Last updated: 25 October 2026
Mixit EOOD (Миксит ЕООД), UIC 208966039, registered in Sofia, Bulgaria ("Mixit", "we", "us", "our"), is the data controller responsible for processing your personal data. For privacy-related inquiries, contact us at privacy@mixit-app.com.
We collect data you provide directly: email address, name, dietary preferences, equipment preferences, and household composition. Household composition (including any number of children) is used solely to size recipe portions — we do not build profiles of, or knowingly process data about, individual children. We also collect data generated through your use of the app: meal plans, shopping lists, favourites, recipe notes, reviews and ratings you post (including the display name shown on them, and any photos you attach to a review), achievement progress, and device identifiers (used to enforce the device limit on your account). Any photos you add to a review are user-generated content that is stored and displayed publicly alongside your review, visible to other users of the app — do not include anything private or sensitive in them. We do NOT collect or store payment card numbers — all purchases are processed by Apple (App Store) or Google Play, and subscriptions are managed through RevenueCat.
We process your data on the following bases: (a) Contract performance — to provide our recipe, cooking-guide, and meal-planning features; (b) Consent — for marketing communications, non-essential cookies, product analytics and crash reports, and sending a post you import to Google Gemini; (c) Legitimate interest — for service improvement, cookieless page-view counts on the web app (Vercel Web Analytics), fraud prevention, five getting-started emails in your first week after sign-up, and, after that, at most one reminder email a week when something you started is waiting in the app (a plan with no shopping list yet, a list not yet shopped, a meal bought but not cooked) or when you have not used it for a while (each of these emails has a one-click unsubscribe, and they never advertise anything outside the app); (d) Legal obligation — for accounting records related to subscriptions.
We use your data to: provide personalised meal plans and recipe recommendations based on your preferences; manage your account and sync your favourites, planner, and notes across your devices; enforce the account device limit; send transactional emails (such as account verification) and, in your first week, five getting-started emails that use your plan and cooking history in the app to pick what they show, and, after that, at most one reminder email a week that picks what it says from your plan, shopping list, Kitchen, cooking history, when you last used the app, whether you set a diet or dislikes (if you did, it suggests no dish) and the recipes you hid, written in your app language (if you never chose one, a guess from the language of what you saved in the app, your name or your email address); and improve the app through cookieless, aggregate page-view counts and, only with your consent, pseudonymous product analytics.
We share data with the following categories of processors: Supabase (EU region, eu-west-1 — database, authentication, and file storage — including the public storage bucket that hosts photos you attach to a review); Vercel (hosting and edge delivery of the web app — request logs); Vercel Web Analytics (on the web app only — cookieless, aggregate counts of page views, with page addresses stripped of their query strings, and of whether the cookie notice was shown and what was chosen in it; it sets no cookie and stores nothing on your device; legitimate interest); PostHog (product analytics, EU-hosted — only when you grant analytics consent; pseudonymous, not anonymous: events are keyed to a random identifier stored on your device, never to your name or email address, and record which screens and controls are used but never the text on them); RevenueCat (subscription entitlement management, used when an in-app purchase is active); Apple App Store / Google Play (purchase processing); Resend (email delivery: account verification, the five getting-started emails of your first week, and the reminder emails); Sentry (crash reporting and diagnostics, EU-hosted in Germany — error and device-state data used to detect and fix app crashes, and only when you grant analytics consent); Cloudflare Turnstile / hCaptcha (bot protection on sign-in, where enabled); Google (Gemini generative AI — only after you allow it in the app: for a post you share from Instagram or TikTok, the post’s caption, video frames and audio are sent to pick step photos, fill in what the caption left out and translate the recipe into your app language; for a recipe you import from a web link, only its title, ingredients and steps are sent, to translate it; nothing that identifies you is sent with them, and you can withdraw this any time in Profile › Privacy & legal. Also used for admin-side recipe creation). Each processor operates under a Data Processing Agreement (DPA) and processes data only on our instructions. We do not sell your personal data to any third party.
Our primary database is hosted in the EU (Supabase eu-west-1, Ireland), and our analytics and crash-reporting processors are configured to EU regions. Where a processor transfers data outside the EEA (for example email delivery, app hosting, or purchase processing by Apple or Google), we rely on European Commission adequacy decisions or Standard Contractual Clauses (SCCs).
Account data: retained for the duration of your account plus 30 days after a deletion request. Subscription records: retained as required for tax and legal compliance. Recipe notes, favourites, and planner entries: retained until you delete them or your account. Analytics data: Vercel Web Analytics keeps only aggregate counts. PostHog product-analytics events (only with your consent) are pseudonymous rather than anonymous: they carry a random identifier stored on your device, not your name or email address.
You have the right to: (a) Access — request a copy of your personal data; (b) Rectification — correct inaccurate data; (c) Erasure — request deletion of your data ("right to be forgotten"); (d) Portability — receive your data in a machine-readable format (JSON); (e) Restriction — limit how we process your data; (f) Objection — object to processing based on legitimate interest; (g) Withdraw consent — at any time, without affecting prior processing. To exercise any right, contact privacy@mixit-app.com. We will respond within 30 days. You can also delete your account and all associated data directly in the app under Account → Delete Account, or — if you no longer have the app — request deletion at mixit-app.com/delete-account.html.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with your national supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP): kzld.bg. You may also contact the supervisory authority in any EU member state where you reside or work.
We use strictly necessary cookies for authentication and session management. Non-essential cookies (analytics, marketing) are only set with your explicit opt-in consent. The page-view counter on the web app (Vercel Web Analytics) sets no cookie. You can manage your cookie preferences at any time. Consent is valid for 6 months and can be withdrawn at any time.
Our service is available to users aged 14 and above (in accordance with Bulgarian data protection law). Users under 14 require verifiable parental consent. We do not knowingly collect data from children under 14 without such consent.
We implement appropriate technical and organisational measures to protect your data, including: encryption in transit using TLS; server-side encryption at rest provided by the Supabase platform (managed disk encryption); row-level security on our database; authentication via Supabase Auth with secure session handling; and regular security reviews. Payment data is handled exclusively by Apple and Google — it never touches our servers.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and notify affected users without undue delay, in accordance with GDPR Articles 33 and 34.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before they take effect.
Mixit is committed to making its app and website usable by everyone, in line with the European Accessibility Act (Directive (EU) 2019/882) and its Bulgarian transposition. We aim for WCAG 2.1 level AA: every control is labelled for screen readers, text follows your system text size, motion can be reduced, a high-contrast mode is available, and the cooking guide never relies on colour alone. Known limitations: some recipe photographs carry generic descriptions, and a few animated surfaces still ignore the in-app reduce-motion switch. If you hit a barrier, write to support@mixit-app.com with the screen and what happened — we answer within 30 days. If you are not satisfied with our response, you may contact the competent Bulgarian supervisory authority (Commission for Consumer Protection, kzp.bg).
Български
Миксит ЕООД, ЕИК 208966039, със седалище в София („Mixit“, „ние“), е администратор на данни, отговорен за обработката на вашите лични данни. Събираме: имейл адрес, име, хранителни предпочитания, състав на домакинството, предпочитания за оборудване, както и данни от използването на приложението — планове за хранене, списъци за пазаруване, любими, бележки към рецепти, ревюта и оценки, които публикувате (включително снимките, които прикачите към ревю — потребителско съдържание, което се съхранява и показва публично заедно с ревюто ви, видимо за други потребители; не включвайте нищо лично или чувствително) и идентификатори на устройства. НЕ съхраняваме номера на платежни карти — всички покупки се обработват от Apple (App Store) или Google Play, а абонаментите се управляват чрез RevenueCat. Споделяме данни и с Vercel (хостинг на уеб приложението; Vercel Web Analytics брои посещенията на страниците обобщено, без бисквитки и без да записва нищо на устройството ви, на основание легитимен интерес), PostHog (продуктови анализи, хостван в ЕС — само при дадено съгласие за анализи; псевдонимни, не анонимни: събитията са свързани със случаен идентификатор, записан на устройството ви, а не с името или имейл адреса ви, и не съдържат текста по бутоните и полетата), Sentry (докладване на сривове и диагностика, хостван в ЕС, Германия — данни за грешки и състоянието на устройството, само при дадено съгласие за анализи), Resend (транзакционни имейли, пет имейла за начало през първата ви седмица и след това най-много по един имейл-напомняне седмично, когато нещо започнато ви чака в приложението или не сте го отваряли известно време; от имейлите за начало и от напомнянията можете да се отпишете с едно щракване) и Google Gemini (генеративен AI — само след като го разрешите в приложението: за публикация, която споделите от Instagram или TikTok, описанието, кадри от видеото и звукът се изпращат, за да се подберат снимки, да се допълни липсващото и рецептата да се преведе; за рецепта от уеб линк се изпращат само заглавието, съставките и стъпките ѝ, за превод; нищо, което ви идентифицира, не се изпраща; разрешението се оттегля от Профил › Поверителност и правна информация. Използва се и за създаване на рецепти от администратор); всеки обработващ работи по Споразумение за обработка на данни (DPA). Базата ни данни е хоствана в ЕС (Supabase, Ирландия). Имате право на достъп, коригиране, изтриване, преносимост, ограничаване и възражение по GDPR — пишете на privacy@mixit-app.com или изтрийте акаунта си директно в приложението (Акаунт → Изтриване на акаунт). Жалби: Комисия за защита на личните данни (kzld.bg). Пълният текст на политиката е достъпен в приложението в раздел „Правни документи“.