Last updated: March 11, 2026
1. Introduction
At GridMast, developers of Bake Balance, we are committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information.
Privacy commitment: Your data is confidential and will never be sold, rented, or shared with third parties for commercial purposes without your explicit consent.
2. Legal Framework
This policy complies with:
- Law No. 29733 - Personal Data Protection Law (Peru)
- GDPR - General Data Protection Regulation (European Union)
- CCPA - California Consumer Privacy Act (for U.S. users)
3. Information We Collect
3.1 Information Provided Directly
| Data Type |
Purpose |
Legal Basis |
| Email |
Identification, authentication, communication |
Consent / Contract execution |
| Password (encrypted) |
Account security |
Contract execution |
| Business name |
Service personalization |
Consent |
| Phone number (optional) |
Technical support, account recovery |
Consent |
| Ingredients and recipes data |
Core service functionality |
Contract execution |
3.2 Automatically Collected Information
- Device Fingerprint: Unique device identifier (for license control)
- Browser information: Type, version, preferred language
- Operating system: Platform and version
- Screen resolution: For interface optimization
- IP address: For security and fraud prevention
- Time zone: For date/time functionalities
- Access date and time: For security auditing
3.3 Cookies and Similar Technologies
We use the following technologies:
- Session cookies: Essential for maintaining your active session
- LocalStorage: For language preferences and settings
- SessionStorage: For temporary data during your visit
Important note: We do not use third-party cookies for advertising or tracking. All our cookies are strictly functional.
4. How We Use Your Information
4.1 Primary Purposes
- Authentication: Verify your identity and protect your account
- Service provision: Provide all Bake Balance functionalities
- Communication: Send important service notifications
- Technical support: Respond to your inquiries and resolve issues
- Security: Detect and prevent fraudulent activities
- Service improvement: Analyze usage to optimize functionalities
4.2 Marketing (Only with Consent)
Only if you explicitly opt in, we may:
- Send news about new features
- Inform about special promotions
- Share educational content about bakery management
You can unsubscribe at any time by clicking the unsubscribe link in any email.
5. Legal Basis for Processing (GDPR)
We process your personal data under the following legal bases:
- Consent: When you expressly accept processing
- Contract execution: To provide the service you requested
- Legal obligation: To comply with tax and commercial laws
- Legitimate interest: To improve our service and prevent fraud
6. Sharing Information with Third Parties
6.1 Service Providers
We share minimum necessary data with:
| Provider |
Service |
Shared Data |
| Supabase (PostgreSQL) |
Database and authentication |
Email, encrypted password, application data |
| Netlify |
Application hosting |
Access information (IP, browser) |
| Hotmart / Gumroad |
Payment processing |
Email, billing information |
6.2 We Never Share With:
- ❌ Advertising companies
- ❌ Third-party marketing agencies
- ❌ Data brokers
- ❌ Social networks (unless you expressly authorize it)
6.3 Legal Obligations
We may disclose your information if required by law, court order, or to:
- Comply with legal processes
- Protect our rights and property
- Prevent fraud or illegal activities
- Protect the safety of users or the public
7. Data Security
7.1 Technical Measures
- SSL/TLS encryption: All communications are encrypted
- Password hashing: Passwords are never stored in plain text
- Two-factor authentication: Available for enhanced security (coming soon)
- Firewalls: Protection against unauthorized access
- Continuous monitoring: Detection of suspicious activities
7.2 Organizational Measures
- Limited data access only for authorized personnel
- Regular security audits
- Ongoing data protection training
- Incident response procedures
Breach notification: In the event of a security breach affecting your data, we will notify you within 72 hours in compliance with GDPR and Peruvian law.
8. Data Retention
We retain your personal data while:
- Your account remains active
- It is necessary to provide the service
- Required by law (minimum 5 years for tax data)
8.1 Data Deletion
When you request account deletion:
- Immediate: Access and session data
- 30 days: Personal and application data
- 5 years: Transaction records (legal obligation)
9. Your Rights
You have the following rights regarding your personal data:
✓ Right of Access
You can request a copy of all data we have about you.
✓ Right of Rectification
You can correct inaccurate data from your profile or by requesting correction from us.
✓ Right of Erasure ("Right to be Forgotten")
You can request complete deletion of your data at any time.
✓ Right of Portability
You can request to export your data in JSON or CSV format.
✓ Right to Restriction of Processing
You can request that we temporarily stop processing your data.
✓ Right to Object
You can object to the processing of your data for direct marketing.
✓ Right Not to be Subject to Automated Decisions
We do not use automated decision-making or profiling.
How to Exercise Your Rights
To exercise any of these rights:
- Send an email to: [email protected]
- Include your full name and registered email
- Specify the right you wish to exercise
We will respond within a maximum of 30 days.
10. International Transfers
Your data may be transferred and stored on servers located outside your country of residence:
- Supabase: Servers in the United States (Privacy Shield certified)
- Netlify: Servers in the United States and Europe
All transfers comply with appropriate safeguards according to GDPR and local laws.
11. Children's Privacy
Bake Balance is not directed to minors under 18 years of age. We do not knowingly collect information from minors.
If we discover that we have collected data from a minor without parental consent verification, we will delete that information immediately.
12. Changes to this Policy
We may update this Privacy Policy occasionally. Significant changes will be notified through:
- Prominent notice in the application
- Email to your registered address
- Update of the "Last updated" date above
We recommend reviewing this policy periodically.
13. Cookies and Preferences
You can manage cookie preferences from your browser settings:
- Chrome: Settings > Privacy and security > Cookies
- Firefox: Options > Privacy and security
- Safari: Preferences > Privacy
- Edge: Settings > Privacy and services
Warning: Blocking essential cookies may affect service functionality.
14. Supervisory Authority
If you have a complaint about how we handle your data, you can contact:
Peru:
National Authority for the Protection of Personal Data (ANPDP)
Ministry of Justice and Human Rights
Web: www.minjus.gob.pe
European Union (GDPR):
Your local data protection authority
Complete list: edpb.europa.eu
15. Contact - Data Protection Officer
For any privacy or data protection inquiries:
Response time: We commit to responding to all privacy inquiries within 5 business days.