Privacy Notice

1. Scope and controller

This Privacy Notice applies to the Roux app, account, import, recipe, sharing, support, and related online services. Roux operates under the business name Studio Bach for an intended United States and Canada launch. Its operator is responsible for how personal information is processed, including processing by service providers acting for it.

The operator’s legal identity, physical address, and dedicated privacy contact must be published before public launch. Until then, questions can be sent through support@rouxrecipes.com.

2. Information you provide

Roux may collect account and sign-in information such as your email address, provider identifier, handle, profile photo, and authentication records. It also processes recipe edits, source links, pasted text, photos, videos, documents, feedback, support messages, and other content you choose to submit.

If you share a recipe, Roux processes invitation, redemption, sender, recipient, and copied-recipe records needed to provide and secure that feature.

3. Information collected automatically

Roux processes device, app version, request, security, import-stage, performance, error, storage, and usage records needed to operate and protect the service. Search and recipe activity may be stored as part of your private account experience.

Product analytics is optional. The consent sheet initially selects this option, but collection stays off until you tap Agree and continue with it selected. You can untick it before continuing. Roux sends a user or device identifier and product-interaction events to Amplitude, which may derive approximate location from the request IP address. Roux does not send GPS coordinates as analytics properties or use this data for cross-app tracking. Session recording is disabled. You can turn future analytics collection off in Settings; that does not erase information already sent. The sign-in consent sheet and this notice describe this optional collection; the Settings toggle applies changes immediately.

4. Why Roux uses information

Roux uses information to authenticate you; import, structure, store, search, scale, display, edit, and share recipes; create and deliver media; provide support; prevent fraud and abuse; enforce usage and storage limits; diagnose failures; maintain source provenance; handle rights reports; comply with law; and improve reliability and product usability.

Roux does not use personal information for a materially different purpose without notice and any consent required by law. Roux does not sell personal information and does not use it for cross-context behavioral advertising.

5. Service providers and AI processing

Roux uses contracted providers for authentication and cloud hosting, email delivery, source retrieval, media storage and transformation, AI-assisted recipe and media processing, analytics, security, and infrastructure operations. Depending on the feature and deployment configuration, those providers may include Google Firebase and Google Cloud, OpenAI, Google Gemini, TwelveLabs, Cloudinary, Apify, Bright Data, Resend, and Amplitude.

When you request an import or generated feature, relevant source text, images, video, audio, documents, recipe context, or technical identifiers may be sent to the providers needed to complete that request. These materials may contain personal information about you, a creator, or another person. After sign-in, a consent sheet links to this notice and offers optional product analytics. You can enable Allow AI processing directly in Settings. If permission has not been granted, the import flow asks for it before submitting content. Enabling the Settings toggle gives permission for future AI imports on this device; changing it does not submit content or start an import. These choices are remembered per account on this device; signing in on another device may require a new choice. Withdrawing AI permission prevents new processing requests from this device; it does not recall requests already submitted. Providers may process information outside your province or country, including in the United States, where it may be subject to lawful access by local authorities. Production processing locations, contractual protections, and any required transfer assessments must be verified before launch.

Roux does not authorize providers to use your private content for their own advertising. Provider retention and model-training settings must be verified and documented for the exact production contracts before launch.

6. Sharing and legal disclosures

Roux shares information with people you intentionally invite and with service providers acting for Roux. It may also disclose information when reasonably necessary to comply with valid legal process, protect a person’s safety or rights, investigate abuse, enforce these Terms, or complete a merger, financing, acquisition, or sale subject to appropriate notice and protection.

Roux may provide a rights notice and relevant contact information to the affected user to handle the claim. A U.S. copyright counter-notice is provided to the original complainant when Roux follows the applicable DMCA process. These disclosures may include the name, address, telephone number, and email included in the notice. Provide only information needed for the report and required declarations; do not include unrelated sensitive information.

7. Retention

Account recipes, completed source media, and related records are generally retained while your account or recipe remains active. Failed-import media is ordinarily eligible for deletion after 7 days, temporary processing media for a completed import after 30 days, and unsettled or orphaned uploads sooner. Limited private operational records may be retained as needed for reliability, security, dispute handling, and legal compliance.

The intended analytics retention period is 12 months for product events, subject to activation and verification before production collection. Session recording is disabled. Account deletion initiates an asynchronous provider-first erasure process; completion across all processors must be verified. A persistent record keyed by a hash of the account identifier may remain to prevent recreation of the deleted identity. That record is pseudonymous, not necessarily anonymous, and does not contain your email, recipe content, source URL, or media.

Deletion workflows are designed to remove linked import-learning records. Roux must adopt a specific time-based retention policy for those records and verify deletion across production processors before public launch. Legal-hold records, where required, must be kept separately from user-visible recipes. Deleting your recipe or account does not necessarily delete an independent copy retained by a sharing recipient. Roux also maintains reusable recipe information derived from public sources separately from your account; those records may survive deletion of your copy. Public availability does not eliminate privacy or creator rights, and retained information remains subject to applicable rights requests. Private uploads and personal edits must not be treated as public-source material.

8. Your choices and rights

You can edit or delete recipes, turn off future product analytics, sign out, and request account deletion in Settings. Depending on where you live, you may also have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to appeal a denied request.

To make a privacy request, contact support@rouxrecipes.com and identify the account involved. Roux may request information reasonably needed to verify the request and may retain information that law permits or requires it to keep. Where processing depends on consent, you may withdraw it, subject to applicable legal or contractual restrictions and reasonable notice. Roux will explain any effect on features that need that processing. You may complain to the relevant Canadian federal or provincial privacy commissioner or applicable U.S. regulator.

9. Security

Roux uses authentication, access controls, encryption in transit, private storage, bounded signed links, abuse controls, and deletion workflows intended to protect information. No online service can guarantee absolute security. Contact Roux promptly if you believe your account or information has been compromised.

10. Children

Roux is not directed to children under 13 and does not knowingly collect their personal information. If you believe a child under 13 has provided personal information, contact Roux so it can investigate and delete the information where required. Additional age or parental-consent rules may apply in some countries.

11. Changes and contact

Roux may update this notice as data practices change. Material changes will be identified by a new effective date and communicated through the app or another reasonable channel. Consent will be requested where required.

Privacy questions and requests can be sent through support@rouxrecipes.com until the dedicated privacy contact is published.