Privacy Policy
Last updated: 22 August 2026.
Who is responsible for your data
The controller of the personal data described here is Rafacst Consultoria LTDA, a company registered in Brazil under CNPJ 66.424.919/0001-10. Data protection questions can be sent to [email protected], or through the contact form. Because we are established in Brazil, both Brazilian law and, where it applies to you, the data protection law of your own country may govern how your data is handled.
The data you enter in the app
Receitório lets you record recipes, ingredients, packaging, categories, locations, costs, production, shopping, inventory, sales, deleted items and your bakery's settings. This data is used to provide the features of the app, and it stays under your control.
Account, profile and sign-in
Signing in is optional. When you use Apple or email authentication, the app may store the account identifier, your name, your email address and the sign-in provider where those are available. You can also keep a local profile without signing in at all. This data identifies your profile inside the app and unlocks paid features.
Signing in on the website
On this site, the subscribe and account pages use Firebase Authentication so you can sign in with Apple, Google, or an email address and password. When you sign in, Firebase issues an identity token that our server checks only to confirm that it is genuine. From that token we use the Firebase account identifier, which is what locates your access. The site never stores your password.
Storage and iCloud
App data can be stored locally on your device. When iCloud syncing is available and switched on for your Apple Account, the data may sync through your own private iCloud, subject to Apple's terms and policies. Receitório does not run a server of its own to hold the app's main data.
Purchases, subscriptions and unlocks
Purchases can be made in two ways. Through the App Store, purchases, subscriptions, free trials, cancellations and refunds are handled by Apple. On this site, the purchase is handled by RevenueCat (Web Billing) together with Stripe, which runs the checkout and processes the payment. In neither case does Receitório receive your full card details: those are handled by Apple or by Stripe, depending on the channel. RevenueCat receives a user identifier, based on your Firebase account identifier, along with your purchase and subscription status, which is what unlocks, restores or restricts the paid features. A purchase made on the site unlocks access in the app when you sign in with the same account.
Camera, files and the local network
The app may ask for camera access to scan receipts, QR codes and barcodes. It may ask for access to files when you import or export data. It may ask for local network access to transfer data directly between nearby devices running the same version of the app. You can manage these permissions in your device settings.
Online receipt and product lookups
When you choose to scan or look up a receipt, QR code or barcode, the app may send the receipt key, the receipt URL, the barcode or related search terms to lookup services and public or third-party databases, so that fields can be filled in for you to review. These services are operated by independent third parties, receive only the data needed for the lookup, and handle it under their own privacy policies. They may include ConsultaDANFE (consultadanfe.com), the official Brazilian state tax authority pages for NF-e and NFC-e, Open Food Facts, GTINHub, Google Shopping and Brave Search. These lookups happen only when you start them, and you can always review, edit or type the data in yourself. Receipt scanning reads Brazilian NFC-e QR codes, so it is only useful in Brazil.
App analytics and diagnostics
To understand how the app is used and decide what to improve, Receitório collects anonymous, aggregated usage events, such as which screens and actions are used, through the Aptabase service, with data processed in the European Union. These events are not used for advertising and do not track you across other apps or websites, and they do not include the contents of your recipes, costs, inventory or sales. Where a purchase transaction identifier has to accompany a diagnostic, it is put through a one-way hash before it is sent. We do not sell this data.
The website, cookies and analytics
This site may use cookies and analytics tools, including Google Tag Manager and Google Analytics, to measure visits, understand which pages get read and improve how the product is explained. Non-essential storage stays off until you allow it: the consent banner on this site sets analytics storage to denied by default, and your choice is remembered in your browser. You can reopen the banner at any time from the cookie preferences button.
The contact form and support
When you use the contact form on this site, we collect the name, email address and message you type, in order to answer your support request. That data is sent to our support message processing service. To reduce spam and abuse, the form uses Cloudflare Turnstile, which may process technical signals such as your IP address and browser information to tell people from bots.
Sharing your data
We do not sell personal data, and we do not share it for cross-context behavioural advertising. Data may be handled by the service providers the app and the site depend on: Firebase and Google (authentication), Apple (sign-in, the App Store and iCloud), RevenueCat and Stripe (purchases and subscriptions on the site), Cloudflare (site hosting and contact form protection), Google (site analytics), Aptabase (app analytics) and the lookup services described above. These providers handle the data under their own policies and for the stated purpose.
International transfers
Receitório is operated from Brazil, and several of the providers above operate in the United States and the European Union. That means your data may be processed outside the country you live in. Where the law requires a transfer mechanism, we rely on the safeguards those providers offer, including the European Commission's standard contractual clauses where they apply.
How long data is kept
Data you enter in the app stays for as long as you keep it on your device, in iCloud or in the associated backups. You can erase all of it from within the app, which removes the local data and syncs that removal if iCloud is on. Anything else can be requested through the contact form.
Your rights
Depending on where you live, you may have the right to ask for access to your personal data, its correction, its erasure, confirmation that it is being processed, restriction of processing, portability, and information about who it has been shared with. You may also object to processing, and withdraw consent at any time without affecting what was done before. If you are in the European Union or the United Kingdom, you have the right to complain to your local supervisory authority. If you are in California, you may ask what personal information we collect and request its deletion, and you will not be treated differently for exercising that right; we do not sell or share personal information as those terms are defined there. Requests can be sent through the contact form.
Legal bases for processing
Where European or United Kingdom data protection law applies, we rely on the following legal bases: performing the contract with you, for your account, your purchases and the features you use; our legitimate interest in keeping the app and the site secure and working, and in understanding which parts of them get used; your consent, for non-essential cookies and site analytics, which you can withdraw at any time; and compliance with a legal obligation, for tax and accounting records of a purchase.
Security
We take reasonable measures to protect the data Receitório handles, including using the system's own protected storage where it is available. Even so, no system is entirely immune to failure, attack or downtime. Keep your own devices and credentials protected.
Children
Receitório is not directed at children, and we do not knowingly collect personal data from them.
Changes to this policy
We may update this Privacy Policy to reflect changes in the app, on the site, in legal requirements or in how we operate. The version published on this page is the version in force.
Contact
Privacy questions can be sent through the contact form.
This Privacy Policy explains how Receitório handles personal data. The app is developed and distributed by Rafacst Consultoria LTDA, a company registered in Brazil under CNPJ 66.424.919/0001-10, which is the data controller.