Privacy notice

Last updated 11 October 2026 · Applies to app.rara.recipes and rara-recipes.no

Who is responsible

RaRa Recipes (“RaRa”) is operated by Backroad AS, org. no. 934 341 929, Bergen, Norway — the data controller for the processing described here. Privacy inquiries are handled directly by the responsible team: [email protected].

What RaRa is

RaRa is a private recipe archive. What you record — recipes, photographs, dictations, notes — belongs to your archive and is visible only to the people invited into it. Your content is never public, never sold, and never used to train AI models.

What we process, why, and on what legal basis

• Account and membership — your name, email address, role in an archive, and sign-in records. Needed to provide the service (GDPR Art 6(1)(b), contract); without a name and a working email address an account cannot be provided. When you start a collection yourself, the address you type is kept for two days only to limit repeated sign-up emails, then deleted.
• Your content — recipes, photographs of recipe cards, voice-dictation transcripts, and notes you add. Processed to provide the service (Art 6(1)(b)). Stored privately per archive.
• Voice dictation — when you dictate, speech is turned into text and the transcript is stored as your draft. The audio itself is not retained.
• The assistant — when you photograph, upload or dictate a recipe, the assistant first reads it into a draft with Claude through Amazon Bedrock, run by Amazon Web Services in the EU. Amazon states that it does not store what is sent to this model, except an image its automated checks flag as illegal content, and that it does not pass it on to Anthropic, the model's maker (checked 11 October 2026). When you answer the assistant or talk to it about a recipe, the recipe, its photographs and your messages are sent to Anthropic in the US. When you ask for a variation, and each time you publish (the assistant checks the recipe first), the recipe's text is sent to Anthropic in the US (see below). Basis: performance of the service you asked for (Art 6(1)(b)). Anthropic does not train models on this data.
• Technical logs — IP addresses and request logs, kept briefly for security and reliability (Art 6(1)(f), legitimate interest).
• Error reports — when something breaks, Sentry receives a technical report with the page and the browser, never what you typed (Art 6(1)(f)).
• Backups — an encrypted copy of the database and your photographs is made every day and kept in the EU with Cloudflare, so nothing is lost if something fails (Art 6(1)(f)).
• Paying for RaRa — if you choose to pay, Stripe handles the payment: your name, email address, card details and payment history. RaRa itself never sees your card number. Basis: the payment you asked for (Art 6(1)(b)); payment records are kept for as long as bookkeeping law requires (Art 6(1)(c)).
• Feedback — when you use the feedback button, what you write, the page you were on, your device type and language go to Innflyt, Backroad AS's own feedback service, which posts it to our team's Slack (Art 6(1)(f), our interest in hearing about problems).
• Email to us — messages to [email protected] are kept in our mailbox at Migadu so we can answer them (Art 6(1)(f)).
• Reports about the assistant — if you report an answer, the answer, the recipe it belongs to and who reported it are kept so we can look at it (Art 6(1)(f), keeping the assistant safe).
• Invitations — when a member invites you, they give us your name and, only if they choose to email it through RaRa, your email address (Art 6(1)(f), the member's legitimate interest in sharing their own archive). The invitation link is sent from the inviter's own phone through the app they pick — Messages, WhatsApp, Snapchat, their mail app or the share sheet — so that app, not RaRa, carries the message; RaRa sends only invitations the inviter asks us to email. An invitation lasts 14 days. The details are deleted when it expires or is withdrawn; if you join, the email address becomes your account.

Who processes data for us

The sign-up form is protected by Cloudflare Turnstile, which checks that a real person is filling it in rather than a machine. It runs invisibly and sets no cookie for advertising or tracking; Cloudflare describes what it collects in its Turnstile Privacy Attestation. Referencing it here is a condition Cloudflare sets for using the invisible mode.

Your data is stored in the EU and Norway (Stockholm and Stavanger), with encrypted backups kept in the EU. Photographs, PDFs and dictated text are first read into a draft in the EU; conversations with the assistant (including the recipe's photographs), variations and the check before publishing are processed by Anthropic in the US, payments by Stripe in Ireland and the US, and feedback reaches our team through Slack in the US, each under the safeguards above; a copy of the applicable safeguards is available on request via the contact address. This notice is updated if any of this changes.

No automated decisions

RaRa makes no automated decisions with legal or similarly significant effects about you. The assistant only drafts and suggests — a person always reviews and decides.

How we protect it

Traffic is encrypted in transit and data is encrypted at rest; access is separated per archive at the database level; backups are encrypted and stored in the EU; access to production systems is restricted and logged.

Wherever you live

We apply the protections described here to everyone who uses RaRa, in every country. If you live outside Norway or the EEA, local law may give you additional rights, and nothing here limits them.

How long we keep things

Your account and content stay until you delete them or your archive is closed. Technical logs are kept for roughly 30 days. Each backup is deleted automatically about 90 days after it is made (the database provider's own backups after 7 days). The 90 days count from when the backup was made, not from when you deleted something: content still held in the service is included in new backups until it is erased there.

Your rights

You can ask for access to, correction of, deletion of, or a copy (portability) of your personal data, ask us to restrict processing, and object to processing based on legitimate interest. Write to [email protected] — we respond within one month. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet, or to the supervisory authority where you live.

Children

You need to be 13 or older to have your own RaRa account, and 18 or older, or have a parent's permission, to pay. Children under 13 cannot sign in, but a collection may naturally mention people, including children, in recipes, photographs and stories — archive administrators are responsible for what their archive records, and anyone can ask us to remove content about them via the address above. The assistant is an AI, and it follows its provider's safeguards for users under 18: it only helps with cooking, and any answer can be reported. More in About the assistant.

Changes

When this notice changes, the date at the top changes with it, and material changes are announced in the app.