Privacy policy

1. Who is responsible

The data controller is João Bianchi Aguiar, the maker of Buxo, based in Portugal. Contact for anything privacy-related: privacy@buxopantry.com.

2. What we collect

• Account: email, name (if you give one), hashed password or Google account identifier, preferred language.
• Receipts and bills: the photo you send and what we extract from it — shop, date, products, quantities and prices.
• Pantry, shopping lists and household: the products, quantities and the people you invited to your household.
• Restaurant spending: amount, date and place of the bills you scan.
• Notifications: your device’s push identifier, if you allow alerts.
• Crash reports: technical information about app errors (device model, version, stack trace), without the content of your receipts.
• Subscriptions: if you subscribe to Premium, the subscription status (never card details, which stay with Google or Apple).
• Waitlist: email, language and the date you consented.
• Website: aggregate visit statistics, with no cookies and without identifying visitors.

3. Why we use it, and on what basis

• To provide the service you asked for — reading receipts, keeping your pantry and lists, sharing with your household, sending alerts (performance of a contract).
• To keep the service safe and working — usage limits, abuse detection, fixing errors (legitimate interest).
• To invite you to the beta and send launch news, if you joined the waitlist (consent, which you can withdraw at any time).
• To meet legal obligations, such as tax rules once there are payments (legal obligation).

We do not sell personal data, we do not run targeted advertising and we do not use your data to train AI models.

Product prices (with no link to you) may be used in aggregate for price comparison between shops.

4. Who we share it with

We use these processors, each only for its own task and under a data processing agreement:

• Supabase — database, sign-in and photo storage (servers in Ireland, EU).
• Anthropic — AI reading of receipt text (USA). Anthropic does not train models on this data and deletes it after processing, apart from limited retention for safety.
• Google — Sign in with Google and Android notifications (Firebase Cloud Messaging).
• Expo — the push notification service for the app.
• RevenueCat — management of Premium subscriptions.
• Sentry — app crash reports.
• Vercel — hosting of this website and cookie-free visit statistics.

Where data leaves the European Economic Area, the transfer relies on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.

Members of your household see the shared pantry and lists, but not your receipts or your restaurant spending.

5. How long we keep it

• Receipt and bill photos: deleted automatically 90 days after they are read.
• Account data, pantry, lists and history: for as long as the account exists. When you delete the account they are deleted immediately.
• Waitlist: until the public launch or until you ask to leave, whichever comes first.
• Crash reports: 90 days.

6. Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing, and to receive it in a portable format. In the app, under Settings, you can export all your data and delete your account without contacting us.

For any other request, or to leave the waitlist, email privacy@buxopantry.com. We reply within one month.

If you think your data is not being handled properly, you can complain to the Portuguese data protection authority (CNPD, www.cnpd.pt).

7. Security and children

Data is encrypted in transit and at rest, and each person can only access the data of their own account and household. Buxo is meant for people aged 16 and over.

8. Changes

If we change this policy in a meaningful way, we will tell you in the app or by email before the change takes effect.