Privacy policy.

01Who is responsible for your data

Filmsim Recipes ("Filmsim", "we", "us"), Portugal, is the data controller for the personal data described in this policy. It applies to filmsimrecipes.com, the Filmsim Recipes mobile app and the Filmsim shop.

For anything to do with your data, write to [email protected]. A person reads it, and we answer within five working days.

We are a small team. There is no separate data protection officer, because the law does not require one at our size, but there is always someone accountable, and it is not a ticket queue.

02What we collect, and why

Only what the Service actually needs. Every row below exists because a feature would break without it.

03Photographs and EXIF metadata

This matters more here than on most sites, so it gets its own section.

When you upload a straight-out-of-camera frame, the file usually carries EXIF metadata written by your camera. We read the camera body, lens, film simulation and exposure fields, because that is how a frame gets labelled and how we check a recipe was genuinely used.

• Kept and shown: camera body, lens, and the in-camera settings.
• Kept, not shown: capture date and time, used only for sorting.
• Stripped before publication: GPS coordinates, serial numbers and owner-name fields.
• Never inferred: we do not run face recognition, object detection or location lookup on your photographs.

If you would rather no metadata reached us at all, strip it before uploading. The frame will still publish; it just will not carry a camera label.

04Our legal basis

Under the GDPR we need a lawful basis for each use. Ours are:

• Contract, running your account, syncing your library, delivering what you bought, handling a submission.
• Legitimate interests, keeping the Service secure, preventing abuse and scraping, understanding which features are used. We balance these against your rights, and you can object at any time.
• Consent, our newsletter, optional analytics cookies, and featuring your photographs in our own marketing. Withdraw it whenever you like, with no effect on anything else.
• Legal obligation, tax and accounting records for purchases.

05Cookies and analytics

We use as few as we can get away with. Nothing in the first group can be switched off without breaking the site; everything in the second is opt-in and off until you say yes.

Some things you would expect to be a cookie are not: your saved handle on the upload form, your private recipe notes on this device, and your library filters live in your browser's local storage, which never leaves your machine unless you are signed in and syncing.

Review your cookie choices →

06Who we share data with

We do not sell your data, and we do not share it for anyone else's marketing. We do use a small number of processors to run the Service, each bound by contract to use your data only on our instructions.

Where a processor sits outside the EU, transfers rely on the European Commission's Standard Contractual Clauses. We will also disclose data if we are legally required to, and where we are permitted to tell you, we will.

07How long we keep things

The retention column in section 02 is the authoritative list. In summary:

• Account data lives as long as your account does.
• Delete your account and personal data is removed within 30 days, apart from purchase records we must keep for tax.
• Server logs roll off after 30 days. Diagnostics after 14 months.
• Recipes you published and photographs credited in the gallery may stay, because other photographers depend on them. Ask us and we will remove or anonymise them.
• Backups are overwritten on a 35-day cycle, so a deleted item can persist there briefly before it is gone for good.

08Your rights

If you are in the EU or UK you have the rights below. They are free to use, and we will not make you justify yourself.

To use any of these, email [email protected] from your account address. We reply within five working days and complete requests within one month.

If you think we have handled your data badly, tell us first, but you can also complain to your national supervisory authority. In Portugal that is the CNPD.

09Security

Traffic is encrypted in transit. Passwords are stored hashed and salted, never in plain text, and nobody here can read yours. Access to production data is limited to the people who need it and logged.

No system is perfect. If a breach affects your personal data and creates a real risk to you, we will notify the supervisory authority within 72 hours and tell you directly, what happened, what it means, and what to do.

Found a vulnerability? Write to [email protected]. We will not take legal action against good-faith research.

10Children

The Service is not intended for children under 16. We do not knowingly collect their data. If you believe a child has created an account, tell us and we will remove it.

11Changes to this policy

We may update this policy. When a change materially affects your rights or how we use your data, we email account holders and update the date at the top at least 14 days before it takes effect.

We keep previous versions. Ask and we will send you the one that applied on any given date.

12Contact

Filmsim Recipes · Portugal

Data protection requests: [email protected]
Security reports: [email protected]
Everything else: [email protected]