Mixator AB, trading as Crubba – Privacy Policy
Last Updated: March 20, 2025
Mixator AB, trading as Crubba (“Mixator”, “Crubba”, “we”, “us”, “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and safeguard your personal data when you use our cooking platform – available both as a website (at crubba.se) and as a mobile app on the App Store and Google Play (collectively, the “Services”). This Policy is designed to meet the requirements of applicable data protection laws—including the General Data Protection Regulation (GDPR) in the EU—and to comply with Apple’s App Store guidelines.

• Account Information:
  Name, username, password, email address, telephone number, and profile picture.
• Social and Content Data:
  Recipes, meals, food plans, photos, user-generated content (comments, posts, and contacts/friends).
• Device and Usage Data:
  Device identifiers, location data (if enabled), browsing and interaction details, date and duration of use, and other usage analytics.
• Payment Information:
  Only processed via third-party providers (e.g., Apple, Google) who are responsible for the secure handling of financial data.

• Performance of a Contract:
  Processing is necessary for fulfilling the user agreement and providing the requested services.
• Legitimate Interests:
  We conduct an internal assessment to balance our interests (e.g., service optimization, analytics, and targeted marketing) against your fundamental rights.
• Consent:
  In cases such as personalized advertising or tracking that goes beyond the minimum required, we obtain your explicit consent (including through Apple’s App Tracking Transparency prompt on mobile devices).

• Data Processed: Email address, login details (including third-party logins via Apple, Google, or Facebook).
• Purpose: To enable account creation, authentication, and secure access to the Services.
• Storage: Data is retained until you delete your account or as required by applicable law.

• Data Processed: User-provided content (recipes, photos, profile data), social interactions, and device/usage data.
• Purpose: To operate, personalise, and improve our Services, as well as to provide relevant recommendations and in-app content.
• Storage: Personal data is kept for the duration of your account’s existence. Post-deactivation, data may be retained in anonymized form for analytical purposes.

• Data Processed: Usage data, interaction history, and optionally, location data.
• Purpose: To analyse and improve our services, tailor content and advertisements, and conduct market research.
• Consent and Controls: We obtain explicit consent where required and provide clear options to opt out of targeted advertising.
• Storage: Until account deletion, with any subsequent use being only in an anonymized format.

• Fixed Retention: Data tied to a contractual period or legal requirement will be stored for that specific period.
• Internal Assessment: For data processed under legitimate interest, retention is determined by regular reviews based on necessity, legal obligations, and risk assessments.
• Deletion: Upon request (or once retention criteria are no longer met), we will securely delete or anonymize your data.

• Access: Request details of the personal data we hold.
• Rectification: Correct any inaccurate or incomplete information.
• Erasure (“Right to be Forgotten”): Request deletion of your data when it is no longer necessary or if consent is withdrawn.
• Restriction: Limit the processing of your personal data in certain circumstances.
• Data Portability: Receive your data in a commonly used, machine-readable format.
• Objection: Object to processing based on our legitimate interests (including direct marketing).
• Withdraw Consent: Revoke your consent for data processing for future activities.

• Adequate Protection: Data is only transferred to countries with an adequate level of protection as determined by the EU.
• Standard Contractual Clauses (SCCs): Where no adequacy decision exists, transfers are subject to SCCs or equivalent safeguards.
• Data Processing Agreements: All processors are bound by contractual obligations to protect your data.

• Technical Measures:
  • Encryption (TLS 1.2 or higher for data in transit, AES-256 for data at rest)
  • Access controls and authentication mechanisms
  • Regular security audits and penetration testing
  • Secure network architecture and firewalls
• Organisational Measures:
  • Regular staff training and internal governance policies
  • Incident response protocols and data breach notification procedures

• Provide essential functionality,
• Analyse user interactions,
• Personalize content and advertisements.

• Data Categories Collected:
  Account and profile information, device identifiers, usage analytics, and location data (only with permission).
• Purpose:
  To authenticate users, provide personalized content, enhance app functionality, and support analytics and marketing efforts.
• Third-Party Data:
  Payment data is processed through Apple or Google; tracking through third-party SDKs is disclosed separately.
• Consent and Transparency:
  We use Apple’s App Tracking Transparency framework to obtain explicit permission before tracking across apps or websites.

• Notify you via email or in-app notifications,
• Provide an updated version on our website and within the app,
• Allow you to review and, where necessary, consent to the changes.