Privacy Policy

Last Updated: August 16, 2026

rasa is owned and operated by Ark Fortune LLC ("we", "our", "us"), the data controller responsible for your information. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and services (collectively, the "Platform").

1. Information We Collect

Account Information: When you create an account, we collect your name, email address, and password. If you use Google Sign-In, we receive your name, email, and profile photo from Google.

Profile Preferences: During onboarding, you may provide your cooking intent, skill level, and dietary preferences. This data is used solely to personalize your experience.

Usage Data: We collect information about how you interact with the Platform, including pages visited, recipes viewed, AI Chef queries, and feature usage.

Signed-in Usage Analytics: When you are signed in, we record how you use rasa within your account — the pages and recipes you view, time spent, and your interactions with upgrade prompts and checkout — linked to your account. We use this solely to operate and improve rasa and to understand how members use their plan. This data stays on our own systems (our database provider, Supabase, acts as a service processor on our behalf), is never sold or shared with third-party advertising or analytics companies, and is automatically deleted after 180 days. You may request access to or deletion of this data at any time (see "Your Rights" below). Visitors who are not signed in are measured only in aggregate, without cookies or personal identifiers.

Payment Information: Payment processing is handled entirely by Stripe. We never store your credit card number, CVV, or full card details. We receive only a Stripe customer ID and subscription status.

2. How We Use Your Information

• To provide, maintain, and improve the Platform
• To personalize your recipe recommendations and AI Chef responses
• To process subscriptions and manage your account
• To communicate with you about updates, security alerts, and support
• To enforce our Terms of Service and prevent abuse
• To comply with legal obligations

3. Data Storage & Security

Your data is stored on Supabase and Cloudflare infrastructure, both of which maintain SOC 2 Type II compliance. Data is encrypted in transit (TLS 1.2+) and at rest.

We implement industry-standard security measures including:

• Server-side authentication and authorization checks
• Row-Level Security (RLS) policies preventing unauthorized reads and writes
• Rate limiting on API endpoints
• Input sanitization to prevent injection attacks
• Secrets stored in Supabase Vault / Cloudflare secrets (never in client code)

4. AI Chef & Data Processing

When you use AI Chef, your message is sent to our server, which forwards it to Anthropic's Claude API for processing and returns the response to you. We do not sell your conversations, and we do not use them to train AI models. Anthropic processes the message on our behalf as a service provider and, under its commercial terms, does not use API content to train its models.

What we store: your AI Chef conversations are saved to your account so you can revisit them, and we keep a record of each query for the purpose of enforcing monthly usage limits. You can review and delete your conversations from within the app, and deleting your account removes them as described in Section 6.

If you choose to add household profiles (for example a child's age or a pet's dietary needs, including allergies you enter), relevant details from those profiles may be included in the request to AI Chef so that its answers are safe and appropriate for that household member. You are not required to provide this information, and you may remove it at any time.

5. Third-Party Services

We use the following third-party services (sub-processors). Each has its own privacy policy, and we recommend reviewing them:

• Supabase — Authentication, database, and application data storage
• Cloudflare — Website hosting, content delivery, and security
• Stripe — Payment processing and subscription billing. Card details are entered directly with Stripe; we never receive or store full card numbers
• Anthropic — AI Chef natural-language processing
• Plausible Analytics — Privacy-focused website analytics. Plausible is cookieless, does not track you across websites, and does not collect personal data; we use it only to understand aggregate page traffic

If we add a new service that processes your personal data, we will update this list and the "Last updated" date above.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Export your data in a portable format
• Withdraw consent for data processing

To exercise any of these rights, contact us at [email protected].

8. Children's Privacy

The Little Rasas feature is designed for children to use with parental supervision. We do not knowingly collect personal information from children under 13 without parental consent. The Family plan requires an adult account holder.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on this page and updating the "Last Updated" date.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at [email protected].