Privacy Policy

Last updated: 10/18/2026

This notice explains how Cocktail BarFlow (“the App”), provided by Vincenzo Caggiano, processes users' personal data under Regulation (EU) 2016/679 (GDPR).

1. Data controller

The data controller is Vincenzo Caggiano, reachable at info@cocktailbarflow.com for any request concerning personal data or the exercise of GDPR rights.

2. Data we collect

Account data: name, e-mail address, password (stored only in hashed form) and optional profile picture. Data entered by the user: managed venues, inventory and products, recipes and costs, checklists, shopping lists, consumption statistics, job posts and applications, recipes published to the public recipe book. Technical data: IP address, device and browser type, access and error logs required for security and maintenance. Usage data (only with your consent): pages visited, features used and device information collected via Google Analytics and PostHog.

3. Purposes and legal basis

We process data to: provide the App features and manage your account (performance of the contract); manage subscriptions and payments (contract and legal obligations); ensure security, abuse prevention and service continuity (legitimate interest); answer your support requests (legitimate interest); comply with tax and legal obligations. With your consent we also collect usage statistics to improve the App (consent, which you can withdraw at any time).

4. Public content

Job posts published on BarFlow Jobs and recipes you choose to publish to the Public Recipe Book are visible to anyone, even without an account, and may be indexed by search engines. Published recipes show your user name as the author. Your sale prices and costs are never made public. You can withdraw a recipe or close a job post at any time from the relevant sections of the App.

5. Third-party services

We use providers that process data on our behalf as processors: • Stripe – subscriptions and payments (full card details never reach our servers) • Resend – service emails (welcome, password reset) • Google (Gemini, Veo) via Emergent and fal.ai – AI features, without sending your personal data (see AI Transparency) • Google Analytics and PostHog – usage statistics, consent only • Open Food Facts – barcode product lookup • Hosting, database and file storage providers – storage of data and images Each provider processes data in compliance with applicable law.

6. Cookies and local storage

We use always-on technical cookies and, only with your consent, analytics cookies. No profiling or advertising cookies. Details, durations and consent management are described in the Cookie Policy, available via the "Cookie preferences" link.

7. Transfers outside the EU

Some providers (e.g. Stripe, Google, PostHog, Resend) may process data in the United States. Transfers are based on the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission (Arts. 45-46 GDPR).

8. Push notifications

If you enable them, we store a technical identifier of your device to send you notifications (e.g. low stock). You can disable them at any time in your browser or phone settings.

9. Amazon affiliate links

The Shop section contains links to Amazon products. As an Amazon Associate we earn from qualifying purchases. We do not share your data with Amazon: when you open a link, Amazon's processing follows its own privacy notice.

10. Artificial intelligence

Some features use artificial intelligence (news summaries, recipe translations, visual content). Your personal data is not sent to the models or used to train them. Details on the AI Transparency page.

11. Data retention

We keep account data and content for the duration of the relationship and afterwards for the time needed to comply with legal obligations (in particular tax and accounting ones). When the account is deleted, associated data is erased or anonymised, except where retention is required by law.

12. Security

We apply appropriate technical and organisational measures: HTTPS encrypted communications, passwords stored only as hashes, role-based access control inside each venue, data separation per workspace and regular database backups.

13. Your rights

You may exercise at any time the rights of access, rectification, erasure, restriction, objection and data portability, as well as the right to withdraw consent where given. Requests can be sent to info@cocktailbarflow.com; you also have the right to lodge a complaint with your national data protection authority.

14. Minors

The service is aimed at professionals and is not intended for children under 16. We do not knowingly collect minors' data; should we become aware of such processing, we will delete the data promptly.

15. Changes to this notice

This notice may be updated for regulatory reasons or when new features are introduced. The current version is always available on this page with its last update date; significant changes will be highlighted inside the App.

General information document, it does not constitute legal advice.