MirabellePrivacy policy
Version : 2026-10-19 · Effective date :
1. Who is responsible for your data?
Mirabelle is a personal space for recipes, photos, your cellar, drinks, dinner plans and shopping lists. This policy explains how personal data is handled when you visit mirabelle.cafe or use the hosted Mirabelle service and its connected applications.
Nathan Lecoanet, France, is the data controller for Mirabelle. For questions about your data or to exercise your rights, contact contact@mirabelle.cafe.
2. The data we process
Account data includes your email address, a securely hashed password when you use password sign-in, verification and recovery records, authentication sessions and, when used, identifiers supplied by a connected sign-in provider. We do not store your password in readable form.
Your workspace contains the information you choose to save: recipes and source addresses, photos, cellar and drink notes, dinner details, shopping lists and other content. Photos and free-text fields can contain personal information; include only information needed for your use of the service.
Technical records include request and security information, connection details such as IP addresses, device or browser information, errors, resource measurements, usage counts and administrative audit events. When billing applies, we retain payment-provider references, subscription status and related transaction or contractual records. Stripe processes payment details; Mirabelle does not store complete card numbers.
3. Why we use this information
We use account and workspace data to provide the service you request, authenticate you, save and retrieve your content, perform imports and exports, and deliver requested AI features. These activities rely on performance of our contract with you, including steps you request before entering into it.
We process security, diagnostic and usage records to protect accounts, prevent abuse, manage service limits, maintain availability and investigate incidents. These activities rely on our legitimate interests in operating a secure, reliable service. We use support correspondence to respond to requests and resolve problems.
Where billing or legal duties apply, relevant records are used to administer payments, respond to lawful requests and meet applicable legal obligations. Account identifiers and authentication information are necessary to provide account access; content and optional features are your choice. Without the information a feature needs, that feature cannot work. Mirabelle does not use your data for advertising profiling or decisions with legal or similarly significant effects.
4. Providers and external services
Cloudflare provides website delivery, security and object storage; Fly.io hosts application runtimes; Neon hosts the control-plane database; and Brevo delivers service emails. Authorized operators may access relevant records for support, security and maintenance.
OpenAI processes requests for the AI features you choose to use. Brave Search provides optional recipe image searches and receives the search terms needed for the request. Stripe handles payments where applicable. Password safety checks use Have I Been Pwned: our server sends only the first five characters of a password hash, never your password or its complete hash.
Importing content from a website or opening an external image or link can contact its publisher. That service may receive connection information under its own privacy policy. External sign-in providers process authentication under their own terms. We may disclose information where required by law or necessary to establish, exercise or defend legal claims.
5. AI features and your content
When you request AI assistance, the relevant text, recipe details, bottle information or selected photograph is sent to OpenAI to produce the requested result. Avoid including sensitive personal information or information about other people that is unnecessary for the task.
We retain generated content you save and usage records needed to enforce allowances and understand service costs. OpenAI states that data sent through its API is not used to train its models by default; its own processing and retention terms also apply. AI suggestions can be inaccurate and should be reviewed before use.
6. Hosting and international processing
Mirabelle uses application hosting in Paris and European storage regions for its hosted workspaces and encrypted archives. This does not mean every service operation is limited to the European Economic Area: website delivery, email, authentication, payments, support and AI providers may process information in other countries, including the United States.
Contact contact@mirabelle.cafe to request details about the providers, destination countries and safeguards applicable to your data, including any relevant contractual transfer safeguards. Each provider also publishes information about its own processing.
7. Cookies and local storage
Cookies are used for sign-in sessions, protection against forged form submissions and your language preference. The language preference cookie lasts up to one year. Authentication and security cookies follow the expiry of the relevant session or security action. Connected applications may store session credentials locally to keep you signed in.
The public website does not embed advertising trackers or third-party audience analytics. You can clear or block cookies in your browser, but blocking essential cookies may prevent sign-in or account actions. External websites and sign-in providers have their own cookie policies.
8. How long information is kept
Workspace data is kept while your workspace exists and is needed to provide the service. You can edit or remove saved content. Canceling a subscription or suspending access does not itself delete your workspace. Account management provides export and deletion requests; the screen shows the expiry of an export download and any period during which a deletion request can be canceled.
When a workspace deletion completes, its hosted content and associated encrypted archive objects are removed by the deletion workflow. Deletion can be delayed by an active support hold, an unresolved subscription or recovery requirements. Provider snapshots and database recovery history are separate from live content and may remain until their applicable recovery retention ends.
Account identity, billing and contractual records, support correspondence, usage records and security or audit logs may remain after workspace deletion when needed for security, handling requests, resolving disputes or legal obligations. Retention depends on the purpose of the record and any applicable legal requirement; workspace deletion is not a promise that every record is erased on the same date. Contact us for an individual erasure request or details about retained records.
9. Your choices and rights
Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability of your personal data. You can object to processing based on legitimate interests, taking account of your particular situation. Where processing relies on consent, you can withdraw it without affecting processing that took place before withdrawal.
Use the data controls in account management or write to contact@mirabelle.cafe. We may request proportionate information to verify your identity. We normally respond within one month; if a permitted extension is necessary, we explain it. You may also complain to the French data protection authority, CNIL, or your competent local supervisory authority.
10. Protecting your information
Mirabelle uses encrypted connections, password hashing, authenticated access controls and encrypted archive backups. Operational access is restricted to authorized personnel for the relevant task. Keep your sign-in credentials private and contact us if you suspect unauthorized access to your account.
11. Changes to this policy
The date above identifies this version. We update this policy when the service or its handling of personal data changes and provide additional notice where required. You can contact contact@mirabelle.cafe with questions about this policy.