Privacy Policy
Last updated 25 October 2026.
Zest Delicious Software LLC (“RecipeYield,” “we,” “us,” “our”) operates recipeyield.io and provides a WordPress plugin that lets readers pay to read a publisher’s recipe without ads. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit this site, when a publisher installs the plugin, and when a reader purchases ad-free access to a recipe. We are registered in the State of Delaware, United States, and we comply with the privacy laws that apply to us, including the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and other United States state privacy laws.
Contact
Zest Delicious Software LLC · 8 The Green Ste A, Dover, DE 19901, USA. Privacy: privacy@recipeyield.io. Legal: legal@recipeyield.io. General: hello@recipeyield.io.
Information we collect
- Publishers. Contact details (name, email, phone), site URL, Stripe Connect account identifiers, license keys, ad-network credentials (stored encrypted at rest), and the contents of onboarding and weekly report emails.
- Readers. Email address (used to send a one-time passcode and receipts, and to let you restore ad-free access on another device), an optional public display name for the reader listing, the recipe URL purchased, payment identifiers from Stripe, and a reader identifier derived from the email.
- Usage and logs. API request logs (IP address, user agent, route, status) with one-time passcodes, JWTs, and card data redacted. We do not store one-time passcodes in plaintext.
- Ad metrics. Page-level RPM and impression data received from Raptive, Mediavine, AdSense, or a CSV the publisher sends, used only to price offers.
- This site. Standard HTTPS request logs via Amazon CloudFront and S3. We do not set a first-party analytics cookie on recipeyield.io.
How we use information
- To operate the service: deliver OTP and receipt email, verify ad-free access on the publisher’s site, and restore access on a new device.
- To provide support, process refunds and chargebacks, and respond to inquiries.
- To price offers so an ad-free price always beats the ads it replaces.
- To send publishers onboarding and weekly revenue reports.
- To protect the security and integrity of the service and to prevent fraud and abuse.
- To comply with legal obligations and to enforce our agreements.
Legal bases
Where the GDPR applies, we process personal information on these bases: performing our contract with a publisher or reader (delivering the ad-free access, sending the passcode, processing payment); our legitimate interests (operating, securing, and pricing the service, and preventing abuse), where those interests are not overridden by your rights; your consent, where we rely on it (for example, marketing emails); and compliance with legal obligations.
Email and OTP
One-time passcodes and receipts are sent from our transactional email domain through Amazon SES. A passcode is a short-lived login code we email to the address a reader provides; we use it to verify that address and to issue or restore the ad-free entitlement. Amazon processes the message to deliver it. We do not sell or rent email lists.
Sharing and disclosure
We do not sell personal information and we do not “share” it for cross-context behavioral advertising as defined by the CCPA. We disclose information only as follows:
- Service providers. Amazon Web Services (hosting, email, storage, this site), Stripe (payment processing), and our database host. These providers may process information only to provide their services to us and are contractually bound to protect it.
- Publishers. A publisher receives the record of ad-free purchases on their site (including a reader’s optional display name, where provided) so they can reconcile revenue.
- Legal and safety. Where required by law, a court order, or a valid request by a public authority, or to protect rights, safety, or property, or to prevent fraud.
- Business transfers. In connection with a merger, acquisition, reorganization, or sale of assets, subject to this policy.
Payments
Card charges are processed by Stripe, with RecipeYield as the merchant of record; the publisher receives payouts through Stripe Connect. We receive payment intent identifiers, amounts, and status — never full card numbers.
Cookies
On a publisher’s domain, a successful ad-free purchase sets a first-party cookie named sponsor_ent (with sponsor_ent_1, … continuations when the token is large). It holds an ES256 JWT signed by our API; the plugin verifies it locally and does not call us on every pageview. The token is short-lived and refreshes automatically while the ad-free access is active. Details are in the Cookie Policy.
Data retention
- One-time passcodes: deleted shortly after use or expiry.
- Entitlements and payment grants: for the life of the ad-free access plus a limited accounting period (typically years, not weeks).
- Ad metrics and offers: a rolling operational window, with aggregates kept for publisher reporting.
- Logs: generally 30–90 days, unless kept longer for security or a dispute.
Security
We use TLS, encrypt ad-network credentials at rest, and keep signing keys on our servers. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security; if we become aware of a breach affecting your information, we will notify you and any relevant authorities as required by law.
International transfers
Information is processed in the United States. Where personal information is transferred from the EU, UK, or Switzerland, we rely on appropriate safeguards, including Standard Contractual Clauses.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or obtain a portable copy of your personal information, and to object to or restrict certain processing. California residents may also have the right to know what personal information we collect, to request deletion, and to opt out of “sale” or “sharing”; we do not sell or share personal information. To exercise any right, email ${mail(PRIVACY_EMAIL)}. We will respond within the time the law requires and may need to verify your identity (for a reader, typically via the email used at checkout).
Children
The service is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided information, email ${mail(PRIVACY_EMAIL)} and we will delete it.
Changes
We may update this policy and will post changes on this page with a new date. Material changes will be described here before they take effect where the law requires. Last updated 25 October 2026.