Privacy Policy

1.Scope and Applicable Legal Framework

This Policy applies to all personal information collected from users in all territories where the Service is made available. Cabas is committed to complying with all applicable data protection laws, including:

• United States: Children's Online Privacy Protection Act (COPPA); California Consumer Privacy Act (CCPA); applicable federal and state privacy laws;

• Canada: Personal Information Protection and Electronic Documents Act (PIPEDA); Quebec: An Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64);

• France & the European Union: General Data Protection Regulation (GDPR) (EU) 2016/679; French Data Protection Act (Loi Informatique et Libertés); CNIL guidelines and decisions.

2.Identity of the Data Controller

3.Personal Information We Collect

3.1 Information You Provide Directly

• Identity and contact data: full name, email address, phone number (where provided), age range;

• User-generated content: shopping lists, items, quantities, priority tags, notes, inventory data, recipes, and ingredient lists;

• Support communications: messages and attachments submitted to our support or legal team.

3.2 Information Collected Automatically

• Device and technical data: device type, model, operating system, unique identifiers, mobile network information;

• Usage and behavioral data: features accessed, screens viewed, session duration, in-app navigation patterns;

• Log data: IP address, access timestamps, error and crash logs.

3.3 Location Information

With your express prior consent, the Service may collect your approximate or precise location to provide location-based features. Location access is entirely optional and may be revoked at any time through your device's operating system settings without affecting core Service functionality.

3.4 Cookies and Tracking Technologies

The Service may use cookies, SDKs, pixel tags, and similar technologies to recognize your device, store preferences, and analyze usage patterns. These may be managed through your device or in-app settings. Disabling certain technologies may limit Service functionality.

4.Legal Basis for Processing (EU & France)

We process your personal data for the following reasons:

To run the Service: we need your data to create your account, deliver features, and manage your subscription. (Art. 6(1)(b) GDPR - performance of a contract)

To improve and protect the Service: we use data to make Cabas better, prevent fraud, and keep the platform secure. (Art. 6(1)(f) GDPR - legitimate interests)

To meet legal requirements: some data must be retained to comply with financial recordkeeping and government obligations. (Art. 6(1)(c) GDPR - legal obligation)

With your permission: for marketing emails and non-essential cookies. You can withdraw your permission at any time without affecting prior processing. (Art. 6(1)(a) GDPR - consent)

5.How We Use Your Personal Information

• To provide, operate, maintain, and improve the Service and its features;

• To process and manage subscription billing and payment verification;

• To verify that users meet the minimum age requirement of 16 years at registration;

• To personalize your experience and generate relevant product recommendations;

• To send essential service communications (receipts, security alerts, account notices);

• To send promotional communications, only with your prior consent, withdrawable at any time;

• To detect, investigate, and prevent fraudulent transactions and Terms violations;

• To comply with applicable legal obligations and respond to lawful governmental requests.

6.Data Analytics & Service Improvement

To provide, maintain, and improve the Service, Cabas collects and processes certain usage data generated through your interactions with the Service. This may include, without limitation, engagement patterns, feature usage frequency, content preferences, and behavioral signals within the application. Such usage data is analyzed in aggregate and anonymized form solely for internal purposes - to enhance service functionality, improve user experience, and inform our product roadmap. This analysis is conducted entirely in-house.

Cabas does not sell, license, rent, trade, or otherwise share any user data - individual or aggregated, identifiable or anonymized - with any third party for their independent use, marketing purposes, or commercial gain. This commitment applies without exception during the current stage of our Service. Should Cabas's data practices change in the future, we will update this Privacy Policy in advance, notify all users directly, and where required by applicable law, obtain renewed consent before any such change takes effect.

7.Disclosure and Sharing of Personal Information

7.1 We Do Not Sell or Share Your Data

Cabas does not sell, rent, license, trade, or otherwise commercially disclose your personal information - individually or in aggregate - to any third party, in any territory where we operate.

7.2 Authorized Service Providers

We share information only with vetted third-party processors who are strictly necessary to operate the Service, bound by written data processing agreements that prohibit any independent or commercial use of your data:

• Payment processors (Apple Pay, Google Pay) - subscription billing;

• Cloud infrastructure providers — data hosting and delivery;

• Analytics platforms - App performance and crash reporting only;

• Customer support tools - user support operations;

• Email delivery services - transactional and marketing communications.

7.3 Business Transfers

In a merger, acquisition, or asset sale, your data may be transferred to the acquiring entity. You will be notified in advance and, where required by applicable law, your consent will be obtained.

7.4 Legal Disclosures

We may disclose personal information where required by applicable law, court order, or governmental authority, or where necessary to protect the rights, property, or safety of Cabas, its users, or the public.

8.International Data Transfers

Cabas infrastructure is primarily located in the United States. Users accessing the Service from Canada, France, or the EU should be aware that their data may be transferred to and processed in the United States. Where required by GDPR, such transfers are conducted pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms recognized under applicable law.

9.Account Deletion and Data Retention

9.1 How to Delete Your Account

• In-App: Profile → Settings → Account → Delete Account. Deletion is immediate and irreversible.

• Support Request: Email [email protected] with subject “Account Deletion Request” including your registered email address. Requests processed within 30 days.

Upon deletion, your profile, shopping data, inventory, recipes, and preferences are permanently removed from active systems. Confirmation will be sent by email.

9.2 Post-Deletion Retention

• Encrypted backup archives: up to ninety (90) days, after which permanently purged;

• Financial and transaction records: seven (7) years per applicable accounting and tax regulations;

• Legal hold data: for the duration of any active legal proceedings or regulatory investigation;

• Aggregated, anonymized analytics: retained indefinitely for internal use only, as this data cannot identify any individual.

10.Data Security

We take the security of your information seriously. Your data is encrypted when it travels between your device and our servers, and again when it is stored. Access to your data within Cabas is strictly limited to team members who need it to do their job. We regularly test our systems for vulnerabilities to stay ahead of potential threats.

While we implement robust safeguards, no system is completely risk-free. In the event of a security incident that materially affects your data, we will notify you and the relevant supervisory authorities as required by applicable law and within the timeframes prescribed by GDPR, CCPA, and other applicable regulations.

11.Territory-Specific Privacy Rights

Depending on where you live, you may have certain rights over your personal data. These include the right to access, correct or delete your information as well as the right to limit or object to how we use it.

California residents may request details about what personal data we collect, how it is used, and with whom it is shared. Cabas does not sell or share your personal data with any third party. You have the right to non-discrimination for exercising your privacy rights.

Quebec residents have additional rights under Law 25, including data portability and the right to request that automated decisions made about you be explained and reviewed by a human.

EU and France residents have the full range of rights under GDPR (Articles 15–21), including access, rectification, erasure, restriction, portability, and objection. You may also withdraw consent at any time without affecting the lawfulness of prior processing. You have the right to lodge a complaint with your national supervisory authority. In France, that is the CNIL at cnil.fr.

To exercise any right or make any request, email [email protected] We will respond within 30 days or as required by applicable law. Identity verification may be required before we process your request.

12.Children's Privacy

The Cabas Service is intended exclusively for users who are 16 years of age or older. This uniform minimum age applies across all territories - including the United States, Canada, France, and the European Union - and ensures compliance with COPPA, PIPEDA, Law 25, and GDPR Article 8 simultaneously. We do not knowingly collect personal information from anyone under 16. If you believe a user under 16 has accessed the Service or provided personal data, please contact [email protected] immediately. Upon confirmation, we will promptly delete the relevant data and close the account.

13.Changes to This Privacy Policy

We may update this Policy periodically to reflect changes in our practices, legal requirements, or business operations. Material changes - including any future change to our data sharing practices - will be communicated by email and in-app notification with at least thirty (30) days notice for existing users. Where required by GDPR or Law 25, we will obtain renewed consent for changes that materially affect how we process your personal data. Continued use of the Service after the effective date of any update constitutes acceptance of the revised Policy.

14.Contact