Restock

Privacy Policy

Last updated: 3 July 2026

1. Who we are (Controller)

K4-Engineering, Ebereschenstr. 13, 86179 Augsburg, Germany — email binventory2026@gmail.com ("we"). This policy explains how we process personal data when you use the Restock app and website (the "Service") under the EU General Data Protection Regulation (GDPR) and other applicable laws.

2. What data we process

  • Account data: email address, display name, authentication provider ID (Google/Apple), language, theme.
  • Household & app data: households you create or join, inventory items, quantities and limits, shopping lists, scanner devices you pair, product submissions including photos you upload.
  • Health profile (optional, special category data): allergies, intolerances, medical-condition flags and diet goals you enter, used solely to show you warnings and filter suggestions. We process this only with your explicit consent (Art. 9(2)(a) GDPR) and you can delete it anytime in Settings.
  • Payment & order data: subscription plan and status, order details and shipping address for hardware orders. Card data is processed by Stripe and never touches our servers.
  • AI usage data: your requests to the cooking assistant, the pantry context sent with them and, if enabled, your dietary preferences; monthly usage counts.
  • Technical data: push notification subscription (if you enable it), cookie/consent state, basic logs for security and abuse prevention (e.g. rate limiting).

3. Purposes and legal bases (Art. 6, 9 GDPR)

  • Providing the Service and your contract with us — Art. 6(1)(b).
  • Health profile, push notifications, non-essential cookies — your consent, Art. 6(1)(a) and Art. 9(2)(a); withdrawable anytime in Settings.
  • Security, fraud and abuse prevention — legitimate interests, Art. 6(1)(f).
  • Invoicing and tax retention — legal obligations, Art. 6(1)(c).

4. Processors and recipients

We use these processors under data processing agreements: Supabase (database, authentication, hosting), Stripe (payments), Resend (transactional email), Groq (AI recipe generation), Google (sign-in). Barcode lookups query the OpenFoodFacts database (the barcode is transmitted). Some providers process data outside the EU/EEA (e.g. USA); transfers are protected by EU Standard Contractual Clauses or adequacy decisions.

5. Retention and deletion

Your data is kept while your account exists. You can export your data (Settings → Export my data) and permanently delete your account (Settings → Delete account); deletion removes personal data immediately, except records we must keep by law (e.g. invoices, 10 years under German tax law).

6. Your rights (EU/EEA)

Access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and withdrawal of consent at any time. You may lodge a complaint with a supervisory authority. The competent authority for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

7. California residents (CCPA/CPRA)

Categories collected: identifiers, commercial information, internet activity, and (only if you enter it) health-related information. We do not sell or "share" personal information for cross-context behavioural advertising. You have the rights to know, delete, correct, and non-discrimination; exercise them via binventory2026@gmail.com. Authorized agents may submit requests.

8. Saudi Arabia, Qatar and other regions

Where local data protection laws apply (e.g. the Saudi Personal Data Protection Law, Qatar Law No. 13 of 2016), we process personal data on the bases of consent and contract necessity, and you may exercise rights of access, correction and deletion via binventory2026@gmail.com. Data may be processed outside your country with appropriate safeguards.

9. Cookies, push notifications, children

See our Cookie Policy. Push notifications are optional and can be disabled in Settings or your browser/OS at any time. The Service is not directed at children under 16 and we do not knowingly collect their data.

10. Changes & contact

We will update this policy when the Service changes and indicate the date above. Questions: binventory2026@gmail.com.