SmartPlate

Account & identity. When you sign in (via our identity provider, Auth0), we receive a unique account identifier and basic profile details, and we store your username and dietary preferences. We do not store your password.

Content you create. Recipes, edits, ratings, reviews, meal plans, shopping lists, and recipe images. Recipes, ratings, and reviews are public (see Section 3); meal plans and shopping lists are private to your account.

Billing data. When you subscribe, Stripe processes your payment details. We do not store your full card number — only a Stripe customer identifier and your subscription/trial status.

Agent & API activity. If you connect an AI Agent (sign in first at /connect-agent; a scoped token is optional), we store a hashed credential (never the plaintext) and an audit log of actions taken with it, so you can see what your agent did.

Usage & log data. Server logs with a request identifier, your account id, timestamps, IP address, and basic request metadata, used for security, debugging, and reliability.

We use your information to provide and operate SmartPlate, process your subscription and trial and prevent payment fraud, let you connect agents and see what they did, secure the service and meet legal obligations, and communicate with you about your account and billing. Where GDPR/UK GDPR applies, we rely on performance of a contract, legitimate interests (security and improvement), consent, and legal obligation.

SmartPlate has no private recipes. Your recipes, ratings, and reviews are public and discoverable by other users and by AI agents, attributed to the account identifier (handle) you choose. Because we canonicalize content (the same recipe from many sources becomes one shared entry) and others may build on public Contributions, we may be unable to fully remove already-shared content after deletion. Don’t submit anything private or confidential.

We don’t sell your personal information. We share it only with service providers that help us run SmartPlate, under contract:

AI note: SmartPlate’s backend runs no AI/LLM inference and does not use your data to train AI models. The only AI processing we perform is in the web app, when you ask it to parse a recipe you paste, photograph, or link — that content is sent to Anthropic to extract structured recipe data. Agents you connect bring their own AI and operate under their own providers’ terms.

We may also disclose information to comply with law, enforce our Terms, or protect rights and safety, and in a merger or acquisition (with notice where required).

We keep your account and content data while your account is active. After deletion, we remove or de-identify your private account data within 30 days, except already-public Contributions (Section 3) and records we must keep for legal, tax, security, or fraud-prevention reasons (for example, billing records for up to 7 years).

We use measures such as encryption in transit, hashed tokens, scoped access, and access controls. No system is perfectly secure, but we work to protect your data and will notify you of a breach where required by law.

Depending on where you live, you may have rights to access, correct, delete, port, or restrict your personal data, to object to certain processing, and to withdraw consent. California residents have rights under CCPA/CPRA; we do not sell or “share” personal information as defined there. To exercise a right, contact support@highway410.com and we’ll respond within the legally required time. You won’t be discriminated against for exercising your rights.

We and our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for transfers out of the EEA/UK.

SmartPlate is not directed to children under 13, and we don’t knowingly collect their data. If we learn we have, we’ll delete it.

We’ll post changes here and, for material changes, notify you via email or in-app. The “Last updated” date shows the latest version.

Privacy questions: support@highway410.com.