fermentLabPrivacy policy
Last updated: November 1, 2026
This policy explains how popLand processes the personal data of people who visit and use fermentLab, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
The data controller is popLand, via Turati 19 - Firenze , 06844720489. For any request about your data, write to info@fermentlab.app.
No Data Protection Officer (DPO) has been appointed, as it is not mandatory for this processing.
2. What data we process
| Category | Data |
|---|---|
| Account | Email address, password (stored only in hashed form, we cannot read it), display name, username, profile picture, preferred language and units, date you accepted the Terms and this policy, and your consent to receive news, if given. |
| Content you enter | Fermentations in your logbook (title, description, ingredients, amounts, measurements, notes, tastings, dates), photos, ingredients you suggest, recipes you choose to share, recipes you save to favorites. |
| Messages you send us | Name, email, subject and text of messages sent with the contact form and, if you are signed in, the link to your account. |
| Security and operation | Number of failed sign-in attempts and temporary lockouts, one-time tokens for email verification and password recovery (stored in hashed form), technical logs of our provider's servers (for example IP address and user agent) for security and diagnostics. |
| Cookies and similar technologies | See section 7. |
We do not ask for special categories of data (such as health data). Please do not enter them in descriptions and notes.
3. Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, providing the fermentation logbook, recipes and other features | Performance of a contract (Art. 6(1)(b) GDPR) |
| Sending service emails: address verification, password recovery, security alerts | Performance of a contract (Art. 6(1)(b)) |
| Showing other users, or anyone, the recipes you choose to share | Performance of a contract and your explicit choice when sharing |
| Answering the messages you send us with the contact form | Legitimate interest of the controller in answering your requests (Art. 6(1)(f)) and, for requests about the service, performance of a contract (Art. 6(1)(b)) |
| Protecting the service: preventing unauthorized access, fraud and unlawful use | Legitimate interest of the controller (Art. 6(1)(f)) |
| Complying with legal obligations and answering requests from authorities | Legal obligation (Art. 6(1)(c)) |
| Sending you news and tips by email | Consent (Art. 6(1)(a)), optional and revocable at any time |
| Measuring, in aggregate form, how the site is used (statistics), with Google Tag Manager and Google Analytics | Consent (Art. 6(1)(a)), given with the “Statistics” category in the banner and revocable at any time |
If you do not provide the data needed for your account we cannot offer you the service. Consent to news is voluntary: you can decline or withdraw it with no effect on your use of fermentLab.
We do not sell your data and we do not use it for automated decision-making or profiling.
4. How long we keep it
- Account data and your content are kept while your account is active.
- You can delete your account at any time from your profile page: your profile, fermentations, photos and saved recipes are deleted right away, except data we must keep by law or to defend a right. For the recipes you shared, you choose: you can delete them or leave them in the community anonymously, without your name. Fermentations that other users already created from those recipes remain with those users. Backup copies are overwritten within 30 days.
- Tokens for email verification and password recovery expire within a few hours and are useless after use.
- Technical logs are kept for as long as needed for security and diagnostics, generally no more than a few months.
- Contact form messages are kept for as long as needed to handle the request, and in any case no longer than 24 months.
- Consent to news is kept until you withdraw it.
- Backups hold the data for a limited period, then they are overwritten.
5. Who we share data with
Your data is processed by providers acting as data processors (Art. 28 GDPR) under our instructions:
- Amazon Web Services: application hosting (AWS Amplify), image storage and delivery (Amazon S3 and CloudFront) and service emails (Amazon SES).
- Aiven: managed PostgreSQL database where accounts and content are stored.
- Google (Google Ireland Limited): Google Tag Manager and Google Analytics, for site usage statistics (see section 7).
Other recipients are public authorities, when the law requires it. Other users only see what you choose to share: a “community only” recipe is visible to registered, verified users, a “public” recipe to anyone and may be found by search engines. In both cases your display name appears next to the recipe. Logbook notes and photos are not shared unless you choose to include some notes.
6. Transfers outside the European Economic Area
Some providers belong to groups based outside the EU (for example in the United States). When data may be transferred outside the EEA, the transfer relies on a European Commission adequacy decision (for example the Data Privacy Framework) or on standard contractual clauses (Art. 46 GDPR), with supplementary measures where required. You can ask for a copy of the safeguards by writing to info@fermentlab.app.
8. Your rights
At any time you can ask us to access your data, correct it, delete it, restrict its processing or receive it in a commonly used format (portability); you can object to processing based on legitimate interest and withdraw your consent, without affecting processing already carried out (Articles 15-22 GDPR).
To exercise your rights write to info@fermentlab.app: we normally reply within one month. You can edit some profile information directly from the profile page.
If you believe the processing violates the law you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority in your country.
9. Security
We adopt reasonable technical and organizational measures: encrypted connections (HTTPS), passwords stored with hashing algorithms, limits on sign-in attempts, access to data restricted to those who need it. No system is 100% secure: we recommend a long, unique password.
10. Minors
fermentLab is not intended for people under 16. If you think a minor has given us data, write to us and we will delete it.
11. Changes to this policy
We may update this policy, for example for new features or legal changes. The date at the top shows the last revision; for important changes we will notify you in the application or by email.