Template — for founder review. Not legal advice. Prepared by a non-lawyer; have counsel review before publishing.
Privacy Policy — Letra de Casa
Last updated: [FOUNDER TO FILL: effective date]
Letra de Casa turns photos of handwritten family recipe cards into a cookbook PDF and a short video. This policy explains what we collect, why we collect it, and the choices you have.
1. Who we are
Letra de Casa is operated by ALPHA BEAC LTD (אלפא ביק בע"מ), a company registered in Israel (company no. 516875952, 6 David HaMelech St., Hod HaSharon 4523433, Israel). We are the "controller" of your personal data. Contact: support@letradecasa.com (privacy requests: privacy@letradecasa.com).
2. What we collect
- Account and order details: name, email address, your orders, and your choices (for example, "Keep my book").
- Your uploads: photos of recipe cards, optional family photos, and any text you add. These may show other people, their handwriting, and family details.
- Generated files: transcribed text, the narration script and audio, the cookbook PDF, and the video.
- Free trial: the card photo you try and its transcription (deleted within 24 hours unless you buy).
- Sharing and gifts: watch and family page settings, contributor names and links, gift recipient name and email, gift message and send time.
- How you found us: your answer to "How did you hear about us?" and ad or referral codes in the link you used.
- Payment data: handled by Polar. We never see your full card number.
- Email sign-up: if you ask for our free guide, your email address, language, and the time and wording of your consent.
- Support emails you send us.
- Usage data: IP address, approximate country, browser type, pages viewed, and clicks, collected through cookies and pixels (section 7).
Giving us data is voluntary, but we cannot make your book without your uploads and email address.
We do not use face recognition and we do not create biometric templates from your photos. Family photos are only shown in the video with a slow pan and zoom; we do not animate faces or generate people.
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Transcribe your recipes, write and voice the narration, and make and deliver your book and video | Contract |
| Payments, refunds, and tax records (through Polar) | Contract; legal obligation |
| Support and service emails | Contract; legitimate interest |
| Security, fraud prevention, and enforcing our Terms | Legitimate interest; legal obligation |
| Analytics and ad measurement | Consent in the EU/EEA, UK, and Switzerland, and for Clarity everywhere; elsewhere legitimate interest, with an opt-out (including GPC) |
| Marketing emails | Only if you opt in. You can unsubscribe at any time. |
We do not use your photos, recipes, or generated files to train AI models. Our AI provider is contractually barred from doing so.
4. How long we keep it
- Photos and generated files are deleted 30 days after delivery, or 12 months after delivery if you choose "Keep my book." If you get a refund, we delete them within 7 days of the refund.
- Download links expire after 7 days; we can reissue them while your files are stored.
- Order and payment records are kept as long as tax law requires (up to 7 years).
- Email sign-ups are kept until you unsubscribe.
- Support emails are kept for up to 24 months.
- Analytics data follows each provider's retention settings.
- Free-trial photos and text: deleted within 24 hours, unless you buy and keep the card.
- Projects that are never finished: if no book is made, we delete uploads 12 months after purchase, and email you 7 days before.
- Backups: deleted files may remain in encrypted backups for up to [FOUNDER TO FILL: number of days, e.g. 7] days before being overwritten.
- Watch and family pages go offline when your files are deleted.
You can delete your photos and files yourself at any time with Delete my photos and files on your account page, or ask us by email.
5. Who we share it with
We share data only with these service providers (sub-processors), each under a contract that protects it:
| Provider | Role |
|---|---|
| Anthropic | AI transcription of your recipe cards; drafting the narration script. Deletes inputs and outputs within 30 days (longer only if content is flagged for misuse). Not allowed to train on your content. |
| Vercel | Website hosting |
| Supabase | Database and file storage |
| Resend | Email delivery |
| Polar Software, Inc. | Checkout; merchant of record |
| PostHog [if used] | Product analytics on our site and app (no recipe text or photos) |
| Cloudflare (Turnstile) [if used] | Bot protection on the free trial and forms |
| Meta (Pixel and Conversions API) | Ad measurement and audiences: the Pixel on our marketing pages, plus server events about sign-ups, trials and purchases (with a hashed email). Never your photos or recipes. Not sent if you opt out or use GPC. |
| Microsoft (Clarity) | Heatmaps and session replay on our marketing pages only if you accept analytics cookies. Never on upload, review, watch or family pages. |
| Google Fonts | Fonts on our website (delete this row once the fonts are self-hosted) |
Apart from these, analytics inside the app (the upload, review and delivery pages) are collected on our own servers and are not shared with third parties.
The narration voice is generated by an open-source text-to-speech model (Kokoro) that runs on our own servers, so your narration text is not sent to a third-party voice provider.
Polar is the seller of record for your purchase and processes your payment data under its own privacy policy. We may also disclose data when the law requires it, to protect our rights, or if our business is sold or merged. We do not sell your personal data. Under California law, using ad pixels may count as "sharing." You can opt out (sections 7 and 9).
6. International transfers
Our providers are mainly in the United States. When we transfer data from the EU/UK or Israel, we use recognized safeguards, such as the EU Standard Contractual Clauses, the EU–US Data Privacy Framework, or the transfer rules under Israeli law.
7. Cookies and pixels
Essential cookies and local storage keep the site working (for example, your language, your privacy choices, and checkout). We also use the Meta Pixel and Meta's Conversions API (ad measurement, audiences and retargeting; the Conversions API sends Meta events such as "started a trial" or "purchased", with a hashed email, from our server), and Microsoft Clarity (heatmaps and session replay, with typed text masked):
- EU/EEA, UK, and Switzerland: these load only after you click Accept in our cookie banner. If you click Reject, they do not load.
- Elsewhere: the Meta Pixel and Conversions API are on by default, and you can turn them off at any time with Do Not Sell or Share My Personal Information. Clarity runs only if you accept it in Cookie settings.
You can change your choice at any time in Cookie settings or block cookies in your browser. We honor Global Privacy Control (GPC) signals. If your browser sends one, or you opt out, these tools don't load and we don't send your events to Meta from our server either.
8. Your rights
Depending on where you live, you may have the right to access and export your data, correct it, delete it, object to or restrict some processing (including marketing), withdraw consent, and complain to a regulator (in Israel, the Privacy Protection Authority; in the EU/UK, your local authority).
Email privacy@letradecasa.com to make a request. We will reply within 30 days, and we may need to verify your identity first. Using your rights will never affect how we treat you.
9. California residents
We collect the categories of data listed in section 2 (identifiers, customer records, commercial information, internet activity, and visual content) for the purposes listed in section 3. We do not sell personal information. To opt out of "sharing" for targeted advertising, use Do Not Sell or Share My Personal Information or turn on GPC. You may also ask to know, delete, or correct your data, either yourself or through an authorized agent.
10. Photos of other people
If you upload photos of other people, you confirm that you are allowed to (see our Terms). If you appear in a photo someone else uploaded, email us and we will remove it. If you share a watch or family page link in a social app, that app may fetch and show a preview image under its own policy.
10A. Information about other people you give us
To make your book and film you may give us information about other people: the person the book honors, relatives in photos, people named in recipes or notes, contributors you invite, and a gift recipient's name and email. We use it only to make, share and deliver your book and film. We email gift recipients and contributors only because you asked us to, and never add them to marketing. People who appear in photos you didn't upload can ask us to remove them (section 10).
11. Age
Letra de Casa is for adults 18 and over. We do not knowingly accept users under 18.
12. Security
We use encryption in transit, access controls, and reputable providers, but no system is fully secure. If a breach affects you, we will notify you and the authorities as the law requires.
13. Changes
We will post any updates here. If a change is significant, we will also email customers.
Contact: ALPHA BEAC LTD (אלפא ביק בע"מ), company no. 516875952, operating Letra de Casa · 6 David HaMelech St., Hod HaSharon 4523433, Israel · support@letradecasa.com · privacy@letradecasa.com
Language. This document is available in English and Spanish. If the two versions differ, the one more favorable to you applies.