Privacy policy

Your data, in plain language

Last updated: 30 October 2026

You can read the recipes without an account. If you choose to create one, you can also save and like recipes or mark the dishes you have cooked. The chat remains separate.

1. Who is responsible for the data

The controller of the data collected through dupagust.com is Carmen Vasinca, a natural person. For questions about personal data or requests for erasure, contact us at [email protected].

2. What data we collect

For personal accounts, we collect the email address, the date the account was created, login sessions and the markers for recipes saved, cooked or liked. The administrator can view these markers linked to the accounts, in order to analyse explicit interactions. We do not track the time spent on a page or printing at an individual level.

When you use the “Write to Carmen” chat, we receive the name you choose, the messages and the replies, as well as the dates of creation and of the last interaction. A functional cookie helps the browser resume the conversation.

For security purposes, the server may process the IP address and other technical data in its logs; the mechanism that protects against abusive messages uses an identifier derived from the IP address.

Please do not send passwords, bank details, medical information or other sensitive data that are not necessary for your question.

Shared shopping lists are optional and do not require an account. For each list, we keep the recipe title, the selected ingredients, the ticks and a random identifier included in the link. Anyone who receives the link can see and change the ticks, without seeing any account data. To prevent abuse, we temporarily use an identifier irreversibly derived from the IP address when lists are created. Do not include personal or sensitive data in lists.

The restaurant survey: if you choose to respond, we keep the features you ticked, the free-text comment and the date of submission. We do not ask for a name, an account or an email address, and we do not link your response to the prices and portions entered in the calculator. To limit repeat votes, the browser receives a functional cookie with a random token; in the database we keep only its cryptographic hash. Please do not include personal data in your free-text answer. As with other requests, the server's technical logs may contain the IP address and access data.

3. Purpose and legal basis

We process account data in order to provide the personal collections service requested by the user, in accordance with Art. 6(1)(b) GDPR. Aggregated analysis of the stated preferences helps improve the site, on the basis of legitimate interest, subject to the right to object.

We process messages in order to respond to requests and to allow the conversation to continue. Technical data are used to secure the site and to prevent abuse. The legal basis relied on is the legitimate interest in communication and security, under Art. 6(1)(f) GDPR, with due respect for the rights of the data subjects.

We do not sell chat messages and we do not use them for personalised advertising. The voluntary survey is used to evaluate future features of the site, on the basis of the legitimate interest in improving the service.

4. How long we keep the data

• The restaurant survey: the selections and the free-text answer are kept for a maximum of 90 days and are then deleted automatically. The vote-limiting cookie expires after 90 days; we do not use it for advertising or for cross-site tracking.
• The account and marked recipes: until you delete the account, including from the “My notebook” interface. Local backup copies of the accounts are rotated within approximately 14 days, a period during which deleted data may persist only in backups.
• Login codes: expire after 10 minutes, and a session can last a maximum of 30 days.
• Conversations and the associated names: 90 days from the last message, after which they are deleted by the periodic clean-up of the database.
• The dg_chat functional cookie: 30 days from its creation.
• Temporary identifiers used to limit messages: intervals of at most one hour; expired records are removed during the periodic clean-up.
• Local backup copies of the chat: are rotated approximately every 14 days. A conversation deleted from the active database may temporarily remain in a backup copy until that copy expires.
• Shared shopping lists: up to 30 days from creation, or until deleted with the revoke button available in the creator's browser. The link allows anyone who holds it to access and modify the list. The anti-abuse identifiers for lists expire after approximately 24 hours.
• Access logs and backups of the hosting infrastructure: are managed separately, at server level, according to security and recovery needs. The exact technical periods can be requested by email; they require confirmation from the hosting administrator.

In legally justified cases, certain data may be kept for longer, but only to the extent necessary to comply with the obligation concerned or to defend a right.

5. Cookies and external services

The functional cookie for the survey, dg_restaurant_survey, is used exclusively to limit repeat responses to the voluntary survey.

The functional cookie dg_account keeps you logged in, for a maximum of 30 days. It is separate from the chat cookie. We do not treat the time spent on a page or printing as proof that someone has made a recipe. We do not enable optional behavioural tracking without informing you and, where required, obtaining your consent.

The dg_chat cookie is necessary to continue the conversation you requested; it is set with HttpOnly, SameSite=Lax and Secure when the site is accessed over HTTPS. If you choose an external service, for example Google Translate, that service may process data in accordance with its own policy.

6. Access and security

Conversations are available to the chat administrator and, where necessary, to the persons authorised to maintain the site. Hosting providers may process technical data necessary for the service. The chat uses HTTPS, authentication for administration and a database outside the public area.

7. Your rights

Under the conditions laid down by the GDPR, you can request access to, rectification or erasure of your data and restriction of processing, you can object to processing based on legitimate interest and you can exercise the right to data portability where the legal conditions are met.

Send your requests to [email protected]. We will respond without undue delay, as a rule within one month at the latest. For the security of the data, we may ask for reasonable verification of your link to the conversation.

You can lodge a complaint with ANSPDCP (the Romanian National Supervisory Authority for Personal Data Processing).

8. Changes

This policy will be updated whenever we change the way we process data. The date of the last change is shown at the top.