Privacy Policy

Last updated: October 28, 2026

Recipe Kit is an app made by Bolle Digital Inc. ("Recipe Kit", "we", "us"). It lets merchants create recipes and show them on their Shopify or BigCommerce stores, on other websites, and on recipe sites we host for them. Sections 2A to 2C, 4 and the Shopify parts of section 7 are about Recipe Kit on Shopify. Section 2D covers BigCommerce, other websites and hosted recipe sites. This policy explains what personal information the app collects, why, who we share it with, and how long we keep it.

1. Our role

Merchant data. For information about you as a store owner, we are the controller. We decide how it is used to provide the app.
Your customers' data. For information about your store's visitors and customers ("readers"), you are the controller and we are the processor. We process it only on your instructions and only to provide the app's features.

2. Information we collect

A. From merchants

Store details: store domain, store name, Shopify plan, store email address, and billing country, city and street address.
Contacts: any contact email you give us, and the names and email addresses of team members you add.
Your content: recipes, images, files and settings you create in the app.
App usage: how you use the Recipe Kit admin, such as pages viewed and features used.

B. Shopify permissions

We always ask for these permissions:

Products (read): to link your products to recipe ingredients.
Content (read and write): to create and update the blog posts and pages that show your recipes.
Themes (read and write): to find your active theme and add the recipe card to it.

We ask for these only when you turn on a feature that needs them:

Customer events and pixels: for the Recipe Analytics pixel.
Metaobjects: to store recipes in your Shopify store.
Languages and translations: to show translated recipes.
Customers (write): for the email capture gate (see section 4).

C. From readers (Shopify)

1. Recipe ratings. When a reader rates a recipe, we store the star rating and the reader's IP address. We use the IP address only to stop repeat ratings.

2. Recipe stats (on by default). The recipe card records views, prints, add-to-cart clicks and similar actions. For each action we store the recipe, the action, the referring website's domain, the device type and the country. We work out the country from the IP address as the request arrives, but we do not store the IP address. The card sends these events only when Shopify's customer privacy settings allow analytics.

3. Recipe Analytics pixel (off by default). If you turn on the pixel, a Shopify web pixel also records:

the full browser user agent, the referring page and the landing page;
campaign tags (UTM) and ad click IDs in the page address;
a random session ID and the reader's device type and country;
for completed orders: the order number, checkout token, products bought from a recipe, order total and Shopify customer ID.

The pixel never collects a reader's name, email address, phone number or postal address. It keeps a session ID and first-visit details in the browser's local storage for up to 30 days, so it can link an order to the recipe that led to it.

4. Recipe search. If your store uses Recipe Kit's recipe search, we store the search terms and the page language.

5. Reader preferences. The recipe card saves the reader's unit choice and checked-off ingredients and steps in their own browser. This information does not leave the browser.

6. Email capture gate. See section 4.

D. BigCommerce, other websites and hosted recipe sites

From merchants. Your name, email address and password (stored only as a hash), your site's address and name, and any contact email you give us. For BigCommerce stores, also the BigCommerce user ID and email address of each staff member who opens the app. For your sign-in sessions we keep the IP address and browser. If you pay by card, Stripe handles the card; we keep only Stripe's customer and subscription IDs. For hosted recipe sites, we also keep the public social posts we imported your recipes from.

BigCommerce permissions.

Content (read and write): to read your blog posts, publish recipe posts, create your Recipes page, and add the Recipe Kit script to your storefront.
Products (read): to link products to recipe ingredients and show their price and stock on the card.
Store information (read): your store's name, address and currency, to show prices correctly.
Channel settings (read): to find the storefronts where the script should run.

From readers.

Recipe ratings: the star rating and a one-way, salted hash of the reader's IP address, used only to stop repeat ratings. We do not store the IP address.
Recipe stats: for views, prints, add-to-cart clicks and similar actions, we store the recipe, the action, the page address without its query string, the referring website's domain, the device type and the country. We work out the country from the request and do not store the IP address or browser details. On BigCommerce, the card sends these only when the store's cookie consent allows analytics, or when the store has no consent banner. On other websites, the merchant is responsible for any consent their visitors' laws require.
Email signups: when a merchant turns on the email form and a reader signs up, we store the email address, the consent wording they agreed to, the page and recipe, and a hash of their IP address. We keep these for the merchant until the merchant deletes them or their site. When a reader unsubscribes, we mark them as unsubscribed. We never email readers ourselves.
Shopping: on BigCommerce, Add to cart goes straight from the reader's browser to the store's own cart. We do not see or store cart contents.
Reader preferences: the card saves the reader's unit choice, checked-off ingredients and steps, and whether they already signed up, in their own browser. This information does not leave the browser.

3. How we use information

To provide the app: show recipes, link products, and save your settings.
To show you analytics: report how your recipes perform and which orders they led to.
To support you: answer questions and fix problems.
To contact you: send account, onboarding and product emails to merchants. We never email readers.
To improve the app: understand which features merchants use.
To meet the law: comply with legal obligations.

We do not sell personal information. We do not use readers' information for our own marketing, and we do not make automated decisions about readers.

4. Email capture gate

Merchants on the Growth plan and up can turn on an email capture gate. It asks readers for their email address before showing a recipe's directions.

When a reader submits their address, Recipe Kit sends it to the merchant's Shopify store. It creates or updates a Shopify customer there with email marketing consent and the tags "recipekit" and "recipe-optin". If the customer already exists and has subscribed or is confirming a subscription, we leave their consent as it is.

Recipe Kit does not store the email address. It keeps a signup record instead: the Shopify customer ID, the recipe the reader signed up on, and the date. The merchant uses these records to see how many readers signed up on each recipe and to export them. An export reads each address and its marketing status from the merchant's Shopify store at the time, so a reader who has unsubscribed shows as unsubscribed, and a customer the merchant has deleted is left out.

For ten minutes after a submission we keep a one-way keyed hash of the address, so a double click doesn't create two requests. Each signup also adds an event to the merchant's recipe analytics, recording the page and browser type but not the address. Recipe Kit does not add readers to any list of its own, send them email, or share their data with anyone except the merchant.

The merchant is the controller of this data and Recipe Kit is the processor. Readers who want to unsubscribe, see their data or have it deleted should contact the store. Merchants can remove the customer in Shopify at any time.

5. Service providers

We share data only with providers that help us run the app. Each one gets only the data it needs.

Shopify: the platform the app runs on.
Render: hosting, database and cache for Recipe Kit on Shopify (United States).
Railway: hosting, database and cache for BigCommerce, other websites and hosted recipe sites (United States).
BigCommerce: the platform BigCommerce stores run on.
Stripe: card payments outside Shopify. It receives your account email and account ID.
Instacart: on hosted recipe sites, when a reader chooses to shop the ingredients, it receives the recipe title and ingredients.
treg.to: reads the public social posts we import recipes from for hosted recipe sites.
Cloudflare: network delivery and security.
Backblaze B2 and BunnyCDN: storage and delivery of recipe images and files.
OpenAI: AI features such as recipe import. It receives the recipe text, pages, photos or files you give it, and public product details. It receives no reader data.
Spoonacular: nutrition facts. It receives ingredient lists.
Bento: email to merchants. It receives your store email, store name, country, plan and app activity. App activity includes orders the Recipe Analytics pixel links to a recipe, which can carry the buyer's Shopify customer ID but never their name or contact details.
Postmark: internal notifications to our support team.
Help Scout: support chat and email.
PostHog: product analytics for the Recipe Kit admin, including session recordings with form inputs masked. It receives no reader data, including readers' email addresses. For BigCommerce, other websites and hosted recipe sites, it receives error reports and app usage events only, with no session recordings.

Analytics we use

We use analytics to understand how merchants use Recipe Kit and how visitors use our website, so we can fix problems and make both better. We never sell this data or use it for advertising.

In the Recipe Kit app (merchants):

PostHog: on Shopify, page views, the features you use and session recordings of the Recipe Kit admin. Every form field is masked in recordings. On BigCommerce, other websites and hosted recipe sites, error reports and feature-use events linked to your account ID, with no recordings.
Bento: on Shopify, the admin notes which plans and features you look at, so the emails we send you are relevant.
Help Scout: the help button in the app. It loads our support chat and help articles.
Mantle: install and subscription reporting for Recipe Kit on Shopify. It receives your store domain, plan and billing history from Shopify.

On recipekit.com (visitors):

Umami: counts page views and clicks. It runs on our own server and sets no cookies.
PostHog: page views, clicks and errors, to see how the site is used. It stores an ID in your browser to recognise repeat visits.
Shopify: our website runs on Shopify, which sets its own cookies and collects visit statistics as its privacy policy describes.
Help Scout: loads only when you open help.
Sign-up forms: when you join our newsletter or a waiting list, we keep your email address, the website you give us and the form you used, and add you to our email list in Bento. You can unsubscribe from any email.

On your storefront (readers): the recipe card's own statistics are described in sections 2C and 2D. They go only to your Recipe Kit account.

6. How we protect data

Data is encrypted in transit (HTTPS/TLS) and at rest (AES-256, including backups). Access to production systems is limited to the people who run Recipe Kit and requires two-factor authentication.

7. Data retention and deletion

Shopify:

While the app is installed: we keep your data so the app works.
When you uninstall: we stop accessing your store and delete our access token. We keep your recipes and settings, so they come back if you reinstall.
48 hours after uninstall: Shopify asks us to erase your store data. We then delete your email addresses, billing address, team contacts, tokens and API keys. We remove IP addresses from ratings, and session IDs, user agents and referring pages from analytics. We keep your recipes, store name and domain, and anonymous statistics.
Full deletion: email help@recipekit.com to have your recipes and all remaining data deleted.
Reader signup records: we delete them when the merchant deletes the recipe, when a reader asks the store to erase their data and Shopify passes the request to us, and 48 hours after the merchant uninstalls Recipe Kit. If the merchant deletes the customer in Shopify, the next export removes their records. Deleted records can stay in our encrypted backups until those backups expire. We never store reader email addresses (see section 4).

BigCommerce, other websites and hosted recipe sites:

When you uninstall from BigCommerce: we delete our access token and remove the Recipe Kit script from your storefront. We keep your recipes, settings, team, stats and email signups, so they come back if you install again.
When a staff member loses access: we stop their access and keep their record, so your store's history stays complete.
When you delete your account in the app: we cancel your subscription and delete your sites, recipes, stats and email signups.
Full deletion: email help@recipekit.com to have everything deleted, including your login.

8. Data processing terms

By installing Recipe Kit, merchants agree that Recipe Kit processes their customers' personal data only on the merchant's instructions and only to provide the app's features. Recipe Kit keeps it confidential, protects it as described above, and deletes it as described in this policy. It helps merchants respond to customer requests and tells them without undue delay about any breach affecting their data.

If you are in the European Economic Area or the UK, you can ask to access, correct, delete or export your personal information, or object to how we use it.

Merchants: email us to use these rights.
Readers: contact the store. We act on the store's instructions. If a reader contacts us directly, we pass the request to the store.

International transfers: we store data in the United States and work from Canada. We rely on adequacy decisions or standard contractual clauses to protect data sent outside Europe.

10. California privacy rights (CCPA/CPRA)

Right to know: you can ask what personal information we collected about you in the last 12 months.
Right to delete: you can ask us to delete your personal information.
Right to opt out: Recipe Kit does not sell or share personal information.
Non-discrimination: we will not treat you differently for using these rights.

Do Not Track: we do not change our practices when a browser sends a Do Not Track signal. The recipe card does follow Shopify's customer privacy settings.

11. Changes to this policy

We may update this policy when our practices or the law change. We post every update on this page with a new "Last updated" date.

12. Contact us

Questions, requests or complaints:

Email: help@recipekit.com
Mail: Bolle Digital Inc., 1965 W 4th Ave, Vancouver, BC V6J 1M8, Canada