Privacy Policy

1. Introduction

Welcome to ShelfCents ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and application at shelfcents.com.

2. Information We Collect

We collect information you provide directly and automatically through your use of ShelfCents:

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), UK, or Switzerland, we process your personal data based on the following legal grounds:

• Consent: When you create an account, subscribe to our service, or opt into notifications.
• Contract: When processing is necessary to provide the service you requested (meal planning, pantry tracking, etc.).
• Legitimate Interest: To improve our service, prevent fraud, and ensure security.
• Legal Obligation: When we are required to retain data for tax, accounting, or regulatory compliance.

4. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Specifically:

• Account data: Retained until you delete your account, then removed within 30 days.
• Transaction data: Retained for 7 years for tax and accounting purposes (as required by law).
• Usage analytics: Anonymized after 12 months.
• Support communications: Retained for 3 years.
• Consent records: Retained for 5 years as evidence of consent.
• Security logs: Retained for 2 years for security auditing.

When you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required by law.

5. Third-Party Service Providers

We use the following third-party services that may process your data:

• Supabase (https://supabase.com, United States) — Database hosting and authentication. SOC 2 Type II certified.
• Stripe (https://stripe.com, United States) — Payment processing. PCI DSS Level 1 certified.
• Vercel (https://vercel.com, United States) — Web hosting and application infrastructure.
• Groq (https://groq.com, United States) — AI processing for meal planning features.

These providers process data on our behalf and are contractually obligated to protect your information.

6. International Data Transfers

ShelfCents is based in the United States. If you access our service from the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data will be transferred to and processed in the United States.

When we transfer data outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V (Articles 44-49). Specifically:

• Standard Contractual Clauses (SCCs): We rely on EU-approved Standard Contractual Clauses adopted by the European Commission for data transfers to the United States.
• Data Processing Agreements: All our service providers (Supabase, Stripe, Vercel, Groq) have signed data processing agreements that include SCCs.
• US-EU Data Privacy Framework: Where applicable, our US-based service providers participate in the EU-US Data Privacy Framework.

You may request a copy of the Standard Contractual Clauses by contacting us at Shelfcents@gmail.com.

If you are in the EEA, you have the right to obtain information about the specific safeguards applied to your data transfers. Contact us for details.

7. How We Use Your Information

We use your information to provide and improve ShelfCents services, generate personalized meal plans and grocery lists, send expiry reminders and task notifications, calculate estimated savings, and communicate with you about your account.

8. Data Storage and Security

Your data is stored using industry-standard encryption both in transit and at rest. We use Supabase for database hosting with SOC 2 compliance. We implement appropriate technical and organizational measures to protect your personal information.

9. Data Sharing

We do not sell your personal information to third parties. We may share anonymized, aggregated data for research or analytics purposes. We may share information with service providers who assist in operating our platform, subject to confidentiality agreements.

10. Cookies and Tracking

We use essential cookies for core functionality. Optional analytics and marketing cookies are only used with your consent. You can manage your cookie preferences at any time through our cookie consent banner.

11. Your Rights Under GDPR

If you are in the EEA, UK, or Switzerland, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate personal data.
• Right to Erasure (Art. 17): Request deletion of your personal data ("Right to be Forgotten").
• Right to Restrict Processing (Art. 18): Request restriction of processing of your personal data.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing of your personal data based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time.
• Right to Lodge a Complaint (Art. 77): You have the right to lodge a complaint with a supervisory authority in your country of residence, workplace, or where the alleged infringement occurred. For EU residents, you may contact your local Data Protection Authority.

To exercise these rights, contact us at Shelfcents@gmail.com. We will respond within 30 days.

12. Automated Decision-Making and Profiling

ShelfCents uses artificial intelligence for meal planning, grocery optimization, and food expiry predictions. Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.

Our AI features:

• Generate meal plan suggestions based on your preferences and pantry items
• Optimize grocery lists for budget savings
• Predict food expiry dates

These are suggestions only and do not produce legal effects. You can opt out of AI features by using the manual/algorithmic alternatives available in the app (e.g., "Quick Plan" instead of "AI Plan"). No automated decision-making is used for any purpose that produces legal or similarly significant effects on users.

13. Data Protection Contact

For any questions about our data practices or to exercise your GDPR rights, contact our data protection team:

• Email: Shelfcents@gmail.com
• Subject line: "GDPR Request" or "Data Protection Inquiry"

We will respond to all GDPR-related requests within 30 days. If we need additional time, we will notify you of the extension.

14. Your Rights Under CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect.
• Right to Delete: Request deletion of your personal information.
• Right to Opt-Out: We do not sell your personal information. If this changes, we will provide an opt-out mechanism.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at Shelfcents@gmail.com.

15. Children's Privacy

ShelfCents is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date.

17. Contact Us

If you have questions about this Privacy Policy, please contact us at Shelfcents@gmail.com or visit shelfcents.com/contact.