Privacy Policy
Effective from 1 October 2026 · version 2026-10
Template – before going public, fill in the details in square brackets, have the text reviewed and remove this notice.
1. Who processes your data
The controller of the Spotrebio service (the app at app.spotrebio.eu, the website spotrebio.eu and the documentation at docs.spotrebio.eu) is [name / business name], [registered address], company ID (IČO) [ ], registered in [the Trade / Commercial Register …] ("we").
Contact for personal data questions: privacy@spotrebio.eu.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| E-mail, name, password (only as a one-way hash), language, household time zone | creating and running the account, sign-in, e-mail verification and change, password reset | performance of a contract – Art. 6(1)(b) GDPR |
| Household content: food, dates, storage places, notes, photos, prices, shopping list, imported receipts (shop, items, prices) | providing the service | performance of a contract |
| History of used-up and thrown-away food (name, category, value in €, date) | the "How much you throw away" statistics | performance of a contract |
| Household memberships, invites | sharing a household with other people | performance of a contract |
| Device data for notifications (push service address, encryption keys, browser type) | delivering reminders | performance of a contract |
| E-mail, summary setting, time of the last summary | weekly e-mail summary (can be turned off in Settings or with the link in the e-mail) | performance of a contract |
| Sign-in sessions (browser type, time); IP address and e-mail on sign-in, registration and password reset – only as a one-way hash in an attempt counter; technical error logs (without IP addresses) | security, protection against password guessing and abuse | legitimate interest – Art. 6(1)(f) GDPR |
| With Premium: Stripe customer and subscription IDs, subscription status and period, invoices | payment processing, accounting | performance of a contract, legal obligation – Art. 6(1)(c) GDPR |
| Date and version of the accepted terms | proof of acceptance | legitimate interest |
We never see or store card numbers – you enter them directly into the Stripe payment page.
Photos are resized on upload and all metadata including GPS location is removed.
We do not sell your data, use it for advertising or profiling, or make automated decisions based on it.
3. Who else has access
- Members of your household see the household content and your name and e-mail.
- Hosting – Forpsi, [provider's legal name and address per contract], server in [data-centre country] (processor).
- Backups – daily backups are also copied to our own server in Slovakia. [If you also use external backup storage, list it here as a processor.]
- E-mail provider – [name, country] for e-mail verification and change, password reset and the weekly summary (processor).
- Stripe Payments Europe, Ltd. (Ireland) – Premium payments; Stripe also acts as an independent controller for its own obligations (e.g. fraud prevention).
- Push services of browser makers (Apple, Google, Mozilla, Microsoft) – deliver notifications; the notification content is encrypted.
- Open Food Facts – when looking up a product we only send the barcode, nothing about you.
- Financial Administration of the Slovak Republic (eKasa) – when loading a receipt we only send the receipt ID from the QR code.
- Public authorities where the law requires it.
Some providers (Stripe, push services) may transfer data outside the EU, mainly to the USA, based on an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
4. How long we keep data
- Account and household data – as long as the account exists. After account deletion it is removed immediately; from backups within 30 days at the latest.
- A household whose last member leaves is deleted with its content; photos within 2 days.
- Sign-in sessions – at most 60 days after last use.
- Password-reset, e-mail verification and e-mail change links – at most 7 days.
- Hashes of IP addresses and e-mails in attempt counters – at most 2 hours.
- Records that prevent changes sent while offline from being saved twice – 7 days.
- Technical logs – continuously overwritten, at most [14] days.
- Sent reminders – 90 days.
- Accounting records for Premium – 10 years as required by the Slovak Accounting Act.
5. Cookies and browser storage
We use only one essential cookie (spotrebio_session) to keep you signed in. Browser storage remembers your theme, language and selected household. So that the app works offline, it also keeps the last loaded stock and shopping list there, plus changes waiting to be sent – they are deleted when you sign out. The app and guide files are kept in the browser cache (service worker). We use no analytics, advertising or tracking cookies, so no cookie consent is needed.
6. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest.
- Export all your data and delete your account yourself in Settings → Privacy & data.
- Send other requests to privacy@spotrebio.eu from your account's e-mail. We reply within one month at the latest.
If you believe the processing breaks the law, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk, or with the authority in your EU country.
7. Security
Communication is encrypted (HTTPS), passwords are stored only as a hash (scrypt), sign-in is protected against password guessing, data is backed up daily with regularly tested restores, and only authorised people have access to the servers.
8. Age
The service is intended for people over 16.
9. Changes
We will tell you about significant changes in the app the next time you sign in. The current version is always on this page.