HeyVeggie
Privacy Policy (v1.0)
Prima Business Control Software Romania SRL · Effective August 7, 2026 · Last updated August 7, 2026
Related: Terms of Service · Consents
Data Controller
Prima Business Control Software Romania SRL
Str. Alexandru Vlahuta 1
Sector 3, Bucharest, Romania
Company registration
CUI 22743162 / J40/21432/2007
- Product
- HeyVeggie
- Website
- https://heyveggie.app
- Effective Date
- August 7, 2026
- Last Updated
- August 7, 2026
This Privacy Policy explains how Prima Business Control Software Romania SRL (“we”, “us”, “our”, or “Company”) collects, uses, discloses, stores, and protects your personal data when you download, install, access, or use the HeyVeggie mobile application and related services (collectively, the “Service”).
We are committed to protecting your privacy in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Romanian Law no. 190/2018, and other applicable data-protection laws.
This policy is written to be clear and understandable. If anything is unclear, please contact us.
1. Scope and Controller
We act as the data controller for personal data processed through the Service.
Certain third-party services, such as app stores, OAuth providers, analytics providers, payment processors, or cloud providers, may act as independent controllers, processors, or joint controllers depending on the context. See Section 5.
This policy does not cover data processed purely on your device without being transmitted to us, such as local-only processing before you choose to save, sync, upload, or share the data.
2. Personal Data We Collect
We collect different categories of personal data depending on how you use HeyVeggie.
2.1 Data You Actively Provide
Account and profile data
- email address;
- display name or nickname;
- preferred language or locale;
- household or family identifiers;
- profile image or avatar, if you choose to add one;
- optional phone number, if a feature requires it.
Household and food-management data
- grocery lists;
- inventory items;
- product names;
- quantities;
- expiration or best-before dates;
- shopping notes;
- receipt data if uploaded;
- expense notes;
- household sharing information;
- reminders and preferences.
Health, nutrition, and preference data, if you choose to provide it:
- dietary preferences;
- allergies or intolerances;
- nutrition goals;
- calorie or macronutrient preferences;
- food restrictions;
- relevant medical or health-related dietary information.
Legal, consent, and preference data
- acceptance of Terms, Privacy Policy, disclaimers, and other legal documents;
- marketing or newsletter preferences;
- analytics or crash-reporting choices;
- push notification settings;
- privacy and consent settings.
Support data
- messages you send to support;
- attachments you provide;
- issue descriptions;
- communication history.
2.2 Data Automatically Collected or Derived
Technical and device data
- device type and model;
- operating system version;
- app version;
- unique installation or device identifiers where necessary;
- IP address;
- approximate region or country based on IP;
- crash logs;
- diagnostics;
- performance metrics.
Usage data, where permitted
- screens visited;
- features used;
- session duration;
- interactions such as adding items, scanning receipts, accepting suggestions, or changing preferences.
Derived or inferred data
- estimated shelf-life patterns;
- consumption habits;
- waste trends;
- inferred dietary patterns;
- nutrition or food-planning insights based on your tracked data and preferences.
2.3 Special Categories of Data
If you voluntarily provide information that reveals health-related data, such as allergies, intolerances, medical dietary restrictions, calorie goals, diet plans, or health-related food preferences, we may process special categories of personal data under GDPR Article 9.
Where required, we rely on your explicit consent for such processing. You may withdraw consent for optional health-related processing at any time through the App settings or by contacting us.
2.4 OAuth and Social Login Data
If you sign in using a third-party provider such as Google, Apple, or another supported OAuth provider, we may receive account information from that provider, such as:
- provider user ID;
- email address;
- name or display name;
- profile image, if provided;
- authentication metadata.
The exact information depends on the provider, your provider settings, and the permissions you grant.
We use this data to create, authenticate, and secure your HeyVeggie account.
2.5 Data We Do Not Collect
We do not collect
- precise geolocation (unless a future feature clearly requests it and you consent);
- full payment card numbers;
- full payment authentication credentials;
- contacts, calendar data, or photos (unless you explicitly provide or upload them for a feature);
- audio or video recordings as stored content (unless a future feature clearly requests this and you consent).
Payments are handled by app stores or payment processors. We may store limited non-sensitive billing metadata, such as transaction IDs, subscription status, receipt identifiers, payment method type, last four digits where provided by a processor, or renewal status.
3. Purposes and Legal Bases
We process personal data only for specified, explicit, and legitimate purposes.
3.1 Providing the Service
Purpose
Create and manage accounts, authenticate users, sync data, provide shopping lists, inventory, household sharing, preferences, reminders, and other core features.
Data
Account data, profile data, household data, tracked items, device/session data.
Legal basis
Contract necessity under GDPR Article 6(1)(b).
3.2 Personalization and Insights
Purpose
Provide food-planning suggestions, inventory insights, waste-reduction estimates, nutrition-related preferences, and personalized recommendations.
Data
Tracked items, preferences, household data, usage data, inferred patterns.
Legal basis
Contract necessity under GDPR Article 6(1)(b), legitimate interests under Article 6(1)(f), and consent under Article 6(1)(a) where required.
Special category basis
Explicit consent under GDPR Article 9(2)(a), where health-related data is processed.
3.3 Receipt OCR and Item Extraction
Purpose
Process receipt images or documents to extract items, prices, dates, and related information.
Data
Receipt images, extracted text, item data, transaction metadata.
Legal basis
Contract necessity under GDPR Article 6(1)(b).
3.4 Notifications
Purpose
Send reminders, transactional notifications, household updates, expiring-item alerts, and account/security notices.
Data
Device token, notification preferences, account data, item data.
Legal basis
Contract necessity under GDPR Article 6(1)(b), legitimate interests under Article 6(1)(f), or consent where required.
3.5 Security, Abuse Prevention, and Fraud Prevention
Purpose
Protect accounts, detect abuse, prevent unauthorized access, enforce security rules, and maintain service integrity.
Data
IP address, device identifiers, logs, behavior patterns, authentication metadata.
Legal basis
Legitimate interests under GDPR Article 6(1)(f) and legal obligations where applicable.
3.6 Analytics and Service Improvement
Purpose
Understand app usage, fix bugs, improve performance, and develop features.
Data
Usage data, diagnostics, crash reports, aggregated or pseudonymized data where possible.
Legal basis
Consent under GDPR Article 6(1)(a), where required, or legitimate interests under Article 6(1)(f) for essential diagnostics and security.
3.7 Marketing and Communications
Purpose
Send newsletters, feature updates, tips, and promotional communications where you opt in.
Data
Email address, marketing preferences, communication history.
Legal basis
Consent under GDPR Article 6(1)(a).
You may opt out at any time.
3.8 Legal Compliance
Purpose
Comply with tax, accounting, consumer-protection, data-protection, law-enforcement, and other legal obligations.
Data
Account data, transaction metadata, legal consent records, support records, audit logs.
Legal basis
Legal obligation under GDPR Article 6(1)(c).
4. Retention Periods
We keep personal data only as long as necessary for the purposes described in this policy.
Typical retention periods
- Active account data: for as long as your account exists.
- Household, inventory, and shopping data: until deleted by you, removed by household controls, or deleted/anonymized after account or household deletion.
- Legal consent records: for as long as necessary to prove acceptance and comply with legal obligations.
- Health or nutrition inputs: until deleted, consent is withdrawn, or your account is deleted, unless retention is legally required.
- Logs and analytics: up to 36 months, unless aggregated, anonymized, or required for security/legal reasons.
- Crash reports: up to 90 days, unless needed for security or investigation.
- Billing and legal records: up to 10 years where required by Romanian fiscal or accounting law.
- Support records: for as long as necessary to handle the request and maintain reasonable business records.
After account deletion, we delete or irreversibly anonymize personal data except where retention is required by law, security, accounting, fraud prevention, dispute resolution, or legitimate audit needs.
5. Sharing and Recipients
We do not sell your personal data!
We may share personal data with the following categories of recipients:
- Cloud hosting and database providers, such as Supabase or similar providers.
- App stores and payment processors, such as Apple App Store, Google Play, RevenueCat, Stripe, or similar providers.
- Email delivery providers.
- Push notification providers, such as Firebase Cloud Messaging or similar services.
- Analytics and crash-reporting providers, if enabled and permitted.
- Support and customer-service tools, if you contact support.
- OAuth/social login providers, such as Google or Apple, where you choose to use them.
- Legal, accounting, security, or compliance providers.
- Public authorities, regulators, or courts where legally required.
Where providers act as processors, we use appropriate contractual safeguards, including data-processing agreements where required.
Where providers act as independent controllers, their own privacy policies apply.
6. International Data Transfers
We aim to process personal data within the European Economic Area where possible.
Where personal data is transferred outside the EEA, we use appropriate safeguards, such as:
- European Commission Standard Contractual Clauses;
- adequacy decisions;
- data-processing agreements;
- technical and organizational safeguards;
- other safeguards permitted under GDPR.
You may contact us for more information about applicable transfer safeguards.
7. Your Rights Under GDPR
Subject to legal conditions and exceptions, you have the right to:
- access your personal data;
- rectify inaccurate or incomplete data;
- erase your data;
- restrict processing;
- receive data portability;
- object to processing based on legitimate interests;
- object to direct marketing;
- withdraw consent at any time;
- not be subject to solely automated decisions with legal or similarly significant effects.
HeyVeggie does not currently make solely automated decisions that produce legal or similarly significant effects.
You can exercise your rights through
- App settings, where available;
- Settings → Privacy / My Data features, where available;
- email: privacy@heyveggie.app.
We respond within one month where required by law, extendable by two additional months for complex requests.
You also have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) or your local supervisory authority.
ANSPDCP
8. Security
We implement appropriate technical and organizational measures to protect personal data, including:
- encryption in transit;
- encryption at rest where supported;
- access controls;
- role-based access;
- secure authentication;
- audit and monitoring controls;
- pseudonymization or minimization where appropriate;
- security testing and updates;
- local-first design where appropriate;
- deletion and erasure workflows.
No system is completely secure. We cannot guarantee absolute security, but we work to protect your data using reasonable and appropriate safeguards.
9. Children’s Data
HeyVeggie is not directed at children under 16.
If we learn that we have collected personal data from a child under the applicable age without valid parental or guardian consent, we will promptly delete that data where required.
10. Legal Documents and Consent
Before creating an account or using certain features, you may be asked to accept our Terms of Service, Privacy Policy, disclaimers, or other legal documents.
We may keep records of your legal-document decisions, including document version, timestamp, locale, and account identifier, to demonstrate compliance and manage updates.
Public legal documents must remain readable before login or account creation.
11. Changes to This Policy
We may update this Privacy Policy to reflect changes in the Service, law, technology, providers, or business practices.
If changes are material, we will notify you in the App, by email, or through another reasonable method where required.
The latest version will be available at
12. Contact Us
For questions, privacy requests, or complaints, contact
Prima Business Control Software Romania SRL
Str. Alexandru Vlahuta 1
Sector 3, Bucharest, Romania
Emails
Website
Thank you for trusting HeyVeggie with your data.