Privacy Policy

Cakeap is a web and iOS app that helps cake makers and bakeries manage orders, customers, planning, recipes, inventory, shopping lists and teams. This policy explains what information Cakeap handles when you use the website at cakeap.com and the Cakeap app, and how it is used.

• Account: your email address and password (passwords are stored only in hashed form by our authentication provider), and optionally your name.
• Profile and settings: business name, currency, measurement system, language, appearance and costing preferences.
• Businesses and teams: business details you add, team members you invite (by email) and the roles you assign them.
• Orders and tasks: order details, dates and times, prices, descriptions, notes, delivery or pickup details and addresses, and order status.
• Customers: names, phone numbers, email addresses, birthdays, notes and other details you choose to record.
• Photos: cake photos, order photos, task photos and images of paper orders or receipts you upload or scan.
• Recipes, inventory, products, tools and shopping lists you create, including suppliers and prices.

Cakeap users may enter information about their own customers, staff or other people. If you do so, you are responsible for having an appropriate lawful basis and any permissions needed to collect and process that information, and for informing those people where the law requires it.

Our hosting and backend providers record standard technical information when the service is used, such as IP address, browser or device type, request times and error logs. This is used to run, secure and troubleshoot the service. Cakeap does not use advertising trackers.

The app stores a small amount of information on your device (browser local storage) to keep you signed in and remember preferences such as theme, language, sound settings and your selected workspace.

When you choose to use AI features — such as scanning a paper order, scanning a receipt, importing a recipe or other assistant features — the image or text you submit is sent to an AI model to extract or generate information. These requests are routed through the Lovable AI Gateway to Google Gemini models. AI processing happens only when you start one of these features. AI output can be inaccurate, so please review extracted details before saving. The handling of submitted content by these providers is governed by their own terms and privacy policies.

• To create and secure your account and let you sign in.
• To provide the app's features: orders, planner, customers, recipes, inventory, shopping lists, reports and teams.
• To share business data with team members you have authorised.
• To provide AI features you request.
• To show delivery addresses on a map (addresses you look up are sent to OpenStreetMap's Nominatim service to find their location).
• To send account emails such as sign-up confirmation and password reset.
• To maintain security, prevent abuse, fix problems and respond to support requests.

• Lovable / Lovable Cloud: website hosting, authentication, database, file storage for photos and account emails.
• Google (Gemini models via the Lovable AI Gateway): AI scanning and assistant features.
• OpenStreetMap Nominatim: converting addresses into map locations.
• Apple: distribution of the iOS app through the App Store / TestFlight.

Cakeap does not currently process payments or subscriptions.

Your data is stored in a managed cloud database. Access is restricted by database rules so that you can only see your own data and data from businesses you have been given access to. Photos are kept in private storage and shown through short-lived links. Connections are encrypted in transit (HTTPS). No system is perfectly secure, but we take reasonable measures to protect your information.

We keep your information while your account is active. You can delete individual records and photos within the app at any time. To delete your account and its associated data, contact us using the details on our Support page.

We do not sell your information. We share information with the service providers listed above to run Cakeap, with team members you authorise to access a business, and where required by law or to protect the rights and safety of users and the service.

Our service providers may process information in countries other than your own, including outside the European Economic Area. Where this happens, transfers rely on the safeguards those providers offer under applicable law.

Depending on where you live, including under the GDPR, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive a copy of it, and to complain to your local data protection authority. Much of your data can be viewed, edited and deleted directly in the app. For other requests, contact us via the Support page.

Cakeap does not use advertising or third-party analytics cookies. It uses device storage only for sign-in and preferences, as described in section 4.

Cakeap is a business tool intended for adults running or working in cake businesses. It is not directed at children, and we do not knowingly collect children's personal information through accounts. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. When we do, we will update the effective date at the top of this page and, for significant changes, notify users in the app or by email.

For privacy questions or requests, please use the contact details on our Support page.