Privacy Policy

This Privacy Policy applies to the website areacacao.com and to all of its subdomains and associated services, both those currently in place and those incorporated in the future under the same root domain.

1. Controller

The controller of your personal data is Contenfo LLC (hereinafter, "we", "our" or "AreaCacao"), the company that develops and operates the AreaCacao service.

Address: 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, United States.

For any matter relating to the protection of your personal data, you may contact us at privacy@areacacao.com. For general inquiries about the product, you may write to us at hola@areacacao.com.

1.1. Representative in the European Union

In accordance with Art. 27 of the GDPR and Art. 13 of Regulation (EU) 2022/2065 (DSA), Contenfo LLC has designated as its representative in the European Union Data Protection Representative Limited (trading as DataRep), a company registered in Ireland under number 616588.

To exercise your data protection rights (GDPR) you may contact the representative by email at datarequest@datarep.com (stating "AreaCacao" in the subject line) or through the web form www.datarep.com/data-request. DataRep maintains contact points in all EU Member States, as well as Norway and Iceland, so that you may address a representative in your own country; the directory of postal addresses is available on request at privacy@areacacao.com. Postal correspondence must be addressed to "DataRep", not to "AreaCacao".

For matters relating to the DSA, please see the Legal Notice.

1.2. Data Protection Officer and Representative in the EU

Contenfo LLC has not designated a Data Protection Officer, as none of the circumstances set out in Art. 37 of the GDPR apply (we are not a public authority or body and our core activities do not consist of regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data). You may direct any data protection inquiry to privacy@areacacao.com.

The Representative in the European Union (Art. 27 GDPR and Art. 13 DSA) has indeed been designated: see section 1.1.

2. Data we collect

In the course of providing the service, we collect the following categories of personal data:

2.1. Registration data

When you create an account on AreaCacao we collect your name, email address and, depending on the access method, a password or an external provider identifier (for example, Google). Passwords are stored exclusively in hashed form (irreversible encryption) and never in plain text.

2.2. Billing data

If you subscribe to a paid plan, we collect the data necessary to issue an invoice: company name or name, tax address and tax identification number. Financial data (card number, bank details) are processed directly by our certified payment providers; AreaCacao does not store card numbers or complete banking credentials.

2.3. Usage data

We automatically collect technical information relating to your interaction with the service, including IP address, browser type, device identifiers, access records (logs) and general activity on the platform.

2.4. User-created content

As a registered chocolatier or business, you enter your own professional information into the service: recipes, ingredients (including custom ingredients you may add), formulations, costs, prices, suppliers, inventory, orders, technical data sheets and any other content associated with the management of your workshop. This content is processed in order to provide you with the service.

2.5. Optional files for AI import

Optionally, you may upload photographs of a recipe notebook or PDF files so that the service automatically extracts the recipe by means of artificial intelligence. These files are processed in order to generate the structured recipe associated with your account and are handled as described in section 5.

3. Purpose of the processing

Personal data are used for the following purposes:

• Provision of the service: creation and operation of the account, access to the contracted features (formulator, technical validation, cost dashboard, allergens, PDF data sheets, AI cost assistant, etc.).
• Billing and contract management: issuance of invoices, management of subscriptions, renewals and cancellations.
• Improvement of the service: aggregate usage analysis, detection and correction of technical errors and optimization of product performance.
• Communications: sending of transactional emails (registration confirmation, password changes, billing notices, system notifications and relevant service updates).
• Commercial communications: if you have given us your express consent, or where a prior commercial relationship exists that the applicable regulations allow us to rely on, sending newsletters, product news and offers. You may unsubscribe at any time from the link included in each message or by writing to hola@areacacao.com; we will action the unsubscribe within a maximum of ten (10) business days. All our commercial communications identify Contenfo LLC, include its postal address and an unsubscribe mechanism that remains operational for at least sixty (60) days after sending. Unsubscribing from these communications does not affect the transactional emails necessary to provide the service.
• Security: fraud prevention, detection of suspicious activity and protection against unauthorized access.

4. Legal basis for the processing

The processing is based on the following legal grounds, in accordance with the European Union General Data Protection Regulation (GDPR) and equivalent legislation in Latin America and the United States:

• Performance of the contract: the processing necessary to provide you with the contracted service (account creation, operation of the service, billing, support).
• Legitimate interest: certain processing operations are carried out on the basis of AreaCacao's legitimate interest, in particular aggregate usage analysis, ensuring the security of the service and the prevention of fraudulent activity.
• Consent: for optional processing operations that are not necessary for the provision of the service, such as the installation of analytics or marketing cookies or the sending of commercial communications, your prior and explicit consent is requested. You may withdraw this consent at any time without affecting the lawfulness of the prior processing.
• Compliance with legal obligations: certain processing operations are carried out in order to comply with legal obligations applicable to Contenfo LLC (for example, retention of invoices for tax purposes).

5. Use of content and service providers

5.1. Processing of user content

The content you enter into AreaCacao (recipes, ingredients, formulations, costs, uploaded files) is not used to train general-purpose artificial intelligence models, nor is it shared with third parties for that purpose. Your content is used exclusively to provide you with the contracted service: storage, processing, indexing, calculation and generation of results (data sheets, validations, costs, AI suggestions) within the isolated space associated with your account.

5.2. Categories of providers

In order to provide the service, AreaCacao works with external providers that may access certain personal data depending on their role. The categories used are the following:

• Authentication and identity: services for the management of accounts, sessions and sign-in with external providers (for example, Google Sign-In).
• Infrastructure and database: cloud hosting and data management services where the service's data reside.
• File storage: storage services for the files uploaded by users (photographs, PDFs, exports).
• Artificial intelligence: language and vision model services for the extraction of recipes from photo/PDF and the AI cost assistant.
• Payments and billing: certified payment providers that process the recurring charges and issue the receipts associated with your subscription.
• Transactional email: email delivery services for notifications, confirmations and reminders.
• Analytics and monitoring: services for the monitoring of errors and technical availability. Marketing analytics tools, if activated in the future, will require your prior consent as described in our Cookie Policy.

AreaCacao works with providers that offer contractual commitments and adequate data protection measures, and applies the appropriate legal safeguards in each case. Data are stored and processed mainly in the United States, although certain features may involve processing in other jurisdictions depending on the providers used.

You may request additional information about the categories of providers by writing to us at privacy@areacacao.com.

6. Categories of subprocessors

In order to provide the service, AreaCacao relies on external technology providers selected with GDPR safeguards (signed Data Processing Agreement + European Commission Standard Contractual Clauses or equivalent where applicable). We disclose the categories for the sake of transparency:

6.1. Named list upon request

The named list of specific subprocessors (with company name, address and signed DPAs) is available to B2B customers who require it for their own compliance or due diligence. Request it at privacy@areacacao.com; it is delivered under a Non-Disclosure Agreement (NDA) within a maximum of 5 business days.

6.2. Notification of changes

Any addition, removal or substantial change within a category will be notified 30 days in advance where it affects data processed on behalf of the customer (Sensory Analysis module) and by email to the affected customers where it affects account or billing data.

6.3. Payments: guarantee regarding card data

No AreaCacao subprocessor stores credit card data. Payment processing is carried out entirely on the platform of the PCI-DSS SAQ-A certified provider. AreaCacao never has access to the customer's card number, CVV verification code or expiry date.

7. Processing of third-party data on behalf of the customer (Sensory Analysis module)

Some of AreaCacao's professional customers use the Sensory Analysis module to carry out tastings with external panelists (tasters who evaluate chocolate samples). In that relationship:

• The customer (professional chef, workshop, school) acts as the Controller of the data of the panelists whom they themselves invite or register in their account.
• AreaCacao acts as the Processor on behalf of the customer, following their documented instructions.
• The panelist is the Data subject whose data are processed.

7.1. Panelist data that the platform may process

• Identification: name, email.
• Contact: telephone (optional).
• Demographics: age, gender, language (optional, configurable by the customer).
• Results of sensory evaluations carried out in the customer's tastings.

7.2. Legal basis applicable to the panelist

The customer MUST obtain the panelist's informed consent (GDPR Art. 6.1.a) before registering them on the platform or inviting them to a digital tasting. The customer is responsible for demonstrating such consent if required by an authority or by the panelist themselves.

7.3. Obligations of the customer as Controller

• Inform the panelist about the processing (Art. 13).
• Collect and retain proof of consent.
• Handle the panelist's requests (access, erasure, etc.) or forward them to AreaCacao for their material execution on the platform.
• Not enter data of minors under 16 years of age — or the higher age required by the legislation applicable to the panelist — without documented parental authorization.

7.4. Obligations of AreaCacao as Processor

• Process the data only in accordance with the customer's instructions.
• Apply appropriate technical and organizational measures (encryption in transit and at rest, access control, audit log).
• Not use the panelist's data for its own purposes or disclose them to third parties without instruction from the customer.
• Return or delete the data upon termination of the relationship with the customer, in accordance with the periods described in the retention section.
• Notify the customer of any security breach affecting the panelist's data within a maximum of 72 hours from its detection.

7.5. Data Processing Agreement (DPA)

By using the Sensory Analysis module, the customer accepts the terms of the Data Processing Agreement (DPA) pursuant to Art. 28 of Regulation (EU) 2016/679. Until the document is published, a copy may be requested at privacy@areacacao.com.

7.6. Authorized sub-processors

The sub-processors listed in the "Categories of subprocessors" section of this policy are also sub-processors for panelist data. Any change will be notified to the customer 30 days in advance.

8. International data transfers

Contenfo LLC is headquartered in the United States. Personal data are processed mainly in United States territory.

For users located in the European Union or the European Economic Area (EEA), international transfers are carried out in accordance with the safeguards of the GDPR, using one or more of the following mechanisms depending on the provider:

• EU-U.S. Data Privacy Framework: where the provider is certified under the DPF.
• Standard Contractual Clauses (SCCs): approved by the European Commission, incorporated into the agreements with providers where applicable.

For users in Latin America, transfers are governed by the equivalent mechanisms provided for in local legislation (LGPD in Brazil, Ley 1581 in Colombia, LFPDPPP in Mexico, Ley 19.628 in Chile, LPDP in Argentina, among others).

9. Data retention

We retain your data for the time strictly necessary to fulfill the purposes described. Applicable periods:

• Account data and content: retained for as long as your account remains active. Following a deletion request, the data associated with your account will be erased within a maximum of 30 days, unless there is a legal retention obligation.
• Billing data: retained for the period required by the tax and commercial legislation applicable to Contenfo LLC, regardless of the status of the account.
• Verification of consent to automatic renewal: retained for three (3) years or for one (1) year after the contract ends, whichever period is longer, as required by US automatic renewal legislation. This retention is maintained even if deletion of the rest of the account data is requested.
• Verification of consent to commercial communications: retained for as long as the consent remains valid and for the three (3) years following its withdrawal, in order to be able to evidence it.
• Technical records (logs): retained for a maximum period of 90 days and automatically deleted once that period has elapsed.
• Files moved to the trash: permanently deleted 30 days after being sent to the trash.

10. Your rights

Regardless of the jurisdiction in which you are located, you have the following rights in relation to your personal data:

• Access: to obtain confirmation as to whether we are processing your data and, where applicable, to access it.
• Rectification: to request the correction of inaccurate or incomplete personal data.
• Erasure ("right to be forgotten"): to request the deletion of your data when it is no longer necessary for the purpose for which it was collected.
• Restriction of processing: to request the restriction of the processing in the cases provided for by the regulations.
• Portability: to receive your data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
• Objection: to object to processing based on legitimate interest.
• Not to be subject to automated decisions: where they produce significant legal effects. AreaCacao does not carry out automated profiling with legal effects on users.
• Withdrawal of consent: at any time, in processing based on consent, without this affecting the lawfulness of the prior processing.

10.1. European Union / EEA users (GDPR)

In addition to the rights above, you may lodge a complaint with the competent data protection supervisory authority of your country. In Spain, the authority is the Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency).

10.2. Latin American users

The same rights apply under the local data protection laws of each country, among others: LGPD (Brazil), LFPDPPP (Mexico), Ley 1581 (Colombia), Ley 19.628 (Chile), LPDP (Argentina). You may address your request either to us or to the competent authority of your jurisdiction.

10.3. United States users

If you reside in a US state with a comprehensive privacy law applicable to this processing, you have, on the terms and with the exceptions that law provides, the following rights: to know which categories of personal data we process, their source, the purpose and the categories of recipients; to access them and obtain a copy in a portable format; to request their correction; to request their deletion; to opt out of the sale or sharing of personal data, of targeted advertising and of profiling with legal or similarly significant effects; to limit the use of sensitive personal data; and not to be treated in a discriminatory way for exercising any of them.

We do not sell personal data and we do not share it for cross-context behavioral advertising, nor do we process minors' personal data for those purposes.

Universal opt-out signals. We recognize the Global Privacy Control (GPC) signal sent by certain browsers and privacy extensions. When we detect it, we treat it as a valid request to opt out of the sale and sharing of personal data and of targeted advertising for that browser or device, without you having to take any further action.

Authorized agents. You may designate a third party to exercise these rights on your behalf. We will ask for proof of the authorization and may ask you to confirm your identity and the authorization directly.

Timeframes. We will respond to your request within a maximum of thirty (30) days, shorter than most of these laws require, extendable by a further thirty (30) days where the request is particularly complex, subject to prior notice.

Appealing a denial. If we deny your request in whole or in part, we will explain the reasons in writing and how to appeal that decision. To appeal, reply to the denial email or write to privacy@areacacao.com with "Appeal" in the subject line. We will decide the appeal and give you a written, reasoned decision within a maximum of forty-five (45) days. If we maintain the denial, we will tell you how to submit a complaint to your state's Attorney General.

California. If you reside in California, the rights above are granted to you by the California Consumer Privacy Act (CCPA), as amended by the CPRA. As we are a business that operates exclusively online and with which you have a direct relationship, the designated channel to exercise them is privacy@areacacao.com.

10.4. Canadian users

We process your data in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, equivalent provincial legislation.

Processing outside Canada. Your personal data is stored and processed mainly in the United States and, depending on the provider, in the European Union. Because it is located outside Canada, it is subject to the law of the country where it is processed and may be accessible to the public authorities of that country under its legal system. We require our providers to apply contractual and technical protection measures comparable to those we apply ourselves.

Commercial messages. We will not send you commercial electronic messages without your express consent or without relying on valid implied consent under Canada's anti-spam legislation (CASL). All our messages identify Contenfo LLC, include its postal address and an unsubscribe mechanism that remains operational for at least sixty (60) days after sending.

Complaints. You may lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) and, if you reside in Quebec, with the Commission d'accès à l'information (CAI).

10.5. United Kingdom users

If you are located in the United Kingdom, your data is processed in accordance with the UK GDPR and the Data Protection Act 2018, and you have the same rights listed at the beginning of this section.

In accordance with Article 27 of the UK GDPR, Contenfo LLC is in the process of appointing a representative in the United Kingdom. Their contact details will be published in this section as soon as the appointment is formalized. In the meantime, you may address any request concerning your data to privacy@areacacao.com, stating that you are resident in the United Kingdom; it will be handled within the same time limits as any other request.

You may lodge a complaint with the Information Commissioner's Office (ICO).

10.6. How to exercise your rights

To exercise any of these rights, write to us at privacy@areacacao.com clearly stating the right you wish to exercise, enclosing, where applicable, a copy of a document evidencing your identity. We undertake to respond within a maximum period of 30 days from receipt of your request. If the request is particularly complex, the period may be extended by a further 30 days, subject to prior notification.

11. Security

We implement technical and organizational measures designed to protect your data against unauthorized access, loss, alteration or disclosure. These include:

• Encrypted communications: all communications between your browser and our servers take place over the HTTPS (TLS) protocol.
• Encryption of credentials and secrets: API keys, tokens and sensitive credentials are encrypted at rest using recognized industry standards.
• Per-account data isolation: each account operates with database-level isolation, preventing unauthorized access to data of other accounts.
• Access control: access restricted to authorized personnel following the principle of least privilege.
• Internal security reviews: we carry out periodic internal reviews aimed at identifying and correcting possible vulnerabilities and at maintaining adequate technical and organizational controls.

12. Notification of security incidents

In the event of a security breach that affects your personal data and entails a risk to your rights, AreaCacao will notify the competent supervisory authorities within the legally established period (72 hours under the GDPR, equivalent periods in other jurisdictions) and, where such risk is high, will notify the affected users directly without undue delay, indicating the nature of the breach, the likely consequences and the measures adopted or proposed in order to remedy it and mitigate its possible adverse effects.

13. Cookies and similar technologies

We use cookies and local storage technologies for the operation of the service. We do not load any non-essential cookie before the user has given their explicit consent.

For detailed information about the cookies used, their purposes and how to manage your preferences, please see our Cookie Policy.

14. Minimum age

AreaCacao is intended for persons of legal age with sufficient legal capacity to contract and manage the service, or for authorized representatives of an organization. By creating an account, you represent and warrant that you are at least 18 years old or that you are acting on behalf of an organization with capacity to accept these terms.

The eighteen (18) year requirement reflects legal capacity to enter into contracts. Independently of it, we do not deliberately collect personal data from minors under sixteen (16) years of age — the age of digital consent under Regulation (EU) 2016/679 — or from children under thirteen (13), the threshold applicable in the United States under the Children's Online Privacy Protection Act (COPPA). If we become aware that a minor has provided personal data without the consent of their legal representative, we will delete it as soon as possible. You may notify us at privacy@areacacao.com.

15. Sign in with Google

If you choose to sign in with Google, we receive the following data from Google: your email address, name, profile picture and a unique identifier (sub ID). This data is used exclusively for authentication and identification within the service. It is not shared with third parties for marketing purposes, nor is it resold. You may revoke access at any time from your Google account settings.

16. Contact

If you have any question, concern or request relating to this Privacy Policy or to the processing of your personal data, you may contact us:

• Data protection and exercise of rights: privacy@areacacao.com
• General inquiries about the product: hola@areacacao.com

17. Modifications

We reserve the right to modify this Privacy Policy at any time. In the event of substantial changes, we will notify you through the service or by email. The date of the last update is indicated at the beginning of this document.

18. Change history

• August 4, 2026 (2nd revision): new rights section for United States users, with the procedure for appealing a denial and recognition of the Global Privacy Control signal. New section for Canadian users, including the notice of processing outside the country. New section for United Kingdom users. Introduction of the commercial communications purpose and its legal basis. Retention periods for consent records. Harmonization of the age thresholds. No pre-existing purpose, legal basis or right has been reduced.
• August 4, 2026:publication of the English version of this document. Both versions have been checked clause by clause and say the same thing; the version of the language in which the service was contracted governs and, in the event of a discrepancy, the reading more favorable to the user prevails. No substantive changes with respect to the Spanish version.
• May 30, 2026: publication of the details of the Representative in the European Union (DataRep, Irish company no. 616588) with its contact channels for the GDPR; separate clarification in a new section 1.2 on the non-designation of a Data Protection Officer (Art. 37 GDPR) and the designation of an EU Representative; removal of the legacy paragraph that mixed both roles in the International data transfers section.
• May 28, 2026: comprehensive update prior to launch. Incorporation of the scope of subdomains and associated services; Representative in the European Union block (Art. 27 GDPR); Categories of subprocessors section with a table by country and transfer mechanism, named list under NDA and PCI-DSS guarantee regarding card data; section on the processing of third-party data on behalf of the customer (Sensory Analysis module); Notification of security incidents section (Art. 33-34). Internal renumbering of the document.
• April 16, 2026: initial publication.

Related documents: Terms of Service · Cookie Policy