Privacy Policy

1. Who We Are

CookWise ("we", "us", "our") is an AI-powered recipe management and cost-calculation platform operated by CookWise Israel, located at Rehovot, Israel ("the Company").

We are the data controller for personal information collected through cookwise.app and any related mobile or web applications (collectively, "the Service").

Privacy inquiries: cookwisesupport@gmail.com

2. What Data We Collect

Account & Identity Data

• Email address, username, and password (hashed — we never store plaintext passwords)
• Language preference and account settings
• Subscription plan and billing history

Recipe & Usage Data

• Recipes you upload or create, including ingredients, instructions, and photos
• Meal plans you build within the Service
• Cost-calculation results linked to your profile
• Feature usage patterns (e.g., number of uploads, AI parses consumed)

Technical & Device Data

• IP address, browser type, operating system, and device identifiers
• Log files (page views, errors, timestamps)
• Cookies and similar tracking technologies (see Section 7)

Payment Data

Payment processing is handled by our third-party payment provider. We do not store credit card numbers or full payment details on our servers. We retain only a payment reference ID and subscription status.

Sensitive & Health-Related Data

If you voluntarily enter dietary preferences, food allergies, or health-driven dietary restrictions (e.g., celiac disease, diabetes diet, kashrut), this information is treated as sensitive personal data under the Israeli Protection of Privacy Law (Amendment 13, 2024). It is used only to personalize your experience and is never shared with third parties for marketing purposes.

3. How We Use Your Data

4. Data Sharing and Third Parties

We do not sell your personal data. We share it only in the following circumstances:

Service Providers (Data Processors)

• OpenAI, L.L.C. (USA) — processes recipe text for AI parsing. Only the content of recipes you submit for parsing is sent; no account identifiers are included. Data is processed under OpenAI's API terms, which prohibit training on API inputs by default.
• Cloud Hosting Provider (EU/Israel region) — servers that store the Service data
• Payment Processor — handles subscription billing (does not receive recipe data)
• Email Delivery Provider — sends transactional and marketing emails

All processors are bound by data processing agreements that restrict them to acting on our instructions only.

Cross-Border Transfers

Some providers are located outside Israel (notably OpenAI in the USA). The USA does not hold an Israeli adequacy decision for all transfers. Where required, we rely on appropriate safeguards (standard contractual clauses or equivalent mechanisms). You may request information about these safeguards by contacting cookwisesupport@gmail.com.

Legal Disclosure

We may disclose personal data when required by Israeli law, a court order, or a lawful request from a competent authority.

Business Transfers

If CookWise is acquired, merged, or sold, your data may transfer to the successor entity. You will be notified before your data becomes subject to a materially different privacy policy.

5. AI Processing and Automated Decisions

CookWise uses OpenAI's API to parse recipe text, extract ingredients, and estimate costs. When you upload or paste a recipe for AI parsing:

• The text content of the recipe is sent to OpenAI's servers in the USA for processing.
• OpenAI's API terms state that API inputs are not used to train OpenAI's models.
• Results are returned to you in real time and stored in your account.

Automated cost calculations are based on publicly available supermarket price data (Israeli mandatory price transparency feeds). These calculations do not constitute profiling or produce legal effects — they are informational estimates provided as a convenience feature.

No fully automated decision-making that produces legal or similarly significant effects is applied to individual users.

6. Data Retention

When an account is deleted, all personal data is permanently removed from active systems within 30 days and from backups within 90 days, except where retention is required by law (e.g., billing records).

7. Cookies and Tracking Technologies

We use the following categories of cookies:

In accordance with the Israeli Privacy Protection Authority Cookie Guidance (April 2024), non-essential cookies require your prior consent. You may manage cookie preferences in your account settings or via your browser settings at any time.

8. Your Rights

Under the Israeli Protection of Privacy Law (5741-1981, as amended by Amendment 13) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Correction: Request correction of inaccurate, incomplete, or outdated data.
• Right to Deletion: Request deletion of your data where it is no longer necessary for the original purpose, where you withdraw consent, or where processing is unlawful. We may retain data required by law (e.g., billing records) or for legitimate fraud-prevention purposes.
• Right to Object to Marketing: Opt out of marketing communications at any time, with immediate effect.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Rights After Death (Israeli law): Your heirs or authorized representatives may exercise these rights on your behalf after your death.
• GDPR Rights (EU/EEA Residents): If you are located in the EU or EEA, you additionally have the right to data portability and the right to lodge a complaint with your local supervisory authority.

How to Exercise Your Rights

Submit a request to cookwisesupport@gmail.com. We will respond within 30 days. For complex requests, we may extend this period by a further 30 days with notice. Responses are provided in Hebrew, English, or Arabic — please specify your preferred language.

Complaints

You may lodge a complaint with the Israeli Privacy Protection Authority (PPA): www.gov.il/en/departments/the_privacy_protection_authority.

9. Data Security

We implement technical and organizational measures consistent with the Israeli Privacy Protection Regulations (Data Security) 5777-2017, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• Hashed password storage (bcrypt)
• Role-based access controls limiting data access to authorized personnel
• Regular security reviews and vulnerability assessments
• Audit logging of administrative access to personal data

In the event of a data breach posing a significant risk to your rights, we will notify the PPA within 72 hours and inform affected users without undue delay, as required by Amendment 13.

10. Children's Data

CookWise is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will delete it promptly. If you believe we have inadvertently collected such data, please contact cookwisesupport@gmail.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email at least 14 days before the changes take effect, and update the "Effective date" at the top of this page. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For any privacy-related questions, requests, or concerns: