Effective from: 27.10.2026
1. Introduction
Welcome to Yumsto.
Yumsto s.r.o., company no. 09685065, registered office: Příčná 1892/4, Nové Město, 110 00 Prague
1, registered in the Commercial Register kept by the Municipal Court in Prague under file no. C
386735 ("the Company", "we", "us" or "our") operates www.yumsto.com and the Yumsto mobile app
(together "the Services").
This Privacy Policy explains what data we process about you, why we process it, on what legal
basis, who we pass it to, and what rights you have. It covers both visits to www.yumsto.com and
use of the Yumsto mobile app.
Every processing activity described below rests on one of the legal bases in Article 6 GDPR —
performance of a contract, compliance with a legal obligation, our legitimate interest, or your
consent. Where consent is needed we ask for it up front and you can withdraw it at any time; we do
not treat merely using the site as consent.
Use of the Services is governed by our Terms and Conditions ("the Terms"). This Privacy Policy is
not part of the contract; it is there to inform you. Unless stated otherwise here, terms used in
this Privacy Policy have the same meaning as in the Terms.
This Privacy Policy is also published in Czech. If the two versions differ, the Czech version
prevails.
2. Types of data we collect
Personal data
While using our Service we may ask you to give us certain personal data that can be used to
contact or identify you ("Personal Data"). It may include, but is not limited to:
2.1. Email address
2.2. Full name and surname
2.3. Phone number
2.4. Address, country, region, postcode, town
2.5. Cookies and usage data
2.6. Username
2.7. Billing details (company no. and VAT no. for businesses)
2.8. Delivery address and contact details for the courier
2.9. Order and payment history
We send newsletters and offers when you sign up and confirm with the link in our email. When you
buy from us, we also send you baking tips and offers on similar products from our shop now and
then, without a separate sign-up. You can refuse this when you order by ticking "I don't want tips
and offers by email". You can unsubscribe at any time using the link in every email or by writing
to support@yumsto.com.
Usage data
We may collect information that your browser sends whenever you visit our Services, from or
through any device ("Usage Data").
This Usage Data may include information such as your computer's internet protocol address (e.g. IP
address), browser type and version, the page of our Service that you visit, the time and date of
your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
If you use the Services on a mobile device, this Usage Data may include information such as the
type of device, its unique ID, IP address and operating system, the type of internet browser,
identifiers and other diagnostic data.
Cookies
Cookies are small files that a website stores on your device. Browser localStorage and
sessionStorage work in a similar way — in this policy we refer to all of them together as
cookies.
Necessary cookies do not need your consent — the law exempts them, because without them the
service you are asking us for would not work. Any personal data processed through them is
processed on the basis of our legitimate interest in running and securing the site, and for
purchases on the basis of performing the contract. Everything else is stored only with your
consent. Until you decide, we store nothing on your device other than necessary cookies. Consent
is voluntary and the site works without it — we only know less about you.
In the mobile app we keep the same data in the app's own storage instead of cookies. The token
that renews your sign-in is kept in storage only the app can access (on an iPhone, in the
Keychain).
How you give and withdraw consent
On your first visit a bar appears at the bottom of the page. "Accept all" gives consent to
analytics and marketing cookies, "Reject all" refuses them, and "Customize" lets you switch on
only the ones you want. Refusing is as easy as accepting, and the site works for you either
way.
You can change your choice or withdraw consent at any time under the "Cookie settings" link — on a
computer it sits at the bottom of the left-hand menu, on a phone under Menu, and under Profile
when you are signed in — or with the "Change cookie settings" button at the top of this page.
Withdrawing consent is as easy as giving it, and once you withdraw it we delete the affected
cookies straight away. We remember your consent for 12 months, then we ask again.
Browser settings do not replace consent: you give and withdraw it only in the cookie settings on
our site. If you delete cookies in your browser, we will ask you again. If you block them, signing
in and the basket may not work.
We do not act on the browser "Do Not Track" signal. Your choice in cookie settings is what
governs.
Necessary cookies
The site would not work without them, so they cannot be switched off and we do not ask for consent to them.
| Name | What it is for | Lifetime | Who stores it, and where |
|---|---|---|---|
yumsto_consent |
Remembers your choice in cookie settings. | 12 months | us, cookie |
yumsto_anon_session |
Holds your basket, an order in progress and your recipe ratings until you sign in. Created on your first visit. | 14 days from your last visit | us, cookie on api.yumsto.com |
yumsto_at, yumsto_it |
Only once you sign in: they tell the site it is you. | 400 days, or until you sign out | us, cookie |
yumsto_rt |
Only once you sign in: renews your sign-in so you do not have to enter a code again. | 400 days, or until you sign out | us, cookie |
yumsto.auth.pending-sign-in-email,
yumsto.auth.pending-sign-in-session
|
Hold a sign-in in progress until you enter the code from the email. | until you close the tab | us, sessionStorage |
yumsto.auth.handed-off-code |
Passes the code from the email link to the tab where you are signing in. | until that tab picks it up | us, localStorage |
PARAGLIDE_LOCALE |
The language we show the site in. | 400 days | us, cookie |
yumsto-guest-shopping-list |
Your shopping list until you sign in. Once you sign in, we move it to your account. | until you sign in | us, localStorage |
searchHistory |
Your last 25 searches, so you have them to hand. They stay on your device only. | until you clear them in your browser | us, localStorage |
sveltekit:scroll, sveltekit:snapshot |
Return you to where you were on the page when you go back. | until you close the tab | us, sessionStorage |
yumsto:checkout-draft:v1:* |
Keep checkout details you have typed but not saved yet, so they survive a page reload. We delete them as soon as you save the step or finish your order. | until you save the step, at most until you close the tab | us, sessionStorage |
Analytics cookies
We store these only with your consent. We measure which recipes and pages help people and where things snag, and we tune the content and recommendations from that. We process the data ourselves, we do not pass it to advertising networks, and we do not connect it with your behaviour on other sites.
| Name | What it is for | Lifetime | Who stores it, and where |
|---|---|---|---|
yumsto_device_id |
An anonymous device identifier. It recognises a repeat visit and lets us recommend recipes you care about. | 12 months | us, cookie and localStorage |
yumsto_analytics_session_id |
Separates individual visits. | until you close the tab | us, sessionStorage |
yumsto_analytics_acquisition |
Remembers where your first visit came from (a search engine, social network, newsletter) and the campaign label from the address. It stores no other part of the address. | while your consent lasts, 12 months at most | us, localStorage |
Without consent to analytics cookies we measure only anonymous visit counts for individual pages,
we cannot recognise a repeat visit, and we do not tailor recommendations to you.
Marketing cookies
We store these only with your consent. They would let us measure whether advertising outside
Yumsto pays off, and show you offers that fit.
We are not using any marketing cookies yet. If that changes, we will add them to
this policy and ask you again.
Payments and card fraud protection
Payments are processed for us by Stripe Payments Europe, Ltd. We load the Stripe.js script only once you add goods to your basket (from a recipe, an article or an offer), or open the basket, a product page or the checkout. Until you do one of those, we do not load Stripe.js. The script is necessary for us to accept payment securely without your card details reaching our site, and for Stripe to detect card misuse. Besides the cookies in the table, Stripe also collects browser and device characteristics.
| Name | What it is for | Lifetime | Who stores it, and where |
|---|---|---|---|
__stripe_mid |
Recognises the device to protect against fraudulent payments. | 12 months | Stripe, cookie on our domain |
__stripe_sid |
The same, within a single visit. | 30 minutes | Stripe, cookie on our domain |
m |
Recognises the device to protect against fraudulent payments. | 400 days | Stripe, cookie on the m.stripe.com domain (third party) |
We store these cookies as necessary for the payment you have expressly asked us for. On pages
where Stripe.js is loaded, Stripe may also use hCaptcha protection. You will find the details in
Stripe's privacy policy.
When you pay by bank transfer, the statement for our account at Raiffeisenbank shows us your name,
the account number the payment came from and the payment details — amount, variable symbol and
message for the recipient. We use them to match the payment to your order and, if money needs to
go back, to refund it to the same account.
Error and speed tracking
To find out about errors and slow spots on the site we use Sentry (Functional Software, Inc.),
which stores the data in the EU. It stores nothing on your device. When an error happens, we send
it a technical description of the error, the page address, and your browser and operating system
type — not your IP address or the contents of your cookies. Each time the site loads we also send
it a short note on whether the load went without an error, and on some visits how fast the page
loaded, together with basic details of your device's performance and connection (for example its
memory size and connection type). The legal basis is our legitimate interest in a working, fast
and secure site.
3. Why and for how long we process data
Each processing activity has its purpose, its legal basis under Article 6 GDPR and the time we keep the data, after which we delete or anonymise it. Without the data an order needs we cannot sell to you; everything else you provide voluntarily.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Order processing, payment and delivery | name, e-mail, phone, addresses, company and its identification numbers, order contents; for a bank transfer also the payer's name, account number and payment details | contract (Art. 6(1)(b) GDPR) | while the order is processed, then see the rows below |
| Invoices and accounting | billing data, order contents, our bank account statements | legal obligation (c) — accounting law, VAT law and the Tax Code | 10 years from the end of the year the invoice was issued or the payment received |
| Complaints, withdrawal and legal claims | order data, our correspondence | legitimate interest in defending claims (f) | 3 years after the complaint or withdrawal is resolved |
| Account and sign-in | e-mail, username | contract | until the account is closed |
| Public profile and authors’ recipes | name or nickname, bio, links, photo, recipes | contract | as long as you keep them in the Services |
| “How did it turn out” ratings | your answer and a pseudonymous session or account identifier | legitimate interest in showing how recipes work in practice | while the recipe exists |
| Weekly newsletter and news by e-mail | consent (a) | until you unsubscribe; the record of consent and unsubscribing for 3 more years | |
| Tips and offers for customers | legitimate interest (f) and Section 7(3) of Czech Act No. 480/2004 Coll.; you can refuse when you order and in every email | until you unsubscribe; the record of the order, refusal and unsubscribing for 3 more years | |
| Customer support | e-mail, message contents | contract, legitimate interest | 3 years after resolution |
| Errors and site security | technical data (see Error and performance monitoring) | legitimate interest in a working, secure website | 90 days |
| Analytics | see Analytics cookies | consent | on your device as listed in the cookie tables; visit records on our servers are deleted after 3 years, and we keep only anonymised daily totals that can't identify anyone |
4. Data retention
How long we keep data is listed for each purpose in the table above. Data we only need briefly we
delete sooner.
5. Transfers outside the EU
We process your data in the European Union. Some of our suppliers (Cloudflare, Stripe, Sentry,
Amazon) are owned by US companies, though. If your data leaves the European Economic Area, it is
protected by the EU–US Data Privacy Framework or by standard contractual clauses approved by the
European Commission.
6. Disclosure of data
We share your data only with the recipients listed in article 9 and:
6.1. with public authorities where the law requires it;
6.2. with a buyer if our business or part of it is sold or merged — under the same rules this
Policy describes;
6.3. with anyone else only with your consent.
7. Data security
The security of your data matters to us, but remember that no method of transmission over the
internet and no method of electronic storage is 100% secure. While we strive to use commercially
acceptable means to protect your personal data, we cannot guarantee its absolute security.
8. Your data protection rights under the General Data Protection Regulation (GDPR)
If you are a resident of the European Union (EU) or the European Economic Area (EEA), you have
certain data protection rights covered by the GDPR.
We aim to take reasonable steps to let you correct, amend, delete or limit the use of your
Personal Data.
If you want to know what personal data we hold about you, or you want it removed from our systems,
write to us at support@yumsto.com.
In certain circumstances you have the following data protection rights:
8.1. the right to access, update or delete the information we hold about you;
8.2. the right to rectification. You have the right to have your data corrected if it is
inaccurate or incomplete;
8.3. the right to object. You have the right to object to our processing of your Personal Data;
8.4. the right to restriction. You have the right to ask us to restrict the processing of your
personal data;
8.5. the right to data portability. You have the right to receive a copy of your Personal Data in
a structured, machine-readable and commonly used format;
8.6. the right to withdraw consent. You also have the right to withdraw your consent at any time
where we rely on consent to process your personal data;
Please note that we may ask you to verify your identity before responding to such requests, and
that without certain necessary data we may not be able to provide the service.
Right to object. You can object at any time to processing based on our legitimate
interest; we then stop unless we show compelling grounds that override yours. You can object to
marketing messages at any time without giving a reason, and we will stop sending them.
You have the right to lodge a complaint about our collection and use of your personal data with
the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů). Your local data
protection authority in the European Economic Area (EEA) can give you more information.
9. Recipients of personal data (subprocessors)
To run the site, the app and the online store, and to deliver goods, we use third-party services.
We pass those parties only the data strictly necessary to provide the particular service:
1. Payments (Stripe):
We use Stripe, operated by Stripe Payments Europe, Ltd. and other Stripe group companies, to
process online payments. Card details are not processed by us but directly by Stripe. You will
find Stripe's privacy policy here: https://stripe.com/privacy.
2. Bank transfers (Raiffeisenbank):
Our bank account and its statements are kept by Raiffeisenbank a.s., company no. 49240901. When
you pay us by transfer, your bank passes it your name, account number and the payment details, and
we then see them in our account statement. When we refund you, we give it the account number to
send the money to.
3. Delivery (Zásilkovna, PPL):
To deliver goods we pass your name, surname, delivery address, phone and email to the carrier you
chose in the basket — Zásilkovna s.r.o. (Packeta), company no. 28408306, or PPL CZ s.r.o., company
no. 25194798 — so they can let you know about the delivery and hand the parcel over.
4. Accounting and tax services:
Your billing details may be processed by an external accounting firm in order to meet our
statutory tax obligations.
5. Hosting and infrastructure (Amazon Web Services):
Our servers, databases, sign-in and email sending run on Amazon Web Services (Amazon Web Services
EMEA SARL) in its Frankfurt data centre. Your browser loads the pickup-point map in the checkout
directly from Amazon Location Service, so AWS sees your IP address.
6. Site delivery and protection (Cloudflare):
Our site, www.yumsto.com, is delivered through the Cloudflare network (Cloudflare, Inc.), which
serves it quickly and protects it from attacks. In doing so Cloudflare processes your IP address
and technical details of your requests, such as your browser type.
7. Error tracking (Sentry):
We track site errors and speed in Sentry (Functional Software, Inc.), which stores the data in the
EU. What we send it is described above under Error and speed tracking.
10. Analytics
We measure traffic and use of our Services with our own tools on our own infrastructure. For every
visit we also note the country you are connecting from. Cloudflare works it out from your IP
address, but we do not store the IP address itself. We do not pass analytics data to advertising
networks and we do not connect it with your behaviour on other sites. You will find the details
and retention periods above under Analytics cookies.
11. Automated decision-making
We make no automated decisions about you and build no profile with legal or similarly significant
effects. Recipe recommendations based on your visits (only with consent to analytics cookies) have
no such effects.
12. Advertising and remarketing
We do not run advertising or remarketing yet. We do not show third-party adverts
in our Services, we do not use remarketing or advertising cookies, and we do not pass data about
your visits to advertising networks.
If that changes, we will describe it in this Privacy Policy, add the relevant cookies to the list
above, and ask you for consent in advance.
13. Links to other sites
Our Services may contain links to other sites that we do not operate. If you click a third-party
link, you will be taken to that third party's site. We strongly encourage you to read the privacy
policy of every site you visit.
We have no control over, and take no responsibility for, the content, privacy policies or
practices of any third-party sites or services.
14. Children's privacy
Our Services are not intended for use by children under 15 ("a Child" or "Children").
We do not knowingly collect personal data from children under 15. If you find that a child has
given us personal data, please contact us. If we find that we have collected personal data from a
child without their legal guardian's consent, we will take steps to remove that information from
our servers.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will let you know about changes by
publishing the new version on this page and updating the effective date at the top.
If a change affects something you gave us consent for, we will ask you again before it takes
effect. We recommend checking this Privacy Policy from time to time. Changes take effect when they
are published on this page.
16. Contact us
If you have any questions about this Privacy Policy, write to us at support@yumsto.com.