Privacy Policy | TastefulKit

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us for support. This may include:

Name and email address
Account credentials
Project information and content
Communication preferences

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our services
Send technical notices, updates, and support messages
Respond to your comments and questions
Monitor and analyze usage and trends

3. Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except as described in this policy. We may share your information:

With service providers who assist us in operating our platform
When required by law or to protect our rights
In connection with a business transfer or acquisition
In connection with a merger, acquisition, bankruptcy, or sale of assets, we may transfer your information to the acquiring entity. You will be notified via email and/or prominent notice on our website of any such change.

Stripe manages any existing subscription payments and billing details. New subscriptions are not offered. We share your account email and an internal account identifier with Stripe and store customer and subscription identifiers, subscription status, and billing period dates. Card details are entered directly with Stripe; we do not store card numbers.

4. Data Security

We implement industry-standard security measures including:

Encryption of data in transit (TLS/SSL)
Encryption of sensitive data at rest
Regular security audits and updates
Access controls and authentication requirements

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Cookies and Tracking Technologies

We use the following types of cookies:

Essential cookies: Required for the service to function
Analytics cookies: Help us understand campaign and product-flow performance
Preference cookies: Remember your settings and preferences

Analytics runs automatically for visitors and signed-in users, without an opt-in banner. We use PostHog to collect page activity, campaign/referral information, account events, browser and device details, and IP addresses with approximate location. Cookies and local storage associate visits; signed-in activity is linked to an internal profile ID. We do not send form contents, passwords, API keys, or private page URLs in analytics events. PostHog session recordings and automatic capture of every click are disabled.

We use Sentry for error reports, performance traces, code profiles, operational logs and metrics. We exclude request bodies, credentials and private URL paths from these reports. On selected public pages, Sentry records a sample of anonymous sessions and sessions with errors to help diagnose problems. Text and inputs are masked, media is blocked, and network bodies are not recorded. Replay is disabled for signed-in users, account pages and URLs containing query parameters or fragments. Sentry uses session storage to associate recordings. Monitoring runs automatically.

Third-party services that may set cookies or use browser storage include:

PostHog (website and product analytics)
Sentry (error monitoring, performance and masked session replay)

You can control cookies through your browser settings. Note that disabling essential cookies may affect service functionality.

6. Your Rights

You have the right to:

Access and update your personal information
Delete your account and associated data
Opt out of marketing communications
Request a copy of your data

7. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

8. Contact Us

If you have any questions about this privacy policy, please contact us at:

Contact: LVTD, LLC
Email: [email protected]
Website: https://tastefulkit.com

9. California Privacy Rights (CCPA)

California residents have specific rights regarding their personal information:

Right to know what personal information is collected
Right to know if personal information is sold or disclosed
Right to say no to the sale of personal information
Right to access your personal information
Right to equal service and price
Right to request deletion of personal information

We do not sell your personal information. To exercise these rights, contact us at [email protected] with "CCPA Request" in the subject line.

10. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your state, province, country, or other governmental jurisdiction where privacy laws may differ. If you are located in the European Economic Area (EEA), we ensure appropriate safeguards are in place for data transfers.

11. European Users' Rights (GDPR)

If you are located in the EEA, you have additional rights under GDPR:

Right to access: Request copies of your personal data
Right to rectification: Request correction of inaccurate data
Right to erasure: Request deletion of your data
Right to restrict processing: Request limitation of data processing
Right to data portability: Receive your data in a structured format
Right to object: Object to processing of your personal data
Right to withdraw consent: Withdraw consent at any time

Legal basis for processing: We process your data based on contract performance, legitimate interests, and your consent where applicable.

Design preferences and votes

Signed-in design comparisons and saved references inform your private taste ranking. Your first vote on a pair also contributes to community rankings. Resetting taste stops using older choices and saves for recommendations; it does not erase vote history or remove saved references. Account deletion removes the link between your account and retained comparison history, preserving community results.

12. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this policy. Specifically:

Account information: Retained while your account is active
Content and projects: Retained until you delete them or close your account
Marketing data: Retained until you unsubscribe or request deletion

After account deletion, we may retain certain information for legal compliance, fraud prevention, and dispute resolution purposes.

13. AI Service Providers

We use OpenRouter to route optional AI-powered features across supported model providers. Your content may be processed by OpenRouter and the selected model provider in accordance with their privacy policies:

OpenRouter Privacy Policy: [link]
Selected model provider privacy policy: [link]

We configure these services to not use your data for training their models where possible, but you should review their policies directly.

Newsletter signup is optional and separate from creating an account. We store your email address and subscription status in our self-hosted Listmonk instance and use Mailgun to deliver confirmation and newsletter emails. You must confirm your email before receiving the newsletter, and every edition includes an unsubscribe link. We do not enable newsletter open or click tracking. We use a short-lived, hashed network identifier to limit signup abuse.

14. Children's Privacy

Our service is not intended for children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

15. Automated Decision Making

We use AI to generate content suggestions, but all final decisions about content publication remain with you. We do not use automated decision-making that produces legal effects or similarly significant impacts on you.

16. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law, typically within 72 hours of discovering the breach.