Privacy Policy

1. Who we are

The data controller responsible for your personal data is:

"Holo Fridge," "HoloFridge," and "Holo" refer to the product operated by BML BIG, MB ("we," "us," "our," or "the Company").

2. Definitions

• "Personal Data" / "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to you or your household.
• "Sensitive Data" includes categories treated as sensitive under applicable law (such as precise geolocation, biometrics used for identification, certain health data, children's data, or other protected categories).
• "Process" means any operation performed on data (collecting, storing, using, disclosing, analyzing, deleting, etc.).
• "AI" means automated systems or models that can analyze inputs and generate outputs (for example, recipe suggestions, food usage suggestions, and personalization).

3. Information we collect

We collect information depending on how you use the Service and what features you enable.

Information you provide directly

• Account information: name, nickname/username, email, phone number (optional), password (stored as a secure hash), language, region, and preferences.
• User content: food inventory entries, shopping lists, notes, recipes you save, meal plans, and other content you enter into the Service.
• Images and media (optional): photos/videos you upload or capture (for example, food items, fridge images, receipts, barcodes) and related metadata.
• Voice input (optional): if you use voice features, your voice input is processed to convert it to text so the Service can act on it. Voice recordings are not used for identification and are not retained longer than needed to provide the feature.
• Communications: messages to support, feedback, survey responses, and attachments you provide.

Information collected automatically

• Device and network data: device model, operating system, app version, browser type (if web), IP address, time zone, language settings, and network provider.
• Identifiers: device identifiers, mobile advertising identifiers (if enabled by your platform settings), cookies or similar technologies (for web).
• Usage and diagnostics: screens viewed, feature interactions, clicks/taps, performance metrics, crash reports, log data, and approximate location derived from IP.

Permissions-based information (only if you allow it)

• Camera/photos: to scan or upload images.
• Microphone: for voice input features.
• Notifications: to send you push notifications (see Section 4).
• Location: precise location, only if a location-based feature is enabled.

You can withdraw permissions in your device settings at any time. Some features may not work without required permissions.

Children's data

The Service is not directed to children under 13, or under the higher minimum age of digital consent in their jurisdiction. We do not knowingly collect personal data from such children. If we learn that we have collected personal data from a child without required consent, we will delete it and take reasonable steps to prevent recurrence.

4. How we use information

Provide and operate the Service

• Create and manage accounts.
• Provide core functionality (inventory, lists, syncing, saved recipes, shared family groups).
• Maintain preferences and settings.

Personalization and recommendations

Recommend recipes, food usage ideas, shopping suggestions, or organization tips based on your inventory and preferences.

AI features

Some features use AI to analyze user-provided information and generate recommendations. For example:

• Analyzing text you enter to suggest recipes or usage.
• Analyzing images you provide to help identify items and generate suggestions.

We use third-party AI providers to power these features. When we do:

• Your inputs are shared with the provider only to generate the response for you.
• Our AI providers are contractually restricted from using your content to train their models.
• We apply contractual and technical safeguards appropriate to the data and risk.

Who receives data for AI features

Depending on the feature, your inputs are processed by the following providers, acting on our instructions:

• OpenAI, L.L.C. (USA) — voice transcription (Whisper); text and image analysis (GPT models)
• Google LLC (USA) — image recognition, text extraction from photos and receipts, and barcode reading (Cloud Vision); text analysis and recipe generation (Gemini models)
• Groq, Inc. (USA) — used as a fallback for chat and voice transcription when a primary provider is unavailable

What is sent: only the content required for the feature — the photo you scan, the voice input you record, the text you type, the relevant item names from your inventory, and any dietary preferences or allergies you have set, where the feature needs them to give you a safe answer. We do not send your account name, your email address, or your account identifiers. Anything you type into a conversation is sent as you wrote it, so if you tell Holo your name it is processed like any other message. Each provider is contractually restricted from using your content to train its models and is bound to protections equal to this Policy.

You can avoid using AI features by not submitting content to those features or by disabling AI-related features in Profile → Account.

Push notifications

With your permission, we send push notifications such as expiry alerts for your food items, meal suggestions, and daily summaries. You can turn notifications off at any time in your device settings or in the app's notification settings.

Safety, security, and integrity

Detect and prevent fraud, abuse, and unauthorized access.

Communications

Service messages (security alerts, account notices, updates) and support responses.

Marketing (optional)

Send promotions or product updates where permitted by law. You can opt out at any time.

Legal compliance

Comply with laws, regulations, and lawful requests.

5. Legal bases

Depending on your location, we process personal data under one or more legal bases:

• Contract necessity (to provide the Service you request).
• Consent (for optional features like precise location, voice input, certain tracking, marketing, and some AI features).
• Legitimate interests (to secure and improve the Service, prevent fraud), balanced against your rights.
• Legal obligations (compliance and recordkeeping).
• Vital interests (rare emergency situations).

6. How we share information

Shared family groups: if you join or create a shared group, other members of that group can see the content you add to shared features — for example, items you add to shared lists, inventory in shared spaces, and attribution such as "Added by you/[name]." Do not join a group with people you do not want to share this information with. You can leave a group at any time in Settings.

Service providers: we share information with vendors that help us operate the Service (cloud hosting and database, AI providers, analytics, payment processors, email delivery, etc.). They process data on our instructions and are bound by contractual safeguards.

Legal and safety disclosures: we may disclose information to comply with law, enforce our agreements, or protect rights, safety, and security.

Corporate transactions: information may be transferred as part of a merger, acquisition, or similar transaction. We will provide notice where required by law.

With your direction: we share information when you ask us to (for example, exporting or sharing lists).

We do not sell your personal data.

7. International data transfers

We may process and store information in countries other than where you live, including outside the European Economic Area. Where we do, we use safeguards required by applicable law for cross-border transfers, such as the European Commission's Standard Contractual Clauses or transfers to countries with an adequacy decision.

8. Data retention

We retain information only as long as necessary:

• Account data: retained while your account is active; deleted after account deletion, subject to the exceptions below.
• AI inputs and outputs: retained only as long as needed to provide the feature and support troubleshooting.
• Logs and diagnostics: retained for limited periods for security and debugging.
• Backups: retained on a rolling basis and overwritten in the normal backup cycle.

Deletion may be delayed where technically necessary (for example, backup cycles) or where retention is required by law.

9. Security

We implement reasonable technical and organizational safeguards to protect information:

• Encryption in transit (TLS/HTTPS) and protective measures for stored data.
• Access controls and least-privilege policies.
• Monitoring, logging, and incident response procedures.

No system is 100% secure. You are responsible for protecting your account credentials.

10. Your privacy rights

Where applicable, you may have rights to:

• Access: request a copy of your personal data.
• Correction: correct inaccurate or incomplete data.
• Deletion: delete your personal data (with legal exceptions).
• Portability: receive your data in a structured, commonly used format.
• Restriction and objection: restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, without affecting prior processing.
• Opt out: of "sale" or "sharing" of personal information where such rights apply (we do not sell personal data).

How to exercise rights

• In the app (deletion and withdrawing AI consent): Profile → Account
• Email (access, correction, portability, and any other request): privacy@holofridge.com

You can delete your account and all associated data yourself at any time — see holofridge.com/delete-account.

We respond within the timeframes required by applicable law. We may need to verify your identity before fulfilling a request.

You also have the right to lodge a complaint with a supervisory authority. In Lithuania, this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). If you live elsewhere in the EU/EEA, you may contact your local data protection authority.

11. Language

This Policy is drafted in English. Translations are provided for convenience only. In case of any discrepancy, the English version prevails, except where mandatory local law requires otherwise.

12. Changes to this Policy

We may update this Policy from time to time. If changes are material, we will provide notice (for example, in-app notice or email) before they take effect.

13. Contact

For privacy questions, requests, or complaints: