Privacy Policy

1. Data Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Data We Collect

We collect and process the following personal data:

• Order data (name, address, email address) when placing orders
• Payment data (processed directly by Shopify)
• Usage data (pages visited, access time, browser used)
• Communication data (email inquiries, chat messages)
• AI chatbot data (your questions are transmitted to Anthropic for processing)

3. Purpose of Data Processing

• Processing and fulfillment of orders and contracts
• Providing and improving our website
• Responding to customer inquiries
• Operating the AI chatbot for recipe and product advice

4. Legal Basis

• Contract performance (Art. 6(1)(b) GDPR) — for orders and deliveries
• Legitimate interest (Art. 6(1)(f) GDPR) — for website analysis and improvement
• Consent (Art. 6(1)(a) GDPR) — for AI chatbot and newsletter

5. Cookies

Our website uses only technically necessary cookies for the shopping cart and language settings. Analytics or advertising cookies are currently not used. Should we use such cookies in the future, we will obtain your consent.

6. Third-Party Services

Shopify

We use Shopify (Shopify International Limited, Ireland) for order and payment processing. Shopify processes your order and payment data. For more information, see Shopify's privacy policy: https://www.shopify.com/legal/privacy

Vercel

Our website is hosted by Vercel Inc. (USA). When visiting our website, technical data (IP address, browser type) is transmitted to Vercel servers. Vercel is subject to the EU-US Data Privacy Framework.

Supabase

We use Supabase (USA) as a database for recipes and content. No personal data is transmitted to Supabase unless you participate in the AI chat.

Anthropic (Claude AI)

Our AI chatbot uses the API of Anthropic (USA). When you use the chatbot, your questions are transmitted to Anthropic for processing. Anthropic stores this data in accordance with its privacy policy. Using the chatbot is voluntary.

7. Data Transfer to Third Countries

Some of our service providers are based in the USA. The transfer is based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

8. Data Retention

We store your data only as long as necessary for the respective purposes or as required by statutory retention periods (e.g., 6 years under commercial law, 10 years under tax law).

9. Your Rights

You have the right at any time to:

• Access your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)

Please contact us at: info.omune@gmail.com

10. Supervisory Authority