAI) to respond to you. |
| Location? | Only if you use delivery; it is sent to Google for the search and is not stored. |
| Advertising? | Yes, in the free version (Google AdMob / AdSense); on iOS we ask for permission (ATT). |
| Can I delete everything? | Yes. Write to us at contact@kynodevs.com or delete your account. |
2. Data we process
2.1 That you provide to us
- Account data: email, password (we store it **encrypted/hashed, never in plain text), name, and language. If you register with Google or Apple**, we receive an identifier from that account and the basic data you authorize (for example, email and name). With Sign in with Apple you can choose to hide your real email.
- Profile data (optional): country (2-letter code) and year of birth, which we use to fine-tune the recommendations. You may choose not to provide them.
- AI queries (Premium): the text you write to the AI Chef or to "What are you cooking today?". This text is sent to a third-party AI provider (see §4). Do not include sensitive or third-party data in the chat.
- Communications: what you write to us through support.
2.2 That are generated by your use
- Recipe activity: events of the type view, open, save, cooked, dismiss, with the recipe id and the date/time. It is the basis of your "palate", your saves, and the recommendations. Without an account, they are stored only on your device. With an account, they are synchronized (limited to ~500 recent events).
- Premium status and purchases: whether you have an active Premium subscription, its validity, the AI credits available (a daily allowance renewed each day), and the delivery quota used. Payment is processed by the Store (Apple / Google): we do not receive or store your card or payment-method data; we only receive from the Store the confirmation of your subscription status in order to enable Premium.
- Technical data: IP address, device/browser type, operating system, language, session identifiers (tokens stored in the device's secure storage), and access logs (logs), which we use to operate, provide security, and prevent abuse (rate limiting).
2.3 Location / geolocation (only if you use delivery)
Location data may be considered a sensitive category of data, so we treat it with special care and only with your explicit consent. When you use "I'm not cooking" / delivery, with your permission we obtain your approximate location (device geolocation coordinates) or the address you enter manually, and we send it to Google (Places / Geocoding) to find nearby venues. The legal basis is your consent (system location permission), which you may revoke at any time from the system settings or by using the manual address entry. We do not store, log, or profile your location: it is used one-time for that query and discarded; we do not build a location history. Google's use of that data is governed by its own policies.
2.3 bis Microphone and voice (hands-free cooking mode only)
In cooking mode you can move through recipe steps by voice ("next", "back", "repeat"). For that:
- Only with your microphone permission, and only while voice mode is active: listening stops when you leave cooking mode or turn it off. You can revoke the permission at any time in your system settings and the app keeps working by touch.
- We do not record or store audio. Kyno does not receive the audio or the transcripts: they never reach our servers and are not saved to your account.
- Recognition is performed by your device's operating system (Apple's dictation service on iOS, Google's on Android). Depending on your device, settings and language, that processing may happen on the device itself or on Apple's or Google's servers. That processing is governed by Apple's and Google's privacy policies, not by this one. If you would rather no audio leaves your device, do not use voice mode.
- We only use the recognized text to detect the command, and discard it immediately after.
2.4 Data for advertising purposes
In the free version, the advertising providers (Google AdMob / AdSense) may process device/advertising identifiers (IDFA on iOS, AAID on Android, cookies/identifiers on web) and technical data. This includes the standard formats (banner, native, interstitial) and the optional rewarded ads you watch in exchange for unlocking a feature. On iOS, we first show the App Tracking Transparency (ATT) notice: the advertising identifier is used for cross-app tracking only if you accept it; if you decline, advertising is non-personalized. See the Cookie Policy.
2.5 Push notifications
If you enable them, we process a notification token to send you alerts (for example, the recipe of the day). You can disable them from the system or app settings.
We do not request sensitive data (health, religion, etc.) nor do we seek data from minors. Avoid including sensitive or third-party data in the AI queries.
3. What we use the data for and on what legal basis (GDPR)
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Provide the Service (catalog, saves, synchronization) | Account, activity, technical | Performance of a contract (art. 6.1.b) |
| Create and authenticate your account | Account, tokens | Performance of a contract |
| Personalize recommendations ("palate") | Activity, country/year | Legitimate interest (art. 6.1.f) / contract |
| AI Chef and suggestions | Query + recipe data | Performance of a contract (feature you request) |
| Delivery / nearby venues | One-time location | Consent (art. 6.1.a) — location permission |
| Advertising and measurement (free) | Identifiers, technical | Consent (ATT/cookies) or legitimate interest depending on jurisdiction |
| Security, abuse prevention, rate limiting | IP, technical, logs | Legitimate interest / legal obligation |
| Payments and Premium management | Plan status (payment processed by the Store) | Performance of a contract |
| Support and communications | Contact, account | Performance of a contract / legitimate interest |
| Comply with the law and defend rights | Those necessary | Legal obligation / legitimate interest |
| Push notifications | Token | Consent |
Where the basis is consent, you may withdraw it at any time (without retroactive effect). Where it is legitimate interest, you may object (see §9).
4. With whom we share data (processors and third parties)
We do not sell your personal data. We share it only with providers that process it on our behalf and instructions, or when you request it:
| Provider | For what | What it receives |
|---|---|---|
| AI provider — Anthropic (Claude), Google (Gemini), or OpenAI, depending on configuration | Generate the AI responses (AI Chef / "What are you cooking today?") | Your query + the recipe text (title, ingredients, steps) |
| Google (Sign-In) | Sign in with Google | Identifier and basic data you authorize |
| Apple (Sign in with Apple) | Sign in with Apple | Identifier and email (real or relay) |
| Google (Places / Geocoding) | Search for nearby delivery | Your one-time location/address (we do not store it) |
| Google (AdMob / AdSense) | Advertising and measurement | Advertising identifiers and technical data |
| Apple App Store / Google Play | Premium billing (IAP) | Purchase data (handled by the Store) |
| RevenueCat | Manage and validate Premium subscriptions (status, renewals, purchase restore) | A customer identifier linked to your account, the purchase receipt issued by the Store, and technical device data |
| Cloudflare R2 | Host recipe images and audio | Content requests (technical IP) |
| Railway (hosting/DB) | Host the server and the database | Stored account and activity data |
| Expo (notifications) | Send push notifications | Notification token |
We may also disclose data: (a) to comply with the law or requests from authorities; (b) to protect rights, security, or prevent fraud; (c) in the context of a corporate reorganization (merger, acquisition), informing you if the controller changes.
Regarding use by the AI: we use the providers' commercial APIs (Anthropic, Google, or OpenAI, depending on the configuration in effect). Under their enterprise/API terms, data sent via the API is not used to train their models. Consult the relevant provider's policy for more detail. We do not send your account data to the AI; only the text of your query and that of the recipe.
5. International transfers
Our providers may process data in the United States or other countries outside yours. When we transfer data from the EU/EEA, the United Kingdom, or Switzerland, we rely on appropriate legal mechanisms (for example, the Standard Contractual Clauses (SCCs) of the European Commission, or applicable adequacy frameworks). You may request information about these safeguards at contact@kynodevs.com.
6. How long we retain the data
- Account and activity data: as long as your account is active. Synchronized activity is limited to the ~500 most recent events.
- Data on your device (without an account): until you delete the app's data or uninstall it.
- AI queries: processing is one-time to respond to you; see §4 regarding the provider.
- Location (delivery): not retained.
- Security logs: for a limited period, according to security needs and legal obligations.
- Billing data: retained by the Store; we retain the plan status as necessary to provide Premium and comply with accounting/tax obligations.
Upon deletion of your account, we delete or anonymize your personal data within a reasonable period, except for what we must retain due to a legal obligation or to defend claims.
7. Security
We apply reasonable technical and organizational measures: hashed passwords, encrypted transmission (HTTPS/TLS), tokens in the device's secure storage, access control, rate limits, and data minimization. No system is 100% secure; we cannot guarantee absolute security. If a breach occurs that affects you, we will act in accordance with the law (including notification where applicable).
8. Minors
The Service is not directed at minors under 18 years of age and we do not knowingly collect their data. If you believe that a minor has provided us with data without the corresponding authorization, write to us at contact@kynodevs.com and we will delete it.
9. Your rights
Depending on your jurisdiction, you have the right to: access your data, rectify it, delete it, restrict or object to its processing, to portability, to withdraw consent, and to not be subject to automated decisions with significant legal effects. To exercise them, write to contact@kynodevs.com; we may ask you to verify your identity. We respond within the legal timeframes (in the EU, generally within 1 month). The exercise is free, except for manifestly unfounded or excessive requests.
9.1 European Economic Area / United Kingdom (GDPR / UK GDPR)
In addition to the above, you have the right to lodge a complaint with your supervisory authority (in your country or before the Uruguayan Personal Data Regulatory and Control Unit (URCDP)). The controller is Kyno; where applicable, its representative in the EU appears at the beginning of this Policy.
9.2 California (CCPA / CPRA)
You have the right to know what personal information we collect and with whom we share it, to access and delete it, to correct it, and to not be discriminated against for exercising your rights. We do not sell personal information nor do we share it for cross-context behavioral advertising within the meaning of the CPRA without offering you control; on iOS that control is the ATT notice. You may exercise your rights at contact@kynodevs.com.
9.3 Brazil (LGPD)
You have the rights under art. 18 of the LGPD (confirmation, access, correction, anonymization, portability, deletion, information about sharing, and revocation of consent) and you may contact the ANPD. Processor contact: contact@kynodevs.com.
9.4 Other jurisdictions (Uruguay, Argentina, and others)
We recognize the equivalent rights under local data-protection laws (for example, Uruguay — Law 18.331; Argentina — Law 25.326) and the possibility of lodging a complaint with the competent authority (the Uruguayan Personal Data Regulatory and Control Unit (URCDP)).
10. Automated decisions
Recipe recommendations are based on your activity, but they do not produce legal effects or affect you significantly. We do not carry out profiling with legal impact.
11. Cookies and similar technologies
On the web we use cookies/local storage and, with advertising active, third-party identifiers. In the apps we use device storage and advertising identifiers. The details and your controls are in the Cookie Policy.
12. Changes to this Policy
We may update this Policy. We will publish the version in effect with its date and, in the event of material changes, we will notify you by reasonable means (notice in the app and, if you have an account, by email) before it takes effect.
13. Contact
Sazón It — Montevideo, Uruguay Privacy / exercise of rights: contact@kynodevs.com EU Representative (where applicable): not designated — Sazón It operates from Uruguay, which benefits from an EU adequacy decision (Decision 2012/484/EU)