Privacy Policy

Last updated: 2026-04-26

1. Who we are

Onrush is a service operated by SAS La Fabrique Alimentaire, a French joint-stock company registered at 4 Côte Planchaude, 81990 Cunac, France (SIREN 81038794). Our data protection contact: legal@onrush.fr.

2. What data we collect

  • Account data: name, email address, business name, phone (optional).
  • Operational data: recipe cards, mercurial prices, stock counts, temperature logs, supplier orders, sales data — entered by you to run your kitchen.
  • Payment data: handled by Stripe. We never see or store your full card number.
  • Usage data: pages visited, features used, error logs (PostHog, Sentry). Used to improve the product and fix bugs.
  • Marketing analytics: aggregated traffic data via Google Analytics 4, Meta Pixel and Metricool. No personal profile is built without your consent.

3. Legal basis (GDPR / UK GDPR)

  • Contract performance (art. 6.1.b) — to provide the Onrush service you subscribed to.
  • Legal obligation (art. 6.1.c) — for tax, accounting, food safety record-keeping (HACCP).
  • Legitimate interest (art. 6.1.f) — security, fraud prevention, aggregated product analytics.
  • Consent (art. 6.1.a) — for marketing emails, non-essential cookies, and marketing pixels. You can withdraw at any time.

4. Where your data is stored

Data is stored on Supabase infrastructure in Frankfurt, Germany (EU). Some sub-processors operate outside the EU (Stripe, Cloudflare, Sentry). Standard Contractual Clauses apply for any transfer outside the EEA. We do not sell your data.

5. How long we keep your data

  • Active customers: as long as your account is open, plus 30 days after deletion.
  • HACCP / food safety logs: 10 years minimum (legal retention).
  • Invoices: 10 years (French commercial law).
  • Marketing emails opt-in: until you unsubscribe.

6. Your rights

You have the right to:

  • Access your data (export available from your account or by emailing us).
  • Rectify inaccurate data.
  • Erase your account and personal data — see our deletion page.
  • Object or restrict processing.
  • Data portability (machine-readable export).
  • Withdraw consent at any time.
  • Lodge a complaint with the CNIL (France) or your national supervisory authority (e.g. ICO in the UK).

To exercise any right: legal@onrush.fr. We respond within 30 days.

7. Sub-processors

  • Supabase (hosting, EU-Frankfurt)
  • Vercel (delivery / edge network)
  • Stripe (payments)
  • Resend (transactional email)
  • Twilio (SMS, optional)
  • Sentry (error monitoring)
  • PostHog EU (product analytics)
  • Google Analytics 4, Meta Pixel, Metricool (marketing analytics, with consent)
  • Anthropic / Google Gemini (AI features for recipe analysis, only on data you submit)

8. Cookies

See our Cookie Policy for details. Marketing pixels are loaded only after consent.

9. Changes to this policy

We'll notify you by email of any material change. Continued use of Onrush after a notified change means you accept the updated policy.

10. Contact

SAS La Fabrique Alimentaire — 4 Côte Planchaude, 81990 Cunac, France — legal@onrush.fr