Legal

Privacy Policy

How we collect, use, and protect your personal data.

1. Data Controller

The data controller responsible for your personal data is L3V Solutions S.r.l., Via Lallio 58, 24044 Dalmine (BG), Italy, VAT no. IT04215590169, the company that develops and operates Hey Pantry! ("Hey Pantry!", "we", "us"). We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Italian data protection law (Legislative Decree 196/2003, as amended). For users in Switzerland, we also comply with the Swiss Federal Act on Data Protection (FADP).

For data protection inquiries, contact us at privacy@heypantry.ch or by certified email (PEC) at l3vsolutions@pec.it.

2. Data We Collect

We collect and process the following categories of personal data:

  • •Account data โ€” email address, display name, and password hash when you create an account. If you sign in with Google, we receive the name and email address of your Google account instead of a password.
  • •Pantry & food data โ€” items you add, expiration dates, quantities, categories, shopping lists, and recipes you save, including any photos you upload. This data is used to provide core app functionality.
  • •Food intolerances and allergies โ€” only if you choose to record them and give your explicit consent. This is health data; see Section 3.
  • •Voice recordings and assistant requests โ€” when you use voice input to add items, search, or talk to the in-app assistant, the app uploads your recording to our server, where it is transcribed and processed to carry out your request. Recordings are stored on our server and deleted automatically after 12 months. Voice commands in hands-free cooking mode are recognized by your phone's speech recognition service and are not sent to our server.
  • •Usage data โ€” recipes viewed, cooking sessions started, features used, and in-app preferences. Collected to improve the service.
  • •Device data โ€” device type, operating system, and app version.
  • •Security logs โ€” IP address, login attempts, and security-relevant account events, used to protect your account and our service.

3. Health Data: Food Intolerances and Allergies

In the app you can record food intolerances and allergies: by selecting them from a list (for example gluten, lactose, or nuts), by typing other allergens in free text, or by telling the in-app assistant. Because this information can reveal details about your health, it is a special category of personal data under Article 9 GDPR and sensitive personal data under Article 5 lit. c of the Swiss FADP. We therefore handle it as follows:

  • •Explicit consent โ€” we store intolerances and allergens only with your explicit consent (Article 9(2)(a) GDPR; Article 6(7)(a) FADP), which the app asks for before the first one is saved. Giving consent is optional: you can use the app without it, but recipe suggestions will then not take your intolerances into account.
  • •Purpose limitation โ€” we use this data only to filter and adapt the recipe suggestions you receive. We do not use it for any other purpose, and we never sell it or use it for advertising.
  • •AI processing โ€” your saved intolerances and allergens are sent to our AI provider (see Section 6) only as part of recipe requests. If you mention an intolerance while talking to the assistant, what you say is processed by the AI provider so that your request can be understood and carried out.
  • •Record of consent โ€” we store the date and time of your consent on our server so that we can demonstrate it.
  • •Withdrawal โ€” you can withdraw your consent at any time in the app's Settings. Withdrawing consent deletes all stored intolerances and allergens, both those selected from the list and those entered as free text. Withdrawal does not affect the lawfulness of processing carried out before it.

4. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR and, for health data, Article 9 GDPR:

  • •Contract performance โ€” processing necessary to provide the Hey Pantry! service (pantry management, recipes, shopping lists, voice input, and the in-app assistant).
  • •Legitimate interest โ€” service improvement, fraud prevention, and security.
  • •Consent โ€” marketing communications and optional camera and microphone access.
  • •Explicit consent โ€” food intolerances and allergies (Article 9(2)(a) GDPR; see Section 3).
  • •Legal obligation โ€” where required by applicable EU or member state law.

5. How We Use Your Data

  • •Provide, maintain, and improve the Hey Pantry! app and its features.
  • •Generate personalized recipe suggestions based on your pantry contents and, if you have consented, your food intolerances and allergies.
  • •Transcribe and carry out your voice and text requests to the in-app assistant.
  • •Send expiry notifications and smart alerts you have opted into.
  • •Aggregate anonymized usage statistics to improve the product.

6. Data Sharing & Transfers

We do not sell your personal data. We use the following service providers, which process personal data on our behalf:

  • •Hosting โ€” Hetzner Online GmbH (Germany). Our servers, database, and stored voice recordings are located in a data center in Finland (EU).
  • •AI services โ€” OpenRouter, Inc. (United States) receives the content of your requests (for example pantry items, recipe requests including any intolerances you have consented to, and assistant questions) as well as voice recordings for transcription. OpenRouter does not run the AI models itself: for each request it automatically selects one of several independent providers that host the model in use, based on factors such as availability and price. We therefore cannot know in advance which provider will process a given request or in which country, and the provider can change from one request to the next. For the models we currently use, these providers include companies in the United States and in the People's Republic of China (for example DeepSeek and Baidu); voice recordings are currently transcribed by Alibaba Cloud. OpenRouter publishes the current list of providers for each model on its website.
  • •Email โ€” Namecheap, Inc. (United States), whose Private Email service we use to send account emails (such as verification and password reset) and to run our heypantry.ch mailboxes.

Some features connect you with third parties that process your data under their own privacy policies:

  • •Open Food Facts โ€” when you scan a barcode, the app looks up the product directly in the public Open Food Facts database (Open Food Facts association, France), which receives the barcode and your IP address.
  • •Google Sign-In โ€” if you choose to sign in with Google, Google processes your sign-in under its own privacy policy.
  • •Device speech recognition โ€” hands-free cooking mode uses the speech recognition service of your phone's operating system (on Android usually provided by Google).
  • •Legal authorities โ€” when required by law or to protect our legitimate interests.

Our hosting is in the EU, which Switzerland recognizes as providing adequate protection. OpenRouter and Namecheap are based in the United States, and the AI model providers selected by OpenRouter may be located in other countries outside the EEA and Switzerland, including the People's Republic of China. Where data is transferred to a country without an adequacy decision of the European Commission (or, for Swiss data, of the Federal Council), we do so only with appropriate safeguards under Article 46 GDPR and Article 16 FADP, such as the European Commission's Standard Contractual Clauses, or on the basis of the recipient's certification under the EU-U.S. or Swiss-U.S. Data Privacy Framework where applicable. You can request a copy of these safeguards at privacy@heypantry.ch.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Food intolerances and allergies are kept until you withdraw your consent or delete your account. Voice recordings are deleted automatically after 12 months, and security logs after 180 days. If you delete your account, we erase your personal data within 30 days, except where retention is required by law (e.g., invoicing records kept for the statutory period). Anonymized, aggregated data may be retained indefinitely for statistical purposes.

8. Your Rights

Under the GDPR and, for users in Switzerland, the FADP, you have the following rights regarding your personal data:

  • •Access โ€” request a copy of the personal data we hold about you.
  • •Rectification โ€” correct inaccurate or incomplete data.
  • •Erasure โ€” request deletion of your personal data ("right to be forgotten").
  • •Restriction โ€” restrict processing of your data in certain circumstances.
  • •Portability โ€” receive your data in a structured, machine-readable format (JSON export).
  • •Objection โ€” object to processing based on legitimate interest or direct marketing.
  • •Withdraw consent โ€” where processing is based on consent, you may withdraw it at any time. For food intolerances and allergies, you can do this directly in the app's Settings, which deletes them.

To exercise any of these rights, email privacy@heypantry.ch. We will respond within 30 days. You also have the right to lodge a complaint with a data protection supervisory authority โ€” in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); or the authority of your EU country of residence.

9. Cookies

The Hey Pantry! website does not set cookies and does not use analytics or tracking tools. It stores two settings in your browser's local storage: your theme choice (light, dark, or auto) and your response to the consent banner. Fonts are served from our own server, so visiting the site sends no requests to third parties. The mobile app does not use cookies.

10. Security

We implement appropriate technical and organizational measures to protect your personal data, including encrypted connections (HTTPS) between the app or website and our servers, hashed passwords, and restricted access to our systems. Despite these measures, no method of transmission over the internet or of electronic storage is completely secure.

11. Children's Privacy

Hey Pantry! is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided personal data, we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via in-app notification or email at least 30 days before taking effect. Continued use of Hey Pantry! after changes constitutes acceptance of the updated policy.