Privacy Policy

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Data We Collect

When using ShelfLife, we collect and process the following personal data:

2.1 Account Data

• Email address: For registration, login, and communication
• Password: Stored encrypted for authentication

2.2 Usage Data

• Household data: Storage locations and categories you create
• Inventory data: Information about your food items and supplies (name, quantity, expiry date, storage location)
• Session data: Login times and device information for security purposes

2.3 Voice Processing

When you use the voice input feature, your voice recordings are transmitted to OpenAI for processing. The recordings are only used for transcription and are not permanently stored. See Section 6 (Third-Party Services) for more details.

3. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract performance (Art. 6(1)(b) GDPR): To provide our service and manage your account
• Consent (Art. 6(1)(a) GDPR): For the use of voice input features
• Legitimate interests (Art. 6(1)(f) GDPR): For the security and operation of our platform

4. Cookies and Session Management

We only use technically necessary cookies:

• Session cookie: Keeps you logged in and enables secure use of the application
• CSRF token: Protects against cross-site request forgery attacks

We do not use tracking cookies, analytics tools, or advertising cookies.

5. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about your stored data
• Right to rectification (Art. 16 GDPR): You can request correction of inaccurate data
• Right to erasure (Art. 17 GDPR): You can request deletion of your data
• Right to restriction (Art. 18 GDPR): You can request restriction of processing
• Right to data portability (Art. 20 GDPR): You can receive your data in a structured format
• Right to object (Art. 21 GDPR): You can object to the processing
• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw given consent at any time

To exercise your rights, please contact us at: info@allonsygmbh.com

You also have the right to lodge a complaint with a data protection supervisory authority.

6. Third-Party Services

6.1 OpenAI (AI Features)

For voice input and AI-powered features, we use services from OpenAI, L.L.C. (USA). The following data is transmitted:

• Voice recordings for transcription
• Text inputs for AI processing

OpenAI processes this data according to their Privacy Policy. Data transfer to the USA is based on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6.2 Hosting

Our servers are located in Germany/EU and are operated by GDPR-compliant providers.

7. Data Security

We implement comprehensive technical and organizational measures to protect your data:

• Encrypted transmission: All data is transmitted via HTTPS/TLS
• Password hashing: Passwords are hashed using modern algorithms
• Access control: Strict access controls for all systems
• Regular security updates: Continuous updates of our systems

8. Data Retention

We only store your data for as long as necessary for the respective purposes:

• Account data: Until deletion of your account
• Inventory data: Until deleted by you or account deletion
• Archived data: 90 days after archiving, then automatically deleted
• Session data: Until logout or automatic expiration

When you delete your account, all personal data is permanently deleted.

9. Changes to This Privacy Policy

We reserve the right to update this privacy policy as needed to adapt it to changed legal requirements or changes to our service. The current version can always be found on this page. We will notify you by email of any significant changes.

10. Contact

For questions about data protection or to exercise your rights, please contact us at: