Privacy Policy
The recipe website and the cookbooks
Last updated: 10 September 2026
Before you read on
This policy is about the recipe website at sofiayuzu.com and the cookbooks sold on it. That is all it covers.
The app is different and has its own policy. If you use the health and food tracker at sofiayuzu.com/app, or the same app from the App Store or Google Play, read the app privacy policy instead. It is written for the app and it is complete on its own — you do not need this page to understand it.
Two things that have always been true here are still true:
- You do not need an account to read recipes. We do not ask you to make one and there is nothing to sign up for.
- We store almost nothing about readers. Most people who read this site leave no record with us at all.
We do not sell your data, we do not use it for advertising, and there are no advertising trackers on these pages.
1. Who is responsible
The person responsible for this website and for the cookbooks is:
Sofiia Serhiivna Hetman (Гетьман Софія Сергіївна)
Sole trader (фізична особа-підприємець), registered in Ukraine
Unified State Register record number: 2011600000000112030
Address: Microdistrict 2, building 46, Lozova, Kharkiv region, 64606, Ukraine
Email: admin@sofiayuzu.com
Phone: +380 93 118 22 96
How to reach us.
Phone: +380 93 118 22 96 — the line takes messages and points you to email.
Email: admin@sofiayuzu.com — the fast way to reach us; we answer in writing.
An AI assistant reads that mailbox first and answers routine things — cancelling a web subscription, questions about how the app works — and it says so at the start of every conversation. A person reads everything else, and every request about your data goes to a person. Please do not send us lab results or other health documents by email: put them in the app. If one arrives, we delete the message.
You can write to us in English, German, Spanish, French, Polish, Portuguese, Russian or Ukrainian. Our full business details are also on the legal notice page.
2. What we collect if you only read recipes
You do not sign in, so we do not have a name, an email address or an account for you. What still happens when a page loads:
Your cookie choice. A banner asks what you allow, in three groups — Necessary, Analytics and Marketing. Your answer is saved in your browser's own storage and never leaves your device — we cannot see it and it is not sent to us. The cookie policy explains it in full.
Hosting and security. The site runs on Cloudflare. To serve a page and to block attacks, Cloudflare processes your IP address, the page you asked for, your browser and operating system, and the time of the request. We do not use these logs to work out who anyone is, and we do not keep a copy of our own.
Fonts. Our typefaces are served from our own domain. Nothing is sent to Google when you load a page.
Embedded cooking videos. Recipe pages show a still image where a video sits. Nothing is sent to Google until you click it. When you click, YouTube loads and may set its own cookies — clicking is your consent for that page. The ingredients, the method and the whole recipe are on the page and work without the video.
If you write to us. We get your email address and whatever you put in the message. We use it to answer you and for nothing else.
That is the whole list for a reader. No account, no profile, no advertising pixels, no data sold to anyone.
3. Analytics
— this section describes a banner and an analytics setup that must be live before the page goes up.
Google Analytics 4. We use Google Analytics to count visits and see which recipes people read. It only loads if you switch Analytics on in the cookie banner. If you do not, the script is never loaded and nothing is sent to Google Analytics.
When it is switched on, Google receives your IP address, the pages you look at, roughly where you are, your device and browser, and a random identifier stored in a cookie so that several page views can be counted as one visit. Google says it does not store the IP address in Analytics; it is used to work out your approximate location and then discarded. We look only at totals — how many people read a recipe — never at individuals. Nothing is used for advertising and Google Signals is off. Data is deleted after 14 months. Google Ireland Limited acts as our processor for this. The cookies it sets are listed in the cookie policy.
4. Marketing and advertising
There are no advertising or social media pixels on this site, and we do not build profiles for advertising. If that ever changes, this page and the cookie policy will say so first, and nothing will load unless you switch Marketing on.
5. If you buy a cookbook
The cookbooks are PDF files. Checkout is run by Paddle.com Market Limited, which sells them to you as the merchant of record: you buy from Paddle, and Paddle handles the payment, the tax and the invoice.
We never see or store your card details. Your card number, expiry date and security code go to Paddle and stay with Paddle. We could not see them if we wanted to.
What reaches us after a purchase:
- your email address, so we can deliver the file and answer you if something goes wrong;
- which cookbook or bundle you bought;
- your billing country (Paddle needs it for tax, and we see it on the order);
- the order reference.
We use this to deliver the file, to answer support questions, and to keep the accounting records the law requires. We do not use it for advertising, and we do not add you to a mailing list because you bought something.
Paddle also decides some things for itself — fraud checks, tax and invoicing — and is its own controller for those. See Paddle's privacy policy.
You must be at least 16 to buy. See section 13.
What you get, when, and what happens if you change your mind is in the terms and the refund policy.
6. If you ask for the free recipes by email
If you enter your email address to get the free sample recipes, we use it to send you those recipes and, if you ticked the box, occasional emails about new recipes and cookbooks. The sending is done by Brevo (Sendinblue SAS, France) on our behalf.
Every email has an unsubscribe link, and unsubscribing takes effect immediately. You can also write to admin@sofiayuzu.com and ask us to remove you. We keep your address until you unsubscribe, and delete it within 30 days after that.
7. Why we are allowed to do this
| What | Why we may do it |
|---|---|
| Serving pages, keeping the site up, blocking attacks (Cloudflare logs) | Our legitimate interest in running a working, secure website |
| Storing your cookie choice in your browser | Necessary to do what you asked — it is how we stop asking you again |
| Loading video embeds after you click them | Your action of clicking play |
| Analytics | Your consent, given in the banner, and withdrawable at any time |
| Marketing emails | Your consent, withdrawable at any time |
| Selling and delivering a cookbook | Performing the contract you entered into |
| Keeping order and tax records | A legal obligation |
| Answering your email | Our legitimate interest in replying to people who write to us |
Where we rely on a legitimate interest, you can object — see section 10.
8. How long we keep things
| What | How long |
|---|---|
| Your cookie choice | In your browser until you clear it or change it. It is not stored on our side at all. |
| Cloudflare hosting and security logs | 7 days — kept by Cloudflare, deleted automatically. We do not keep our own copy. |
| Order records (email, product, billing country, order reference) | For as long as the tax rules require us to keep accounting records: at least 3 years. Paddle keeps its own copy under its own policy. |
| Emails you send us | Up to 24 months, then deleted. |
| Analytics data | Deleted by Google after 14 months. |
| Newsletter address | Until you unsubscribe, then deleted within 30 days. |
9. Who else sees your data
Only these companies, each for one job:
- Cloudflare, Inc. — hosting, delivering pages, and blocking attacks. It processes your IP address and request details.
- Google (Google Ireland Limited / Google LLC) — the YouTube embeds on recipe pages, after you click one. Google acts as its own controller for that. Google also runs Analytics for us as our processor, if you switched Analytics on.
- Paddle.com Market Limited (United Kingdom) — the merchant of record for cookbook sales: payment, tax, invoice, fraud checks.
- Brevo (Sendinblue SAS, France) — sending the emails we send you.
Nobody else. We do not sell your data, we do not share it with advertising networks, and we do not give it to anyone else unless a law or a court makes us.
Where your data goes. We are in Ukraine. These companies are in the EU, the UK and the United States, so data about you leaves the country you are in. For the transfers to the United States we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), incorporated into each provider's data processing agreement, and, for data covered by UK law, the same clauses with the UK International Data Transfer Addendum. The United Kingdom has an adequacy decision, so no extra instrument is needed for Paddle. What Ukrainian law adds to this is in section 12. You can ask us for a copy at admin@sofiayuzu.com.
10. Your rights
You can:
- ask what we hold about you and get a copy;
- have mistakes corrected;
- have data deleted;
- ask us to pause using it while a dispute is sorted out;
- object to anything we do on the basis of a legitimate interest;
- take your data with you in a machine-readable file, where it applies;
- withdraw consent at any time — for analytics in the cookie banner, for emails through the unsubscribe link. Withdrawing does not undo what was lawful before you withdrew.
Write to admin@sofiayuzu.com. It is free.
How long we take. We usually answer within a week. Billing disputes and anything complex can take up to two weeks. Requests about your personal data are answered within one month (45 days if you are making a request under Washington State law), and any refund we owe you is paid within 14 days of your notice. If a request about your data is unusually complicated we may take up to two more months, and we will tell you inside the first month if that happens.
One honest limitation: for someone who only reads recipes we usually hold nothing that identifies you, so there may be nothing to find. If we cannot connect any data to you, we will say so rather than ask you for identity documents we do not need.
11. Complaining
If you think we have handled your data badly, tell us first — admin@sofiayuzu.com — and we will try to fix it.
You can also complain to a supervisory authority: in the EU, the data protection authority of the country you live in; in the UK, the Information Commissioner's Office (ico.org.uk); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua). You do not have to talk to us first, and you can go to court instead.
12. If you are in Ukraine
This section adds to the rest of this policy and does not replace it. Where this section and the rest of the policy say different things, this section is the one that applies to you.
Who is responsible. ФОП Sofiia Serhiivna Hetman (Гетьман Софія Сергіївна), record in the Unified State Register of Ukraine (ЄДР) 2011600000000112030, Microdistrict 2, building 46, Lozova, Kharkiv region, 64606, Ukraine, admin@sofiayuzu.com, +380 93 118 22 96. We are a sole trader registered in Ukraine, which means Ukrainian data protection law applies to everything we do with your data — and, in fact, to everything we do with anyone's data.
Why we are allowed to hold it. This site holds very little. There are no accounts, and reading recipes leaves no record with us. If you buy a cookbook, we process your order data in order to perform the contract with you, and we keep the accounting records the tax law requires. Analytics and the recipe emails run on your consent — given in the cookie banner or when you signed up — and you can withdraw it at any time. We do not collect health data on this website; the app is a separate product with its own policy.
Your data leaves Ukraine. Our providers are in the European Union (Brevo), the United Kingdom (Paddle) and the United States (Cloudflare and, if you switched Analytics on, Google). Ukrainian law treats the European Union and the United Kingdom as giving an adequate level of protection — the United Kingdom because it is a party to Council of Europe Convention 108. The United States is not on that list. For the American companies we rely on two things together: your consent, for everything that is optional here — nothing goes to Google until you switch Analytics on — and the Standard Contractual Clauses written into each provider's data processing agreement, as the guarantees we give as the controller.
We would rather say the rest of it plainly than bury it: once your data is in the United States, Ukrainian law does not travel with it, authorities there may be able to require access to it under their own rules, and the rights this policy gives you may be harder to enforce there than at home.
Your rights, and how fast we answer. You can ask us to show you what we hold about you, correct it, stop using it, delete it, and withdraw any consent you gave. It is free. Write to admin@sofiayuzu.com. We answer within one month, and never later than the deadline Ukrainian law sets — 30 calendar days.
Where to complain. Tell us first if you can — most things are a misunderstanding we can fix the same week. You do not have to, and you can go straight to the Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини), ombudsman.gov.ua, or to a court where you live.
Language. If you open our site from Ukraine, the Ukrainian version loads by default, and it is never shorter or less detailed than any other version. If you write to us in Ukrainian, we answer in Ukrainian.
Where we do not sell. We do not offer the app or the cookbooks in Russia, Belarus, Kazakhstan or Uzbekistan, we do not direct our services at those countries, and we do not accept sign-ups or orders from there.
13. Children
You must be at least 16 to buy a cookbook. Reading recipes needs no account and no age check.
We do not knowingly collect data from anyone under 16. You confirm your age at checkout; we do not ask for documents and we do not keep a date of birth for a cookbook order. If we learn that a buyer was under 16, we cancel the order and refund it in full. If you are a parent and think your child has sent us data, write to admin@sofiayuzu.com and we will delete it.
14. Security
The whole site is served over HTTPS, and Cloudflare sits in front of it filtering attacks and abusive traffic. Cookbook files are delivered over a link that tells browsers and proxies not to keep a cached copy. We never hold card details. Access to the mailbox and to the order records is limited to Sofia and one technical person who maintains the service, both under an obligation of confidentiality, both with two-factor authentication on every account involved.
No website is perfectly safe, and we will not claim otherwise. If something happens that puts your data at real risk, we will tell the supervisory authority within 72 hours and tell you directly when the law requires it.
15. Changes to this policy
If we change this page we update the date at the top. If a change matters — a new recipient, a new purpose, anything that affects your rights — we will say so clearly on the page rather than quietly editing a line.
16. Languages
The English text of this page is the one we write and update first.
Where we have published a version in another language, that version is the one that applies to you and you can rely on it. If it differs from the English one, the meaning that is more favourable to you applies. Anything that was more favourable to you in an older translation still applies to what you did while that translation was the published one — we do not get to improve our position by being slow to translate. Once the Ukrainian version is published, it applies to users in Ukraine as Ukrainian law requires.
Today this text is published in English. The German, Spanish, French, Polish, Portuguese and Russian pages still show the previous version of this policy and are being updated to this one within days; until then, where they differ, this English text is the more recent one. The Ukrainian version is being prepared. If you spot a difference between two versions, write to admin@sofiayuzu.com and we will fix whatever is wrong.
17. Contact
admin@sofiayuzu.com — for questions about this page, for any of the rights in section 10, and for anything else about your data. +380 93 118 22 96 — the line takes messages and points you to email.
Related pages: cookie policy · terms · refund policy · legal notice · about Sofia · app privacy policy.