Last updated: 21 September 2026

Privacy policy

What we keep, why, for how long, and how to delete everything.

Who is responsible for your data

The data controller is the publisher of the service (see the legal notice). For any question or to exercise your rights: contact@2prepr.com.

What we keep, and why

Your account

Email address, password (encrypted by our provider, never readable by us) or Google identifier, and the public keys of your passkeys if you create one. Legal basis: performance of the contract — without an account, there is no service.

Your restaurant

Name, logo if you upload one, email templates, products, categories, suppliers and their ordering addresses. These addresses belong to you: we do not reuse them for any other restaurant and do not share them with anyone.

Your orders

Every order sent is kept exactly as it left — recipient, products, quantities, attached Excel file. This is the heart of the service: the history must show what was true on the day it was sent, even if a product has been renamed since.

Your mailbox, if you connect it

Connecting Gmail or Outlook gives us an authorisation token, stored encrypted in our database. It is used for one thing only: sending your purchase orders from your own address. We never read your mailbox. The token is kept while at least one of your restaurants uses that connection. When you disconnect Gmail in settings, we delete the token if no other restaurant of yours still uses it and ask Google to revoke the authorisation. You can also revoke it from your Google or Microsoft account.

Data received from Google

To connect Gmail, you authorize 2Prepr to receive your verified account email address with the “openid” and “email” permissions, and to send messages with “gmail.send”. 2Prepr does not read your inbox, other messages, contacts, or attachments.

When you confirm an order, 2Prepr sends the purchase order and any attachments from the connected Gmail address to the supplier or suppliers you selected. Those recipients see the sender address and email contents. Google processes the request to provide Gmail. 2Prepr does not sell Google data, use it for advertising or to train artificial intelligence models, or include the OAuth token in the sent email.

The Gmail address and refresh token are kept while the restaurant’s connection is active. The token is encrypted before it is stored in our database and used on our server only to send orders you confirm. The short-lived access token is not stored. Disconnecting Gmail removes that restaurant’s connection; if another of your restaurants uses the same token, it remains necessary for that restaurant. Once it is no longer used, 2Prepr asks Google to revoke it. Deleting the restaurant also deletes its connection.

2Prepr’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your voice, if you dictate

Dictation sends the audio clip to our transcription provider just long enough to turn it into text. 2Prepr does not keep the recording: only the written order that results from it is kept.

Sessions and security

A session cookie, essential for the service to work, and anti-abuse counters (the number of login attempts, for example) kept for a few hours. The service also uses Cloudflare Turnstile to tell a human from a robot at sign-up, at login and when requesting a new password.

Payment

Subscriptions are collected by Stripe. We never see your card number: it never passes through our servers. We keep your subscription identifier and its status to know which plan you are entitled to.

What we do not do

• No sale or rental of data to anyone.
• No advertising, no advertising profiling.
• No advertising trackers or third-party audience measurement cookies.
• No automated decision with legal effects on you.

Who else sees this data

Only the technical providers the service needs, each for the part that concerns it:

• Supabase — Accounts, sessions, database and imported files. European Union (Paris).
• Cloudflare — Hosting, anti-robot protection (Turnstile) and access filtering. European Union, with safeguarded transfers to the United States.
• Upstash — Sessions and anti-abuse counters, kept for a few hours. European Union.
• Stripe — Subscription payments — 2Prepr never sees your card. European Union and United States, safeguarded transfers.
• Resend — Sending the service’s emails (confirmation, invitation, reminders). European Union and United States, safeguarded transfers.
• Google (Gmail API) — Sending orders from your own mailbox, if you connect it. European Union and United States, safeguarded transfers.
• Microsoft (Graph / Outlook) — Sending orders from your own mailbox, if you connect it. European Union and United States, safeguarded transfers.
• Groq — Transcription of voice dictation, when you use it. United States, safeguarded transfers.

The data is hosted in the European Union. The transfers outside the EU mentioned above rely on the European Commission’s standard contractual clauses.

How long

• Account and restaurant data: as long as your account exists.
• Order history and files: as long as your account exists — it is there for you to consult.
• Session and anti-abuse counters: a few hours.
• Invoices: kept by Stripe for the period required by accounting law.

Your rights

You can access, correct, export or have your data erased, object to its processing or ask for it to be restricted. Two ways:

• Right away, by yourself: “Supprimer mon compte” (Delete my account) in your settings erases the files, the restaurant, the history and the account. This cannot be undone.
• By email: write to contact@2prepr.com. We reply within one month at most.

If you are not satisfied with a reply, you can lodge a complaint with the Belgian Data Protection Authority (Rue de la Presse 35, 1000 Brussels — dataprotectionauthority.be).

Cookies

2Prepr only sets necessary cookies: your session, your choice of light or dark theme, and Cloudflare’s anti-robot check. No advertising or audience measurement cookies — which is why the site does not ask for your consent on the first screen: there is nothing to accept.

Changes

This page may change along with the service. The date at the top shows the latest version; any significant change will be announced to you by email.

This English version is a translation of the French policy. If the two ever differ, the French version prevails.