Food Roots

Privacy policy

Last updated: November 2026

Food Roots (foodroots.ie) is a space for stories about food, memory and belonging. This page explains which personal data we use, why, and what rights you have.

1. Who is responsible for your data

The data controller is Dor Str, an individual based in Ireland. You can reach us through the Contact page.

2. What we collect and why

Your stories: your first name or nickname, countries and town, the text, photos and video you send. Legal basis: your consent, which you give by ticking the box when you submit. You can delete your story at any time.

Your account: your email address to sign in by link, and your display name. Legal basis: providing the service you asked for.

Comments and reactions: your display name and text. For guests we use a random code stored in a cookie.

Event sign-ups: your name and email, to organise the event and send you the link and a reminder. We keep them for up to 12 months after the event.

Newsletter: your email address, language and the date you confirmed. Legal basis: your consent; you can unsubscribe from every email.

Messages sent through the Contact page: your name, email and message, so we can reply. We keep them for up to 12 months.

Technical data: IP addresses are processed by our hosting and security services in the normal running of the site. We do not use advertising or analytics cookies.

3. Cookies and similar technologies

We only use what is necessary: your sign-in session, stored in your browser, and a cookie called “fr_guest” (1 year) that counts guest stories, prevents duplicate reactions and lets you delete your own guest stories. The Cloudflare Turnstile security check may set its own technical cookies. We do not use advertising or tracking cookies.

4. Who we share data with

Providers that process data on our behalf: Supabase (database and files, Ireland/EU region), Vercel (hosting), Cloudflare (security check), DeepL (translation of text, only when someone presses the translate button), Brevo (emails) and OpenStreetMap (maps: your browser connects to their servers when the map is shown).

Some providers may also process data outside the EU/EEA, relying on approved safeguards such as standard contractual clauses.

5. Public content

Published stories, first names, photos and comments are visible to everyone. Please do not share sensitive information or home addresses. Do not upload photos in which children can be recognised without their parents’ consent.

6. How long we keep data

Stories and comments until you delete them or we remove them. Your account until you delete it. Event sign-ups and contact messages for up to 12 months. Newsletter subscribers until they unsubscribe.

7. Your rights

You have the right to access, correct, erase, restrict and port your data, to object, and to withdraw consent at any time. Write to us through the Contact page and we will reply within one month. You may also complain to the Data Protection Commission in Ireland (dataprotection.ie).

8. Children

This site is for adults. People under 16 should not create accounts.

9. Changes

We may update this policy. The date of the latest update is shown at the top.