ShopNChef

Privacy Policy

Version 1.0Effective July 25, 2026Last updated July 25, 2026

This Privacy Policy explains how ShopNChef, Inc. (“ShopNChef,” “we,” “us”) collects, uses, shares, and protects personal information when you use the ShopNChef apps, website, and services. We are the controller of your personal information.

1. Information we collect

We collect the following categories of information:

  • Account and profile information — name, email address, username, password credentials (stored by our identity provider, not by us in plaintext), and profile preferences.
  • Dietary and allergy information — dietary restrictions, allergies, and cooking preferences you choose to provide so we can tailor recipes and grocery matches. This may include health-related data, which we process only with your consent.
  • Location information — approximate or precise location (with your permission) to find nearby stores and estimate delivery. When you tap “use current location,” your device coordinates are sent once to our maps provider (OpenStreetMap) solely to translate them into a city, state, and ZIP code. We do not use your location for advertising and do not sell it.
  • Transaction information — grocery orders, Marketplace purchases and sales, subscription status, and limited payment tokens and metadata from our payment processor. We never receive or store your full payment card number.
  • Content — recipes, notes, photos, and ratings you create or share.
  • Device and usage information — device type, operating system, app version, identifiers, log data, and analytics about how you use features, used to operate, secure, and improve the Service.

2. How we use information

We use personal information to:

  • provide, operate, and maintain the Service and your account;
  • personalize recipe suggestions and match ingredients to products, including through machine-learning services;
  • process grocery orders, subscriptions, and Marketplace transactions;
  • communicate with you about your account, transactions, and (with consent) marketing;
  • maintain safety and security, prevent fraud, and enforce our policies; and
  • comply with legal obligations.

3. Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract (operating your account and completing transactions); consent (marketing communications and processing of dietary/allergy health data — which you may withdraw at any time); legitimate interests (securing the Service, preventing fraud, and improving our products); and legal obligation (retaining records the law requires us to keep).

4. How we share information

We do not sell your personal information. We share information only as needed to run the Service, with the following categories of recipients (sub-processors):

  • Amazon Web Services (AWS) — cloud hosting, storage, database, and search infrastructure.
  • Amazon Bedrock — machine-learning models used for recipe understanding and ingredient matching.
  • Stripe, Inc. — payment processing and Marketplace payouts. Stripe handles card data under PCI DSS; we never store raw card numbers.
  • Grocery partners (e.g., Kroger) — to find stores, match products, and fulfill orders. We share only the store and product data needed to fulfill an order; we do not send them your dietary/allergy profile.
  • OpenStreetMap Foundation (Nominatim) — when you choose to use your current location, we send your coordinates once to convert them into a city, state, and ZIP code (reverse geocoding). We do not send any account identifiers, and this is used only to help you find nearby stores.

We may also disclose information to comply with law, enforce our terms, or protect the rights, safety, and security of our users and the public. If we undergo a merger or acquisition, information may be transferred subject to this Policy.

5. Social media recipe import (Instagram & TikTok)

You can import a recipe from an Instagram or TikTok post you choose to share into the app. This feature processes only content you provide or own — we do not scrape, crawl, or bulk-collect arbitrary third-party posts, and we comply with the Instagram Platform Terms and TikTok Developer Terms.

  • What we fetch. When you share a post link, we detect the platform and resolve the link to its canonical URL. For TikTok we may call TikTok’s public oEmbed endpoint to retrieve limited, publicly available metadata — the post title, author name, thumbnail image, and the platform’s embed code. Public oEmbed does not provide the full caption text or a downloadable video. Instagram import that reads a post’s content is available only after the relevant platform approvals and, where required, your authorization to your own account; until then, Instagram import relies on the video you upload or share.
  • Only your or owned content. Because no official API returns another creator’s raw video by link, the actual media you extract a recipe from comes from you — the video you share or upload from your device. Any caption text you paste or send is provided by you.
  • How we use it. The shared link, any public metadata, and the media you provide are used solely to generate a draft recipe for your review (via the same recipe understanding described in “How we share information” above, using Amazon Bedrock, Amazon Transcribe, and Amazon Textract on AWS).
  • Retention. Caption text you provide is used transiently for extraction and is not stored on the import job record. Uploaded video follows the same retention as other video imports: raw uploads are automatically expired shortly after processing, and the resulting draft recipe is stored in your account until you delete it (see “Data retention”).

6. Data retention

We keep personal information only as long as needed for the purposes described here. Account data is retained while your account is active. When you delete your account, we begin a 30-day recovery window, after which we permanently purge your data from our databases, file storage, search indexes, and identity provider. We retain a minimal, immutable consent-audit log where the law requires us to demonstrate compliance, and we retain transaction records for the period required by tax and accounting rules.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can access, update, export, or delete most of your data directly in the app (Settings → Privacy & Security). To exercise any right, contact privacy@shopnchef.com. We will not discriminate against you for exercising your privacy rights.

8. Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the purposes for collection, and the categories of third parties with whom we share it; to request deletion; and to correct inaccurate information. We do not sell or share your personal information as those terms are defined under California law, and we do not process it for cross-context behavioral advertising. We nonetheless provide a “Do Not Sell or Share My Personal Information” choice for transparency — because we do not sell or share, no opt-out action is required, but you may contact us with any request. You will receive equal service and pricing regardless of the privacy choices you make.

9. International data transfers

We operate globally and use AWS infrastructure that may replicate data across regions, including outside your home country. Where we transfer personal data internationally, we rely on appropriate safeguards, including AWS’s Data Processing Addendum and Standard Contractual Clauses. For more information on AWS’s compliance program, see AWS’s GDPR resources and the AWS Data Processing Addendum.

10. Cookies (website)

Our website uses cookies and similar technologies. Essential cookies are required for the site to function; non-essential cookies are used only with your consent. For details and controls, see our Cookie Policy.

11. Children’s privacy

Our Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected such information, we will terminate the account and delete the data promptly. If you believe a child has provided us information, contact privacy@shopnchef.com.

12. Security

We use administrative, technical, and organizational measures — including encryption in transit and at rest, access controls, and monitoring — to protect personal information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected in the version number and effective date above, and, where required, we will ask you to re-accept before continuing to use the Service.

14. Contact us

For privacy questions or to exercise your rights, email privacy@shopnchef.com or write to ShopNChef, Inc., 3716 Jetson Way, Austin, TX 78723, United States.