КоШиЯм — Privacy Policy
Version 1.1 · effective [DATE OF LAUNCH]
This policy explains how Peshets LTD, UIC [NUMBER], [ADDRESS] ("we"), as data controller, processes your personal data when you use КоШиЯм, in line with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Bulgarian Personal Data Protection Act. Contact: [PRIVACY E-MAIL]. [Data protection officer, if appointed: NAME, E-MAIL.]
1. Data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| E-mail, name, Google account ID, password hash (stored by our auth provider) | Account and sign-in | Contract (Art. 6(1)(b)) | Until you delete the account |
| Budget, timeframe, household size, children's ages, diet, calorie target, disliked foods | Creating meal plans | Contract (Art. 6(1)(b)) | Until you change or delete them |
| Allergies and diet restrictions (may reveal health information or religious beliefs) | Excluding unsafe ingredients from your plans | Your explicit consent (Art. 9(2)(a)), given in onboarding; you can withdraw it at any time by removing the allergies — the app then cannot protect you from them | Until you remove them or delete the account |
| Location (GPS) — only when you actively search for nearby stores, never tracked in the background — and the stores you choose | Finding the nearest supported stores and their exact prices | Contract (Art. 6(1)(b)); location only with your Android permission | Rounded to about 1 km and kept with your preferences until you change them |
| Generated menus and grocery lists | Showing your plans, offline access | Contract | Until you delete them or the account |
| Subscription status, Stripe customer and subscription IDs, payment dates | Billing, the 48-hour refund, tax records | Contract; legal obligation (Art. 6(1)(c)) — Accounting Act | Invoices: 10 years as required by Bulgarian accounting law; the rest until account deletion |
| One-way hashes of the card fingerprint (from Stripe) and of an app-specific device identifier; whether the account had a free trial | One free trial per person (fraud prevention) | Legitimate interest (Art. 6(1)(f)) in preventing repeated free trials | The hashes are kept after account deletion, unlinked from the account, so a new account cannot claim another trial; they cannot be traced back to you |
| Consent records (which version of the terms/privacy policy you accepted and when) | Proving consent | Legal obligation / legitimate interest (Art. 6(1)(c), (f)) | For the life of the account plus 3 years |
| Technical logs and crash reports (IP address, device type, error details; no allergy data) | Security, fraud prevention, fixing bugs | Legitimate interest (Art. 6(1)(f)) | 90 days |
| AI usage records (number of tokens and cost per plan) | Cost control and abuse prevention | Legitimate interest (Art. 6(1)(f)) | 12 months |
We do not sell your data, show third-party advertising or build advertising profiles. Card details are collected directly by Stripe; we never receive them.
2. Automated processing and AI
To draft menus, the AI provider receives only what a recipe needs: ingredient lists with prices, and your diet, allergies, household size and budget. Your name, e-mail and account identity are never sent to the AI engine. The AI's output is checked by automatic rules that remove declared allergens and enforce your diet. This processing does not produce legal or similarly significant effects within the meaning of Art. 22 GDPR; you can always change your inputs or regenerate a plan, and you can contact us for human review.
3. Recipients (processors)
| Provider | Role | Location / safeguard |
|---|---|---|
| Supabase Inc. | Database and authentication | EU (Frankfurt, Germany) |
| Vercel Inc. | API hosting | EU region (Frankfurt); US company — EU Standard Contractual Clauses (SCCs) and EU–US Data Privacy Framework (DPF) |
| Anthropic PBC | AI menu generation | USA — SCCs / DPF; data not used to train models under its commercial terms |
| Stripe Payments Europe, Ltd. | Payments | Ireland / USA — SCCs, DPF |
| Google Ireland Ltd. | "Sign in with Google" (only if you use it) | Ireland / USA — SCCs, DPF |
| Railway Corp. | Price data collection (no personal data) | — |
| Functional Software Inc. (Sentry) | Crash and error reports (no allergy data, no e-mail) | USA — SCCs / DPF |
We may disclose data to authorities when required by law.
4. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting earlier processing). Most actions are available in the app (Settings: edit preferences, export data, delete account). Otherwise write to [PRIVACY E-MAIL]; we reply within one month.
You may lodge a complaint with the Commission for Personal Data Protection (КЗЛД), 1592 Sofia, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg, or with the authority of your EU country of residence.
5. Security
Data is encrypted in transit (TLS) and at rest by our providers. Database access is restricted per user by row-level security; administrative keys are kept server-side only. Offline copies of your plans on your phone are stored in the app's private storage.
6. Children
The Service is intended for users aged 16 and over. Information about children in a household (number and ages) is provided by the adult user for portion sizing and child-safety rules only.
7. Changes
We will inform you in the app about material changes to this policy before they apply.