Privacy Policy | Easy Everyday Baking

1. Who we are

This privacy policy applies to the website https://easyeverydaybaking.com ("the Site"), operated by Easy Everyday Baking (operator name — configure in Admin → Settings), located in (country — configure in Admin → Settings) ("we", "us", or "our").

Easy Everyday Baking is a recipe and baking content website run by a single creator. We are not a registered business collecting personal data at scale. We collect only the minimum data needed to operate the Site and respond to your messages.

2. What personal data we collect and why

a) Contact form submissions

When you use the contact form at /contact, we collect:

Name — so we know how to address you
Email address — so we can reply
Subject and message — the content of your enquiry

This data is used solely to respond to your enquiry. It is delivered to our inbox via Resend (see §5) and is not stored in any database, not used for marketing, and not shared with anyone other than the email service required to deliver it.

b) Admin authentication

The Site has a private admin area at /admin used exclusively by the site creator. Public visitors do not have accounts and do not log in. For the admin account, Supabase stores:

Email address and password hash
Session tokens (stored in secure HTTP-only cookies)
Display name and role

c) Technical/operational data

When you visit any page, our hosting infrastructure (Replit) and CDN/security layer (Cloudflare) may process your IP address, browser type, and request metadata for security, abuse prevention, and reliability purposes. This is standard server-side data necessary to deliver web pages and protect the Site. We do not log this data ourselves, and do not use it to profile visitors.

d) Security verification (Cloudflare Turnstile)

The contact form is protected by Cloudflare Turnstile, a privacy-preserving CAPTCHA alternative. Turnstile may process your IP address and browser attributes to distinguish humans from bots. No data is shared with Cloudflare beyond what is necessary for this security check.

3. Legal bases for processing

Where EU/UK data protection law (GDPR / UK GDPR) applies, we rely on the following legal bases:

Legitimate interests (Article 6(1)(f)) — operating and securing the Site, including infrastructure and security services. Our interest in secure and reliable operation is not overridden by your interests or rights.
Legitimate interests — responding to contact form messages you voluntarily submit. You initiate contact; responding is the natural and expected outcome.
Legitimate interests — maintaining admin authentication so the site creator can manage content.

We do not currently use your personal data for direct marketing, profiling, or automated decision-making that produces legal or similarly significant effects.

4. How long we keep your data

Contact messages — retained only in our email inbox for as long as necessary to manage the correspondence (typically until the thread is resolved and archived or deleted). We delete messages that are no longer relevant.
Admin session data — session tokens expire automatically (as configured in Supabase Auth). Admin account data is kept for as long as the account is active.
Cloudflare / Replit logs — subject to each provider's own retention policies (see §5).

5. Data processors and third-party services

We use the following third-party processors to operate the Site. Each processor is engaged under a data processing agreement or equivalent contractual safeguards:

Replit (hosting)

The Site is hosted on Replit Autoscale. Replit processes server requests and may temporarily log IP addresses and request metadata for reliability and security. Replit is based in the United States. Personal data transferred outside the EEA is subject to Replit's standard contractual protections. See replit.com/privacy.

Cloudflare (DNS, CDN, and security)

Cloudflare provides DNS resolution, DDoS protection, and the Turnstile bot-detection widget on the contact form. Cloudflare may process IP addresses and request metadata. Cloudflare is based in the United States and operates data centres globally. See cloudflare.com/privacypolicy.

Supabase (admin authentication and database)

Supabase stores admin authentication credentials and the site's content database. Supabase is based in the United States. See supabase.com/privacy.

Resend (transactional email)

Resend is used to deliver contact form messages to our inbox. When you submit the contact form, your name, email address, and message content are transmitted to Resend for delivery. Resend does not store message content beyond the time needed for delivery. See resend.com/legal/privacy-policy.

Termly (consent management — infrastructure only)

The Site has integrated the Termly consent management infrastructure to prepare for future optional cookies. Termly is currently inactive (no analytics or advertising cookies are set). When Termly is configured and active, it will display cookie consent notices and process preferences. See termly.io privacy policy.

YouTube (embedded video)

Some recipe pages embed videos using YouTube's privacy-enhanced mode (youtube-nocookie.com). In privacy-enhanced mode, YouTube does not set cookies or track you unless you interact with the embedded player. If you play a video, YouTube may set cookies and collect data in accordance with Google's privacy policy. We will expand this section when we add a full consent flow for video embeds.

6. Future services (planned — not yet active)

We intend to add the following services in the future. They are not currently active and no data is collected through them at this time. This section is included for transparency so you know what to expect before these services go live.

Google Analytics (planned)

We plan to add Google Analytics to understand how visitors use the Site (pages viewed, session duration, referral sources). Analytics cookies will be classified as non-essential and will only be loaded after you give consent via the cookie consent manager. Google Analytics is operated by Google LLC (United States).

Google AdSense (planned)

We may in the future use Google AdSense to display advertisements. AdSense uses cookies to serve personalised or contextual ads. Personalised advertising cookies will require your explicit consent before being activated.

Affiliate programmes (planned)

We may participate in affiliate programmes (such as Amazon Associates) and include labelled affiliate links in content. Clicking an affiliate link may result in the affiliate network recognising your visit via a cookie set by their platform. Affiliate networks have their own privacy policies.

7. International data transfers

Our third-party processors (Replit, Cloudflare, Supabase, Resend) are based primarily in the United States. Personal data transferred from the EU/EEA or UK to these providers is subject to appropriate safeguards, including Standard Contractual Clauses or equivalent frameworks, as described in each provider's privacy documentation.

8. Your rights

Depending on where you are located, you may have some or all of the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — request correction of inaccurate data.
Right to erasure — request deletion of your data where there is no compelling reason to continue processing.
Right to restrict processing — request that we limit how we use your data.
Right to object — object to processing based on legitimate interests.
Right to data portability — receive your data in a structured, machine-readable format.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right not to be subject to automated decisions — we do not carry out automated decision-making with legal or similarly significant effects.

Residents of California (CCPA/CPRA), Canada (PIPEDA), and other jurisdictions with equivalent laws have analogous rights under their local law.

To exercise any right, contact us using the details in §10. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling a request.

If you are in the EU/EEA or UK and believe we have not handled your data lawfully, you have the right to lodge a complaint with your local data protection supervisory authority.

9. Cookies

We use a small number of cookies. Our Cookie Policy provides a full breakdown by category, including which cookies are strictly necessary and which are optional. You can manage your preferences via the link in the site footer (once the consent manager is fully configured) or by adjusting your browser settings.

10. Contact

For privacy enquiries, data subject requests, or any other questions about this policy, contact us:

Email: contact@easyeverydaybaking.com
Contact form: easyeverydaybaking.com/contact

11. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page reflects the date of the most recent revision. We encourage you to review this page periodically. Material changes will be noted at the top of the page.