Privacy Policy

CarritoFácil is an app for saving recipes, organizing them into categories, and preparing shopping lists. This policy explains how data is processed in the app and on this website.

1. Data we process

The camera and photo library are only used when you choose to take or select a photo for a recipe. The app may also store your language, the open section, and a shopping list draft on your device. CarritoFácil does not sell personal data, show personalized advertising, or use the advertising identifier to track you.

2. How we obtain data

• Directly from you when you create an account, save content, or request support.
• Automatically when you use the app, for security and product analytics.
• From Apple, Google, and RevenueCat when you purchase or restore a subscription.
• From external pages or services when you ask to import a link or select an image.

3. Purposes and legal bases for using data

• Providing the service: creating and protecting your account, syncing content, applying initial access, and validating a subscription. This processing is necessary to perform the service you request.
• Features you choose to use: accessing the camera or photos, importing a URL, and sending instructions to AI. We use this data only when you initiate the feature and with the applicable permissions.
• Security and improvement: preventing fraud and abuse, limiting requests, measuring performance, and fixing errors. We rely on our legitimate interest in maintaining a secure and useful service, where permitted by law.
• Legal obligations: retaining records required by tax, accounting, or consumer protection rules, or by a competent authority.

Where the law requires consent, you may withdraw it at any time without affecting processing already carried out. You may also object to analytics by writing to the contact address below.

4. Providers that process data

We use specialized providers solely to operate CarritoFácil:

• Google Firebase and Google Cloud: authentication, databases, image storage, backend functions, configuration, analytics, and app protection.
• Google Gemini: recipe generation and extraction, nutrition estimates, and image search queries. Do not include sensitive personal data in prompts or recipes.
• RevenueCat: subscription status, technical history, and associated access entitlements.
• Apple App Store and Google Play: subscription payments, receipts, renewals, cancellations, and refunds.
• Unsplash: photo searches and photographer attribution when you choose an image from its catalog.
• Resend: delivery of transactional emails when the branded email channel is enabled.
• Cloudflare and OpenAI Sites: hosting, security, and technical logs for this website.

These providers operate under their own terms and data protection commitments. We do not share your recipes for advertising purposes. When you open an external link, that site may apply its own privacy policy.

5. International transfers

Some providers operate from the United States or other countries. Where applicable, we use contracts and legally recognized mechanisms to protect international transfers. Firebase Authentication is processed in the United States; other Google services may use global infrastructure or the region configured for each resource.

6. Retention

• Your account, recipes, categories, and images are retained while you maintain your account, including if your subscription expires, so that you can recover them when you renew.
• When you delete your account, we delete the profile and content hosted under your user ID. Backups are deleted as they rotate.
• Pseudonymous identifiers used to limit abuse are retained for the applicable window and up to seven additional days.
• Analytics data, security logs, and communications are retained only for the configured period or as long as necessary for the purposes described.
• Apple, Google, RevenueCat, and other providers may retain purchase, fraud prevention, or compliance records according to their obligations.

7. Account deletion and your rights

You can delete your account under Profile → Delete Account in the app. You can also start a request from our account deletion page. Deleting your account does not, by itself, cancel a subscription billed by Apple or Google; first review the instructions on that page.

Depending on your jurisdiction, you may request access, correction, portability, deletion, restriction of processing, or object to processing, or withdraw consent. Write from the email address associated with your account to support@carritofacil.app. We may request reasonable information to verify your identity. You may also lodge a complaint with your country's data protection authority.

8. Security

We apply reasonable technical and organizational controls, including encryption in transit, account isolation, access rules, integrity verification, and request limits. No system is completely infallible; we therefore recommend using a unique password and keeping your device up to date.

9. Children

CarritoFácil is not directed at children under 13. Anyone who is not old enough to accept these terms in their country must use the service only with permission from a parent or legal guardian. If you believe we have received data from a child without authorization, contact us so we can delete it.

10. This website

This website does not install advertising cookies or integrate its own analytics. The hosting provider may process IP addresses, dates, user agents, and technical logs necessary to deliver and protect the pages.

11. Changes and contact

We may update this policy to reflect changes in the product or the law. We will publish the effective date and, if a change is significant, communicate it within the app or through an appropriate channel.

Privacy and support questions:
support@carritofacil.app