Privacy Policy
Last updated: 10/18/2026
This notice explains how Cocktail BarFlow (“the App”), provided by Vincenzo Caggiano, processes users' personal data under Regulation (EU) 2016/679 (GDPR).
1. Data controller
The data controller is Vincenzo Caggiano, reachable at info@cocktailbarflow.com for any request concerning personal data or the exercise of GDPR rights.
2. Data we collect
Account data: name, e-mail address, password (stored only in hashed form) and optional profile picture. Data entered by the user: managed venues, inventory and products, recipes and costs, checklists, shopping lists, consumption statistics, job posts and applications, recipes published to the public recipe book. Technical data: IP address, device and browser type, access and error logs required for security and maintenance. Usage data (only with your consent): pages visited, features used and device information collected via Google Analytics and PostHog.
3. Purposes and legal basis
We process data to: provide the App features and manage your account (performance of the contract); manage subscriptions and payments (contract and legal obligations); ensure security, abuse prevention and service continuity (legitimate interest); answer your support requests (legitimate interest); comply with tax and legal obligations. With your consent we also collect usage statistics to improve the App (consent, which you can withdraw at any time).
4. Public content
Job posts published on BarFlow Jobs and recipes you choose to publish to the Public Recipe Book are visible to anyone, even without an account, and may be indexed by search engines. Published recipes show your user name as the author. Your sale prices and costs are never made public. You can withdraw a recipe or close a job post at any time from the relevant sections of the App.
5. Third-party services
We use providers that process data on our behalf as processors: • Stripe – subscriptions and payments (full card details never reach our servers) • Resend – service emails (welcome, password reset) • Google (Gemini, Veo) via Emergent and fal.ai – AI features, without sending your personal data (see AI Transparency) • Google Analytics and PostHog – usage statistics, consent only • Open Food Facts – barcode product lookup • Hosting, database and file storage providers – storage of data and images Each provider processes data in compliance with applicable law.
6. Cookies and local storage
We use always-on technical cookies and, only with your consent, analytics cookies. No profiling or advertising cookies. Details, durations and consent management are described in the Cookie Policy, available via the "Cookie preferences" link.
7. Transfers outside the EU
Some providers (e.g. Stripe, Google, PostHog, Resend) may process data in the United States. Transfers are based on the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission (Arts. 45-46 GDPR).
8. Push notifications
If you enable them, we store a technical identifier of your device to send you notifications (e.g. low stock). You can disable them at any time in your browser or phone settings.
9. Amazon affiliate links
The Shop section contains links to Amazon products. As an Amazon Associate we earn from qualifying purchases. We do not share your data with Amazon: when you open a link, Amazon's processing follows its own privacy notice.
10. Artificial intelligence
Some features use artificial intelligence (news summaries, recipe translations, visual content). Your personal data is not sent to the models or used to train them. Details on the AI Transparency page.
11. Data retention
We keep account data and content for the duration of the relationship and afterwards for the time needed to comply with legal obligations (in particular tax and accounting ones). When the account is deleted, associated data is erased or anonymised, except where retention is required by law.
12. Security
We apply appropriate technical and organisational measures: HTTPS encrypted communications, passwords stored only as hashes, role-based access control inside each venue, data separation per workspace and regular database backups.
13. Your rights
You may exercise at any time the rights of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw consent where given. Requests can be sent to info@cocktailbarflow.com; you also have the right to lodge a complaint with your national data protection authority.
14. Minors
The service is aimed at professionals and is not intended for children under 16. We do not knowingly collect minors' data; should we become aware of such processing, we will delete the data promptly.
15. Changes to this notice
This notice may be updated for regulatory reasons or when new features are introduced. The current version is always available on this page with its last update date; significant changes will be highlighted inside the App.
General information document, it does not constitute legal advice.