Privacy Policy

1. What information do we collect?

Personal information you give us

In short: we collect the personal information you provide when you create an account, buy or subscribe, or contact us.

• Account information. Your name and email address, and the identifier our sign-in provider gives your account. If you sign in with a social login, section 6 applies. Your password, if you use one, is held by our sign-in provider, not by us.
• Orders, subscription and library. The recipes in your library and how each one got there, your orders, your subscription and its history (the plan, its dates and status, plan changes, cancellations), your recipe credits, and the emails we sent you about them.
• Payment and billing information. You enter your card on pages operated by Stripe, our payment provider. We never see or store your full card number or security code. Stripe holds your card, your billing address and, when you subscribe, a customer record with the card on file for renewals. We store the identifiers Stripe gives your customer record, payments, subscriptions, invoices and refunds, together with the amount, date and tax of each charge, and we record refunds and payment disputes.
• Messages. What you send us through the contact form or by email, with your name and email address.
• Newsletter. The email address you give when you sign up for our newsletter.

All personal information you give us must be true, complete and accurate, and you must tell us about changes.

Sensitive information. We do not process sensitive personal information.

Information collected automatically

In short: our servers record technical data when you use the Services, and we count page views.

• Server logs. When you use the Services our servers record technical data such as your IP address, browser and device type, the pages and requests you make, and timestamps. We use it to keep the Services secure, to limit abuse and to diagnose problems.
• Web analytics. We use Vercel Web Analytics to count page views and see which pages are used. It sets no cookie and gives us aggregated figures, not a profile of you.
• Cookies. Our sign-in provider sets the cookies that keep you signed in. Our Cookie Policy explains all the cookies the Site uses.

2. How do we process your information?

In short: to provide, improve and administer the Services, to run your orders and your subscription, to communicate with you, for security and fraud prevention, and to comply with the law.

We process your personal information:

• To create and manage your account, so that you can sign in and keep your account in working order.
• To deliver the Services: to add recipes to your library, to show you the recipes you have access to, and to keep the features of your plan switched on.
• To run your orders and your subscription: to take payments through Stripe, to calculate tax, to renew your subscription, to issue your recipe credits, to apply the subscriber price, to handle plan changes, cancellations, failed payments, refunds and disputes, and to keep the records of all of it.
• To send you service messages: order and payment confirmations, confirmations of changes you make to your subscription, reminders before an annual renewal, failed-payment notices, price-change notices, cancellation and ending confirmations, and notices about our terms and policies. These are part of the Services and are sent to every account holder they concern.
• To respond to you when you contact us, and to offer support.
• To send you our newsletter, if you signed up for it. Newsletter emails, sent through Kit, may record whether they were opened and which links were clicked. You can unsubscribe at any time from the link in every newsletter.
• To protect the Services, including fraud monitoring, abuse prevention and security.
• To understand how the Services are used, through aggregated analytics, so that we can improve them.
• To comply with the law, for example to keep tax and accounting records, and to establish, exercise or defend legal claims.

3. What legal bases do we rely on to process your personal information?

In short: we process your personal information only when the law allows it: with your consent, to perform our contract with you, to comply with the law, to protect vital interests, or for our legitimate interests.

If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation and the UK GDPR require us to have a legal basis for each processing. We rely on:

• Performance of a contract: to provide the Services you asked for, including your account, your library, your orders and your subscription.
• Consent: for our newsletter, and where we ask for it. You can withdraw consent at any time.
• Legal obligations: to keep tax and accounting records and to comply with other laws.
• Legitimate interests: to keep the Services secure, to prevent fraud and abuse, to improve the Services, and to send service messages, where those interests are not overridden by your rights.
• Vital interests: where processing is necessary to protect someone’s life or safety.

If you are in Canada, we process your information with your express consent, or where your consent can be implied, and in the exceptional cases where the law allows processing without consent, such as fraud detection and compliance with legal orders. You can withdraw your consent at any time.

4. When and with whom do we share your personal information?

In short: with the service providers that run the Services for us, and in the situations listed here.

Service providers. We share personal information with the companies that provide the Services on our behalf. They use it to provide their service to us, and some of them, such as Stripe for payments and Google for embedded videos, also act under their own privacy policies for the information you give them directly:

• Clerk, which provides accounts and sign-in;
• Stripe, which processes payments, keeps cards on file for subscriptions, calculates tax, and operates the checkout and billing pages;
• Amazon Web Services, which delivers our transactional email;
• Kit, which sends our newsletter;
• Cloudinary, which hosts our images and videos;
• Vercel, which hosts the website and provides web analytics;
• Railway, which hosts our application and database;
• Google (YouTube), which hosts the videos embedded on some recipe pages (see our Cookie Policy);
• Slack, which carries our internal operational alerts (they contain account and order identifiers, never names or email addresses); and
• the email provider that hosts our support mailbox, which holds the messages you send us.

Business transfers. We may share or transfer your information in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business by another company.

Legal reasons. We may disclose your information where the law requires it, to respond to lawful requests from authorities, to enforce our terms, or to protect the rights, property or safety of The Lils, our customers or others.

We do not sell your personal information, and we do not share it for targeted advertising.

5. Do we use cookies and other tracking technologies?

In short: only the cookies the Services need to work, plus cookie-free analytics.

Our sign-in provider sets the cookies that keep you signed in and protect your account. Stripe sets its own cookies on its payment and billing pages. Vercel Web Analytics sets no cookie. Some recipe pages embed YouTube videos through YouTube’s privacy-enhanced player. When such a video comes into view, your browser connects to YouTube, which receives your IP address and device information and may store an identifier in your browser. YouTube sets its own cookies only when you play the video, and Google handles the information under its own privacy policy. We do not use advertising cookies. Our Cookie Policy at thelils.com/cookie-policy has the details and explains how to control cookies.

6. How do we handle your social logins?

In short: if you sign in with a social media or other account, we receive your name and email address from that provider.

You can create an account and sign in with a supported third-party sign-in service. When you do, we receive the profile information that service shares with us, such as your name, your email address and your profile picture, and we use it only as this policy describes. We do not control, and are not responsible for, what the sign-in service does with your information. Please read its privacy policy.

7. Is your information transferred internationally?

In short: our servers are in the United States, and your information is processed there.

Our Services are hosted in the United States, and our service providers process information there and in other countries where they operate. If you live in the European Economic Area, the United Kingdom, Switzerland or another country with its own data protection law, your information is transferred to the United States when you use the Services. We protect it as this policy describes, and we rely on the transfer safeguards our service providers offer, including the European Commission’s Standard Contractual Clauses where they apply.

8. How long do we keep your information?

In short: for as long as you have an account, and afterwards for as long as the law requires.

We keep your personal information for as long as you have an account with us, so that you can use your library and your subscription. When your account is deleted (section 11), we anonymize it in our own database: your name, email address and sign-in identity are replaced with placeholders, your cart is emptied, and, if you subscribed, the name and email address on the customer record our payment provider holds for you are replaced too.

We keep the records of your orders, payments, invoices, refunds and disputes, without your name or email address, for as long as tax and accounting law require, and to resolve disputes and enforce our terms. Those records keep the reference numbers of your payments with Stripe. Stripe keeps its own records of your payments, including the name, email address and billing address you entered on its pages, under its privacy policy and for as long as the law requires it to. We keep server logs for a short time for security, and we keep aggregated analytics indefinitely.

9. How do we keep your information safe?

In short: with organizational and technical security measures.

We have put in place reasonable technical and organizational measures to protect the personal information we process, and we choose providers that do the same. Despite these measures, no transmission over the internet and no storage technology can be guaranteed to be completely secure, and we cannot promise that unauthorized third parties will never defeat our security. Use the Services in a secure environment, and keep your sign-in details private.

10. Do we collect information from minors?

In short: no. The Services are for adults.

The Services are for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will close the account and delete the information as the law requires. If you believe we hold information about a person under 18, contact us.

11. What are your privacy rights?

In short: depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to restrict or object to its processing, and to withdraw consent.

In some regions, including the European Economic Area, the United Kingdom, Switzerland, Canada and several US states, you have rights under data protection law. They may include the right to access your personal information and get a copy of it, to have it corrected or deleted, to restrict or object to its processing, to data portability, and not to be subject to automated decision-making. To exercise them, contact us through the contact form at thelils.com/contact or by email at . We act on every request as the law requires, and we may ask you to verify your identity first. If you live in the EEA or the UK and believe we are processing your information unlawfully, you may also complain to your data protection authority.

Withdrawing your consent. Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it.

Marketing emails. You can unsubscribe from our newsletter at any time with the link in every newsletter, or by contacting us. Service messages about your account, your orders and your subscription are not marketing, and we keep sending them while you hold an account.

Your account information. You can review and change your name and email address from your account settings. To delete your account, contact us through the contact form or by email; you cannot delete it from your account settings. Before we delete a subscriber’s account we tell you what ends: deleting the account ends your subscription at once, nothing more is charged, there is no automatic refund of a period you have paid for, and you can no longer open your library or use unused recipe credits. We then anonymize the account as section 8 describes and keep the records the law requires.

12. Controls for Do-Not-Track features

Most browsers and some mobile operating systems offer a Do-Not-Track (“DNT”) setting that signals your preference not to have your online activity tracked. No uniform standard for recognizing DNT signals has been adopted, so we do not respond to them at this time. If a standard we must follow is adopted, we will say so in a revised version of this policy. California law requires us to tell you how we respond to DNT signals; this is our answer.

13. Do United States residents have specific privacy rights?

In short: if you live in a US state with a consumer privacy law, you may have specific rights over your personal information.

Several US states, including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, have consumer privacy laws. Where they apply to us, they give you the rights listed below.

Categories of personal information we collect

We use and keep the information in categories A, B, D and F as described in sections 2 and 8.

Your rights

• The right to know whether we process your personal information, and to access it.
• The right to correct inaccuracies.
• The right to request deletion of your personal information.
• The right to a copy of the personal information you gave us.
• The right not to be discriminated against for exercising your rights.
• The right to opt out of targeted advertising, the sale of personal information, and profiling with legal or similarly significant effects. We do none of these.

How to exercise your rights

Contact us through the contact form at thelils.com/contact, by email at , or through the contact details in section 15. We may ask you to verify your identity. You may authorize someone to make a request for you; we may ask for proof of the authorization.

California “Shine the Light” law

California Civil Code Section 1798.83 lets California residents ask us, once a year and free of charge, which categories of personal information, if any, we disclosed to third parties for their direct marketing purposes. We disclose none. To ask, use the contact details in section 15.

14. Do we make updates to this policy?

In short: yes, to keep up with the law and with changes to the Services.

We may update this policy from time to time. The updated version is shown by the date at the top. If we make material changes, we will post a notice on the Site or email you. Please review this policy from time to time.

15. How can you contact us about this policy?