MyPantry AI (“we”, “us”, “our”) operates the My Pantry AI pantry and AI meal-planning service at mypantryai.com.au (the “Service”). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have. It has been prepared to comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA/CPRA) where applicable.

1. Who we are and how to contact us

MyPantry AI is an Australian-owned company helping households reduce food waste and simplify meal planning with AI, including pantry management and grocery organisation.. If you have any question about this policy or wish to exercise a data right, contact us at info@mypantryai.com.au. We aim to respond within 3 business days.

2. Information we collect

2.1 Information you give us

Account data — when you sign in with Google via the Emergent Authentication service: your email address, name, profile picture, and a stable Google account identifier.
Pantry data — items you add to your pantry (name, quantity, category, optional expiry date, low-stock flag) and any AI-suggested meals or weekly plans you save.
Images you upload — photos submitted to the AI Food Scanner (barcode / nutrition label / food / fridge). These are transmitted to our AI vision provider (Anthropic) for analysis and are not permanently stored by us.
Support messages — anything you write to us via the contact form or by email.

2.2 Information collected automatically

Session cookie — an HttpOnly cookie (`session_token`) storing your authenticated session. See our Cookie Policy.
IP address & approximate location — used once per session to detect your country and display prices in your local currency (via a lookup to ipapi.co). The IP is cached in memory for up to 24 hours; we do not create a persistent profile from it.
Browser/user-agent string — logged only when you submit the contact form, for spam prevention.

2.3 Information from third-party processors

When you subscribe or make a payment, our payment providers (Stripe, PayPal) collect your billing details directly. We receive from them only a customer identifier, subscription status, last-4 of card, country, and payment currency — we never see or store your full card number, CVC, or bank credentials.

3. How we use your information

To operate and maintain your account and pantry.
To generate AI meal suggestions, weekly plans, ingredient substitutes, meal photos, and food-scan results.
To process subscriptions and payments and to keep your Premium status accurate.
To communicate with you about your account or in response to a request.
To detect, prevent and address technical issues, abuse and fraud.
To comply with legal obligations.

4. Legal bases for processing (GDPR / UK GDPR)

Performance of a contract — providing the Service you signed up for.
Legitimate interest — securing the Service, preventing abuse, minimal analytics.
Consent — where required (e.g., non-essential cookies, marketing emails if introduced).
Legal obligation — tax, accounting, responding to lawful requests.

5. Who we share information with (sub-processors)

We use the following third parties strictly to deliver the Service. We do not sell your personal information.

Emergent — hosting, authentication (Google sign-in), and AI gateway.
Anthropic — meal suggestions, substitutes, and image analysis for the food scanner.
OpenAI — meal suggestions and image analysis.
Google — AI-generated meal images.
Stripe — card payments and subscription billing.
PayPal — PayPal subscriptions and one-time orders.
MongoDB (via Emergent-hosted database) — primary application data store.
ipapi.co — IP-to-country lookup for currency detection.
Open Food Facts — public product database used to enrich barcode scans.

6. International transfers

Because our AI providers and payment providers operate globally, your personal information may be transferred to, stored, and processed in the United States, the European Economic Area, and other countries. Where required by law (e.g., for EU/EEA users) these transfers rely on Standard Contractual Clauses or equivalent safeguards published by the sub-processor.

7. Data retention

Account and pantry data — kept while your account is active. Deleted within 30 days of a verified deletion request.
Scan images — not persistently stored. Streamed to the AI provider and discarded after inference.
Meal history — up to the most recent 20 generations per user.
Payment records — retained for the period required by Australian tax law (currently 5 years) and Stripe / PayPal record-keeping rules.
Contact form messages — retained up to 24 months for support and audit purposes.
Server logs — retained no longer than 90 days.

8. Your rights

Depending on where you live you have some or all of these rights: to access, correct, delete, restrict or object to processing, port your data to another service, and withdraw consent. To exercise any of them, email info@mypantryai.com.au and we will respond within 3 business days. If you are in the EU/EEA/UK you also have the right to lodge a complaint with your local supervisory authority. Australian users can contact the Office of the Australian Information Commissioner (OAIC).

9. Security

We use HTTPS in transit, HttpOnly secure cookies, cookie-only authentication with no bearer-token fallback, encrypted storage at rest via our database provider, least-privilege access, and periodic dependency updates. No system is 100% secure — please use a strong, unique password on your Google account.

10. Children

The Service is not intended for children under 13, and under 16 in the EU/EEA/UK. We do not knowingly collect information from children under those ages. If you believe we have, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be signalled by updating the “Effective” date and, where required, notifying you by email or in-app banner.

12. Complaints

If you are unhappy with our handling of your information, contact us first at info@mypantryai.com.au. Australian users can then escalate to the OAIC (oaic.gov.au). EU/EEA/UK users can contact their national data-protection authority.