• Account details — your email address and password (stored only as a secure hash), or the basic profile details Google shares if you sign in with Google. Used to create and secure your account and to contact you about your account. Legal basis: performance of our contract with you.
• Your recipe library — recipes you save, recipes you generate, custom titles, favourites and the wording of the cravings and recipes you enter. Used to give you your personal “My Bake Lab” collection and to apply your monthly generation allowance. Legal basis: performance of our contract with you.
• Membership status — your plan, subscription status and renewal date, linked to identifiers from our payment provider. Used to give members access to Bake Lab+ features. Legal basis: contract.
• Technical and usage data — IP address, device and browser information, error reports and basic usage events. Used for security, fraud and abuse prevention, keeping the site working and improving the product. Legal basis: legitimate interests.
• Support messages — anything you send us when you ask for help. Used to answer you. Legal basis: legitimate interests.
• Marketing emails — only if you opt in, and you can unsubscribe at any time. Legal basis: consent.

We do not sell your personal data, and we do not use your saved recipes to identify or profile you beyond running the features described above.

• Merchant of Record — Paddle.com Market Ltd acts as the reseller and Merchant of Record for Bake Lab+ orders and handles payments, subscription management, invoicing, tax compliance and refunds. Paddle collects payment details directly; we never see or store your card number.
• Service providers — hosting, database and authentication providers, email delivery, and the AI providers that generate recipes from the wording you submit. They process data on our instructions under contract.
• Professional advisers — legal and accounting advisers where needed.
• Authorities — where we are required to disclose data by law, or to protect our rights.

Some of these providers are located outside the UK and EEA. Where data is transferred internationally we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.

Account data and your recipe library are kept while your account is open. If you close your account, or ask us to delete it, we delete or anonymise your data within a reasonable period, apart from records we must keep for tax, accounting or legal reasons. Records held by Paddle for order and tax purposes are kept under Paddle's own retention rules.

Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent where we rely on it. You can also complain to your local data protection authority. Contact us to exercise any of these rights and we will respond within one month.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, and database access rules that make your saved recipes and account details readable only by you.

We use essential cookies and browser storage to keep you signed in, remember recipes you saved before creating an account, and keep the checkout secure. These are required for the site to work. We do not use advertising cookies. Our payment provider may set its own cookies during checkout, as described in Paddle's privacy notice. You can clear or block cookies in your browser settings, though signing in may then stop working.

If this notice changes we will update this page, and for significant changes we will tell you in the app or by email.