gellatti
The Spanish version is the binding version; this English version is provided for information. Versión en español (vinculante)
gellatti — privacy policy
Version: 0.3 · Prepared on: 2026-09-29 · Effective from: 1 October 2026
1. Controller and contact
PINGÜINO GLOBAL S.L., tax ID B19879501, Carrer dels Caputxins 11, 07002 Palma, Illes Balears, Spain, is the controller for gellatti personal data. Contact: info@gellatti.com. Accounts and purchases are intended for people aged at least 18.
2. Data, purposes and legal bases
| Activity | Necessary data and purpose | Legal basis |
|---|---|---|
| Account and access | Email, identifier, preferences and necessary information from the selected login method | Performance of the contract and service security |
| HOME/PRO and private recipes | Recipes, ingredients and settings saved or used for requested functions | Performance of the contract |
| Scanner and image recognition | Food or label photograph, product data and minimal technical information needed to provide a result and control abuse | Performance of the requested function; legitimate security interests for proportionate controls |
| Shared catalogue | Reliable product facts and evidence needed for verification | Non-personal product facts do not identify a user; limited personal traceability is based on legitimate quality and abuse-prevention interests |
| Purchases and invoices | Identification, contact, plan/product, amounts, address and tax information where applicable | Contract and legal tax/accounting obligations |
| Physical delivery | Name, delivery address and necessary delivery contact | Performance of the order |
| Community | Profile and material the user publishes, reports and responses | Requested service; legitimate moderation interests and legal obligations |
| Partner programme | Application, public links, contact, attribution, commissions and verification/payment status | Precontractual steps, contract, security and legal obligations |
| Franchise or support enquiry | Contact information and enquiry content | Responding to the request, handling complaints and legal obligations |
| Errors and security | Minimised technical fault and abuse-prevention data | Legitimate interests in maintaining and protecting the service |
| Remembering a partner link | Identifier and partner association for 30 days | Consent for optional storage; contractual or legitimate-interest grounds, as applicable, for the subsequent minimal attribution record |
Accepting this policy is not treated as blanket consent. Required fields are identified; not providing them may prevent the function for which they are needed. When relying on legitimate interests, we limit the data to the stated purpose and you may object on grounds relating to your situation.
2 bis. Sign-in with Google
If you choose “Continue with Google”, Google shares with us only your name, your email address and your profile picture (the openid, email and profile scopes). We do not receive your Google password and we do not access your contacts, Gmail, Drive, calendar or any other Google data.
We use this information only to create your gellatti account, to sign you in and to contact you about your account. We do not sell it, we do not use it for advertising and we do not use it to train artificial-intelligence models. We share it only with the providers in the Provider Register that process it on our behalf, such as Supabase, our authentication provider.
We keep this information while your account exists and delete it together with your account. You can also remove gellatti’s access at any time at https://myaccount.google.com/permissions.
gellatti’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
3. Photographs, catalogue and recipes
Photograph only food or labels, avoiding people, documents, addresses and other personal information. Photographs are sent to OpenAI through its API for the requested result. We do not use your photographs, scans or recipes to train our own or third-party models. Provider technical retention, security controls and legally required retention are distinct from training.
Complete and reliable label data may enter the shared PR-ING catalogue automatically; approximate data remains private PM-ING; contributions needing review are published after verification. This does not publish the contributor's identity or private photograph. Private recipes do not enter the official library or community without the user's publication action. Additional library or advertising use requires the author's specific permission.
We do not request a personal allergy or health profile; allergen information concerns products and labels. Do not include medical data in text fields or images.
4. Recipients and transfers
The Provider Register identifies the roles of Stripe, Supabase, the active hosting provider, OpenAI, Resend, Sentry and other recipients actually used. Carriers receive only what is needed for delivery. Stripe performs its own payment and identity checks where applicable; not every provider activity is performed on gellatti's behalf. Voluntary publications are visible to the indicated audience.
If access or transfers outside the European Economic Area occur, the relevant adequacy decision or valid safeguards will apply, such as standard contractual clauses and supplementary measures where needed. You can request information or a copy of applicable safeguards from info@gellatti.com. We do not claim that all data remains in the EU without verification.
5. Retention and deletion
We retain account and recipe data while necessary for the service or until deletion. Tax documents and information needed for claims are retained separately for the applicable legal periods with restricted access. Account deletion does not require erasing product facts that no longer identify any person.
Periods: account, settings and private recipes until you delete the account; recognition photos: deleted within 24 hours; photos sent for verification: 90 days after verification (product facts remain, without author data); invoices, orders and commissions: the legal period (usually 6 years); error logs: 30 days (security, up to 90); franchise enquiries and non-accepted partner applications: 6 months; backups: at most 90 days. Backups are replaced according to the disclosed cycle; deletions are reapplied after restoration. Removing a publication stops its display; a restricted copy may be retained where a legal obligation or legitimate evidential need applies, without public reuse.
6. Your rights
Request access, rectification, erasure, restriction, portability where applicable and objection through info@gellatti.com. Withdraw consent as easily as you gave it; withdrawal does not affect earlier lawfulness. Identity verification will be proportionate. We respond within GDPR time limits and explain any legally permitted extension. You may complain to the Spanish Data Protection Agency or the competent supervisory authority.
We do not use your data for advertising, remarketing or newsletters. The cookies information lets you change the partner-link choice. A new purpose requiring consent cannot be introduced merely by publishing an updated policy.