Privacy Policy

Yourfamilycookbook.com · Version 1.0

Introduction

The website at yourfamilycookbook.com is operated by Compareyourrealestate.com [Insert legal entity name] [Insert ABN/ACN] of [Insert registered address] (we, us or our). This Privacy Policy describes how we collect, use, store, disclose and otherwise handle your Personal Information in connection with your access to and use of the Platform, being that website and any related applications, features, content, tools and services.

This Privacy Policy is incorporated into and forms part of our Terms and Conditions. Capitalised terms not defined in this Privacy Policy have the meaning given to them in our Terms and Conditions.

We are committed to handling your Personal Information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) (Privacy Act) and, where applicable to you, the General Data Protection Regulation (EU) 2016/679 (GDPR) and the United Kingdom General Data Protection Regulation as it forms part of the law of England and Wales, Scotland and Northern Ireland (UK GDPR).

1. Definitions and interpretation

Defined terms. In this Privacy Policy, unless the context otherwise requires:

• Australian Privacy Principles or APPs means the principles set out in Schedule 1 to the Privacy Act.
• Cookbook means a recipe website created by a Registered User through the Platform.
• Cookies means small data files placed on your device when you access the Platform, and similar tracking technologies including pixels, tags, scripts and local storage.
• EEA means the European Economic Area.
• GDPR means the General Data Protection Regulation (EU) 2016/679, and where the context requires, the UK GDPR.
• OAIC means the Office of the Australian Information Commissioner.
• Owner means the Registered User who created a Cookbook.
• Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in a material form or not, and includes “personal data” as defined in the GDPR.
• Privacy Act means the Privacy Act 1988 (Cth).
• Published Cookbook means a Cookbook that its Owner has chosen to make publicly accessible.
• Recipe Content means the recipes, chapter names, descriptions, notes, stories, photographs and other material an Owner submits to or generates on the Platform, including photographs of handwritten recipes.
• Sensitive Information has the meaning given in the Privacy Act and includes “special category data” as defined in the GDPR.
• Standard Contractual Clauses or SCCs means the standard contractual clauses approved by the European Commission or the UK Information Commissioner from time to time for the transfer of Personal Information out of the EEA or the United Kingdom.
• Supervisory Authority means a public authority responsible for monitoring the application of the GDPR or any other applicable privacy law.
• Visitor means a person who views a Published Cookbook without being its Owner.

Interpretation. In this Privacy Policy, unless the context otherwise requires:

• headings and sub-headings are for convenience only and do not affect interpretation;
• the singular includes the plural and vice versa;
• a reference to a person includes a corporation, partnership, trust, government body or any other entity;
• a reference to a statute, regulation or other instrument includes any amendment, replacement or re-enactment of it; and
• a reference to writing includes email and other electronic forms of communication.

2. About this Privacy Policy

This Privacy Policy applies to all individuals who access or use the Platform, whether as a Visitor to a Published Cookbook or as a Registered User, and to all Personal Information we collect through or in connection with the Platform.

We are the data controller (within the meaning of the GDPR) of Personal Information collected through the Platform. Where an Owner includes Personal Information about another person in their Recipe Content, the Owner determines what is included and we handle that information on their behalf.

If you do not agree with this Privacy Policy, you should not use the Platform. By using the Platform, you acknowledge that you have read this Privacy Policy and understood how we handle your Personal Information.

3. Personal Information we collect

We collect the following categories of Personal Information:

• identity and contact information, such as your name and email address. Where you sign in with a third-party provider such as Google, we receive your name and email address from that provider. We never receive your password for that provider;
• account information, such as your account preferences, authentication tokens and the settings that make up your Cookbook’s appearance;
• Recipe Content, being everything you write or upload — recipe titles, ingredients, methods, notes, chapter names, your story, and every photograph you upload, including photographs of handwritten recipe cards and notebook pages;
• Visitor activity on Published Cookbooks, being counts of views, likes and shares. These are recorded against an anonymous identifier stored in the Visitor’s own browser so that the same person is not counted twice. We do not store names, email addresses or IP addresses against these counts;
• technical and usage data, including your IP address, device identifiers, browser type, operating system, time zone, referring URLs, pages visited and information collected through Cookies;
• communications, including the content of any emails, support requests or feedback you send to us; and
• any other Personal Information that you choose to provide to us.

We do not knowingly collect Sensitive Information through the Platform, and you should not submit Sensitive Information unless we expressly request it. You should be aware that a recipe, a dedication or a family story may contain information about health, religious practice or ethnic origin. Where you choose to include that information, you do so at your own election and we handle it only to provide the Platform to you.

A Visitor may read a Published Cookbook without creating an account or providing any identifying information.

4. How we collect Personal Information

We collect Personal Information in the following ways:

• directly from you, when you sign in, create or edit a Cookbook, upload a photograph, contact us or otherwise interact with us;
• automatically, when you access or use the Platform, through Cookies, browser local storage, server logs and similar technologies;
• from third parties, being the sign-in provider you choose to authenticate with; and
• from a Cookbook’s Owner, where an Owner includes information about you in their Recipe Content.

5. Purposes of collection, use and disclosure

We collect, hold, use and disclose your Personal Information for the following purposes:

• to provide, operate and maintain the Platform, including storing your recipes and photographs and publishing your Cookbook when you ask us to;
• to read and type up photographs of handwritten recipes, and to translate them into the language you select, where you use that feature;
• to create, manage, secure and administer your account;
• to personalise your experience and remember your preferences;
• to show an Owner how many people have visited their Published Cookbook;
• to communicate with you, including to respond to your enquiries, send transactional messages, provide support and notify you of changes to the Platform or this Privacy Policy;
• to send you marketing communications about our products and services, where you have consented or where we are otherwise permitted by law;
• to operate, evaluate, improve and develop the Platform, including by analysing usage patterns;
• to detect, prevent and respond to fraud, abuse, security incidents and other harmful or unlawful activity;
• to comply with our legal and regulatory obligations, respond to lawful requests from courts, regulators or law enforcement, and exercise or defend legal claims;
• to facilitate a corporate transaction, including a sale, merger, acquisition, reorganisation or insolvency proceeding involving us; and
• to generate aggregated and de-identified data and insights, subject to the limits in clause 10.

6. Lawful bases for processing under the GDPR

Where the GDPR applies to our processing of your Personal Information, we rely on the following lawful bases under Article 6(1) of the GDPR:

• performance of a contract: where processing is necessary to provide the Platform to you under our Terms and Conditions, or to take steps at your request before entering into that contract;
• legitimate interests: where processing is necessary for our or a third party’s legitimate interests, including operating, securing and improving the Platform, counting visits for an Owner, preventing fraud and abuse, marketing similar products and services to existing customers, and pursuing or defending legal claims, except where those interests are overridden by your interests or fundamental rights and freedoms;
• consent: where you have given clear consent, including for non-essential Cookies, certain marketing communications, and any processing of Sensitive Information;
• legal obligation: where processing is necessary to comply with a legal or regulatory obligation to which we are subject; and
• vital interests: in rare circumstances, where processing is necessary to protect your vital interests or those of another natural person.

Where we rely on your consent as the lawful basis for processing, you may withdraw that consent at any time by contacting us using the details in clause 18. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7. Disclosure and sharing

We may disclose your Personal Information to the following categories of recipients:

• our hosting and infrastructure providers, being Vercel Inc. (website hosting and storage of uploaded photographs) and Neon Inc. (database hosting), which store your account, your recipes and your photographs on our behalf;
• your chosen sign-in provider, being Google LLC where you sign in with Google, for the purpose of authenticating you;
• Anthropic PBC, where and only where you use the feature that reads handwritten recipes from photographs. The photographs you submit to that feature, and the text produced from them, are sent to Anthropic’s API to be read, typed up and translated. If you never use that feature, no photograph of yours is sent to Anthropic;
• our professional advisers, including lawyers, accountants, auditors and insurers, where reasonably necessary;
• law enforcement, regulators, courts, government authorities and other third parties, where required or permitted by law or where reasonably necessary to protect our rights, property or safety, or the rights, property or safety of any other person;
• an actual or prospective acquirer, investor, financier, successor or assignee in connection with any actual or proposed corporate transaction, including a sale, merger, acquisition, reorganisation, financing or insolvency event;
• any other third party with your consent or at your direction; and
• any other person, where required or authorised by law.

We do not sell your Personal Information, your recipes or your photographs.

We require our service providers to handle Personal Information in accordance with their obligations under applicable law and to use it only for the purposes for which we disclose it to them.

8. Published Cookbooks are public

A Cookbook is private to its Owner until the Owner chooses to publish it. Once published, it is accessible to anyone who has its web address, and may be indexed by search engines. There is no password on a Published Cookbook.

Anything an Owner puts into a Published Cookbook — including names, photographs, family stories and dedications — becomes publicly readable. An Owner should not publish information about another person without that person’s knowledge and, where appropriate, consent.

An Owner may unpublish a Cookbook at any time. Unpublishing removes it from the Platform, but we cannot recall copies that have already been viewed, saved, shared or cached by search engines or other third parties.

9. International data transfers

The Platform is operated from Australia. Your Personal Information may be stored, accessed and processed in Australia and in other countries where we or our service providers have facilities or operations, including the United States, the United Kingdom and member states of the European Union.

Where we transfer Personal Information out of the EEA or the United Kingdom to a country that has not received an adequacy decision under Article 45 of the GDPR (including Australia), we put in place appropriate safeguards in accordance with Article 46 of the GDPR. These safeguards typically include the Standard Contractual Clauses, supplemented where necessary by additional technical, contractual and organisational measures.

Where we transfer Personal Information from Australia to overseas recipients, we take reasonable steps in accordance with APP 8 to ensure that those recipients handle the Personal Information in a way consistent with the APPs.

You may request a copy of the relevant safeguards we use for international transfers by contacting us using the details in clause 18.

10. Aggregated and de-identified data

We may aggregate, anonymise or de-identify information about how the Platform is used so that it can no longer reasonably be used to identify you. We do not consider aggregated or de-identified data to be Personal Information.

We may use that aggregated or de-identified usage data to operate, evaluate, improve, develop and promote the Platform, and to report on the Platform’s performance.

Your Recipe Content is excluded from this clause. We do not license, sell or otherwise commercialise your recipes, your photographs or your family stories, in original, aggregated or derived form, and we do not use them to train artificial intelligence models.

We will not re-identify aggregated or de-identified data, and we will require any third parties to whom we disclose that data not to attempt to re-identify it.

11. Storage, security and data breach

We take reasonable technical and organisational measures to protect your Personal Information from misuse, interference, loss, unauthorised access, modification or disclosure. These measures include access controls, encryption in transit, network security and regular review of our information handling practices.

No method of transmission over the internet or method of electronic storage is completely secure. While we use reasonable means to protect your Personal Information, we cannot guarantee its absolute security. You should keep your own copy of anything you would be distressed to lose.

If we become aware of an eligible data breach involving your Personal Information, we will notify you and any relevant Supervisory Authority or regulator, and otherwise comply with our obligations under the Privacy Act, the GDPR and any other applicable law.

12. Retention of Personal Information

We retain your Personal Information only for as long as is necessary for the purposes for which it was collected or as required by law.

You may delete your account at any time from Account & billing in the studio. Doing so deletes your recipes, your photographs and your account immediately. It cannot be undone.

When determining the appropriate retention period for anything we keep after that, we consider the nature and sensitivity of the Personal Information, the purposes for which we process it, our legal and regulatory obligations, the existence of any actual or threatened legal claims, and applicable limitation periods. [Insert backup and server log retention period.]

When we no longer need to retain Personal Information, we will take reasonable steps to securely destroy or de-identify it.

13. Your privacy rights

Rights under the Privacy Act. Under the Privacy Act, you have the right to request access to, and correction of, the Personal Information we hold about you. We will respond to any request within a reasonable period and in accordance with the APPs.

Additional rights under the GDPR. If you are located in the EEA or the United Kingdom, or your Personal Information is otherwise subject to the GDPR, you also have the following rights, in each case subject to the conditions and limitations set out in the GDPR:

• the right to be informed about the processing of your Personal Information;
• the right of access to your Personal Information (Article 15);
• the right to rectification of inaccurate Personal Information (Article 16);
• the right to erasure of your Personal Information in certain circumstances (Article 17);
• the right to restrict processing of your Personal Information in certain circumstances (Article 18);
• the right to data portability (Article 20);
• the right to object to processing based on our legitimate interests or for direct marketing (Article 21);
• the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you (Article 22); and
• the right to withdraw any consent you have given at any time.

Exercising your rights. You can exercise your privacy rights by contacting us using the details set out in clause 18. We may need to verify your identity before responding to a request, and we may decline a request where permitted by applicable law (for example, where the request is manifestly unfounded or excessive).

We will respond to your request within the timeframes required by the Privacy Act, the GDPR and any other applicable law. There is generally no fee for exercising your rights, although we may charge a reasonable fee where permitted by law.

If a Cookbook is about you. If a Published Cookbook contains Personal Information about you and you want it removed, contact its Owner in the first instance. If that is not practicable, contact us using the details in clause 18 and we will take reasonable steps to assist.

14. Children

The Platform is not intended for, or directed at, children under the age of 16. We do not knowingly collect Personal Information from children under 16 without the consent of a parent or guardian where required by law.

If you become aware that a child has provided Personal Information to us without the necessary consent, please contact us using the details in clause 18 and we will take reasonable steps to delete that Personal Information.

15. Artificial intelligence, automated processing and profiling

Where you use the feature that reads handwritten recipes, the Platform sends the photographs you submit to a third-party artificial intelligence service, which transcribes the handwriting into text and, if you have asked for it, translates that text into another language.

That output is a draft. Handwriting is not always read correctly, and neither is a translation. A number, a word or an instruction can come out wrong. Anything the service could not make out is marked, and every imported recipe is flagged for you to check against the original photograph before you publish it.

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you within the meaning of Article 22 of the GDPR. If we propose to do so in the future, we will update this Privacy Policy and obtain your consent or rely on another lawful basis as required by applicable law.

16. Marketing communications

We may send you marketing communications about our products, services, offers and content where you have consented to receive them or where we are otherwise permitted to do so by applicable law, including the Spam Act 2003 (Cth), the GDPR and the Privacy and Electronic Communications Regulations in the United Kingdom.

You can opt out of marketing communications at any time by clicking the “unsubscribe” link in any marketing email, adjusting your communication preferences in your account, or contacting us using the details in clause 18. We will continue to send you transactional and service-related communications in connection with your use of the Platform.

17. Cookies and tracking technologies

We use Cookies and browser storage on the Platform for the following purposes:

• strictly necessary, which are required for the Platform to function, such as keeping you signed in;
• functionality, which remember your preferences and personalise your experience;
• measurement, being the anonymous identifier stored in a Visitor’s browser so that the same person is not counted twice in an Owner’s visitor numbers; and
• advertising and marketing, which we may use, with your consent where required, to deliver and measure marketing communications.

Where required by applicable law (including the GDPR and the Privacy and Electronic Communications Regulations in the United Kingdom), we will obtain your consent before placing any non-essential Cookies on your device. You can adjust your browser settings to refuse, delete or disable Cookies. Disabling certain Cookies may affect the availability or functionality of parts of the Platform.

18. Complaints and how to contact us

If you have a question, request or complaint about how we handle your Personal Information, please contact us in the first instance at [Insert privacy contact email] or by post to our address set out in the Introduction. We will acknowledge your enquiry promptly and respond within a reasonable period.

For the purposes of the GDPR and where required by Article 27 of the GDPR, our representative in the European Union is [Insert EU representative name and address, or note ‘not applicable’], and our representative in the United Kingdom is [Insert UK representative name and address, or note ‘not applicable’].

If you are not satisfied with our response, you may make a complaint to the relevant Supervisory Authority. In Australia, you may contact the OAIC at www.oaic.gov.au. In the United Kingdom, you may contact the Information Commissioner’s Office at www.ico.org.uk. In the EEA, you may contact the Supervisory Authority in the member state of your habitual residence, place of work or the place of the alleged infringement.

Nothing in this Privacy Policy limits your rights to seek remedies under the Privacy Act, the GDPR or any other applicable law.

19. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform or applicable law. The version and date at the top of this Privacy Policy indicate when it was last updated.

We will notify you of any material change by posting the updated Privacy Policy on the Platform and, where you are a Registered User, by email. Where required by applicable law, we will obtain your consent to material changes.