Privacy Policy

Effective date: 2026-05-27

1. Who we are

CubChief (Mauritius) is an AI-driven smart pantry and shopping assistant. This privacy policy explains how we collect, use, and protect your personal data. We comply with the EU General Data Protection Regulation (GDPR) and the Mauritius Data Protection Act 2017 (DPA).

2. What data we collect

  • Account data: email address, display name, password hash, language preference.
  • Household data: shared with other members of your household — pantry contents, shopping lists, recipes, jam ledger entries.
  • Receipt photos: uploaded receipts are processed by AI (Anthropic / OpenAI) for product extraction, then stored on our servers. Photos are deleted automatically after 90 days unless you choose to keep them.
  • Payment data: handled by Stripe. We never see or store your card details.
  • Usage data: session cookies, IP address (hashed for audit), browser type.

3. Legal basis

  • Contract performance — running the app you signed up for.
  • Consent — for optional features (anonymous statistics, marketing emails).
  • Legitimate interest — service improvement, fraud prevention.

4. Third parties

We share data with the following processors to deliver the service:

  • Stripe — payment processing (EU/US datacenters).
  • Anthropic / OpenAI — AI vision for receipt OCR. Photos are sent for processing only; not used for AI training (zero data retention).
  • Cloudflare — DNS, CDN, DDoS protection.

We never sell your data.

5. How long we keep data

  • Account data: while your account is active, plus 30 days after deletion request.
  • Receipt photos: 90 days unless you opt to keep them.
  • Jam ledger: 7 years (financial record retention).
  • Consent log: 6 years (compliance proof).
  • Anonymous platform statistics: retained indefinitely in aggregated form. Because the data is k-anonymised before storage, it cannot be linked back to you, and erasure of your account does not retrospectively remove already-aggregated rows.

5a. Anonymous platform statistics

By default, your usage activity contributes to anonymised, aggregated platform statistics: which products are popular, which stores are visited, how prices move over time. The aggregation uses a k-anonymity threshold so that no single household can be inferred from any published number. You can withdraw consent at any time in Settings → Household → Share anonymous statistics. Your withdrawal is logged for audit purposes (DPA 2017 §27).

6. Your rights

Under DPA 2017 and EU GDPR, you have the right to:

  • Access your data — Settings → Data Export
  • Correct inaccurate data — Settings → Edit profile
  • Erase your data — Settings → Delete account (30-day grace period)
  • Port your data (JSON download)
  • Object to processing, Restrict processing
  • Withdraw consent at any time for optional features

7. Complaints

You may lodge a complaint with:

8. Contact

For any privacy-related questions, contact us at support@cubchiefmu.com.