Privacy policy
This policy explains what personal data the Spremli app for Android, its server (api.spremli.com) and the website spremli.com process, why, for how long, and what your rights are under the General Data Protection Regulation (GDPR). The app’s terms of use are on the Terms of use page.
In short
- We process only what the app needs to work: your account and the content you and your household enter.
- We do not sell your data or use it for advertising. The app has no ads and no tracking tools.
- The AI chef sends the content of your request (food items, recipe, photo) to an AI provider — without your name or email address.
- We store a location for price comparison only if you turn it on, rounded to about 100 m.
- You can delete your account and data at any time: Delete account.
Data controller
The data controller is MARACOM d.o.o., Hrvatska, OIB 34214030546. For any privacy question or to exercise your rights, write to info@spremli.com.
What data we process
Account: email address, the name your household sees, password (stored only as a cryptographic hash, never in readable form), app language, time of sign-up, email confirmation and last sign-in, and sign-ins on your devices (device name and time of last use).
Household: name, number of people, members with their role (owner, admin, member, child) and permissions, invitations (invitee’s email address, role, expiry) and an activity log (who added or changed what).
Content you enter: stock (items, quantities, dates, storage), the shopping list with notes and urgency, shopping and usage history, chores, meals, meal plan and votes, recipes with photos, notes, and your notification and daily digest settings.
Bills (optional): payees (name, address, IBAN, payment reference), amounts, due dates and payments, custom bill types, attachments (photo or PDF of a bill) and the content of a scanned payment code. Bills are visible only to members the household owner or an admin has given that permission.
Price comparison (optional, Croatia only): the household location rounded to about 100 m — from your device location or a chosen city — the search radius, selected retail chains and the prices you picked for items. Store prices come from retail chains’ publicly available price lists; your data is not sent to stores.
AI chef (optional): your requests and preferences (e.g. number of people, foods you avoid), the list of food in your stock, the recipe you are discussing and photos you send. On the server we keep AI suggestions and recipes (your request and the answer) and a technical usage record (request type, model, number of tokens) for daily limits and cost. We do not keep photos sent for food recognition or recipe-from-photo, or recipe chat messages, on the server.
Notifications: notifications about dates, chores, bills and shopping are stored on the server and the app fetches them when it syncs. We do not use Firebase Cloud Messaging or any other push service.
Emails: we only send messages needed for your account — email confirmation, password reset links and household invitations — from no-reply@spremli.com. We do not send newsletters or promotional emails without your consent.
Security and technical data: IP address, time and type of request in server logs and error logs. For rate limiting (e.g. sign-in and sign-up attempts), IP address and email are stored only as a hash. Admin actions, such as blocking or deleting an account, are logged with the time and the admin’s IP address.
Subscription (only if you buy one): name or company name, address, country and billing email, tax number for businesses, subscription details and invoices issued. You enter card details directly with Stripe; we never see them. Paid plans are not currently offered.
Website: server logs (IP address, time, page address, browser type) and the cookies described in the cookies section.
Purposes and legal bases
- Performance of a contract (Art. 6(1)(b) GDPR): creating and running your account, the household and sharing content with its members, sync, notifications, account emails, the AI chef, bills and price comparison when you use them, and answering your questions.
- Consent (Art. 6(1)(a)): device location for price comparison (you can choose a city instead) and analytics and marketing cookies on the website. You can withdraw consent at any time; this does not affect processing carried out before.
- Legitimate interests (Art. 6(1)(f)): security and abuse prevention (rate limiting, server logs, admin log), fixing errors and monitoring the cost of the AI service. You may object to this processing.
- Legal obligation (Art. 6(1)(c)): issuing, fiscalising and keeping invoices for paid subscriptions.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. The AI chef’s suggestions are just suggestions.
Who receives data
- Members of your household — they see shared content according to their role and permissions, including your name next to what you added.
- Our hosting provider — runs the API, database, file storage and email sending on its servers, processing data only on our instructions.
- AI provider — depending on server settings OpenAI, Anthropic or Google (Gemini), acting as a processor. We send only what is needed for an answer (food items, recipe, your request, photo), without your name, email address or location. Dish images are generated by OpenAI from the dish name and description. Under these providers’ business API terms, data sent through the API is not used to train models by default, but may be kept for a limited time to prevent abuse.
- Open Food Facts — when you scan a barcode, the server sends only the barcode number to this public product database, and only if the product is not already known.
- OpenStreetMap (Nominatim) — to locate stores we send only store addresses from public price lists, never your location.
- Stripe (subscriptions only) — card payment processing; Croatian Tax Administration — invoice data for fiscalisation, as required by law.
- Google and Meta (website only, and only with consent) — see the cookies section.
- Public authorities — only where the law requires us to.
We do not sell data or share it with advertisers.
Transfers outside the EU
AI providers (OpenAI, Anthropic, Google), Stripe and, with your consent, Google and Meta may process data in the USA or other countries outside the European Economic Area. Such transfers rely on the European Commission’s adequacy decision (EU-US Data Privacy Framework) for certified providers and/or the Commission’s standard contractual clauses. You can request a copy of the relevant safeguards at info@spremli.com.
How long we keep data
- Account and household content — as long as you have an account, or until you or the household owner delete the content.
- Unconfirmed account — deleted automatically after 7 days. A confirmation link is valid for 48 hours, a password reset link for 60 minutes and an invitation for 7 days.
- Sign-in on a device — up to 180 days or until you sign out.
- Notifications — 60 days.
- AI suggestions and dish images — 90 days; recipes you save stay until you delete them.
- Rate-limiting records — up to 24 hours.
- Server and error logs — up to 30 days.
- Admin log — as long as needed for security and to prove that a request (e.g. deletion) was carried out.
- Subscription invoices — 11 years, as required by Croatian tax law; deleting your account does not delete them.
Deleted data may remain briefly in backups until those are routinely replaced.
Phone permissions
- Camera — scanning QR labels, barcodes and payment codes, and photos for recipes, bills and the AI chef. The camera runs only when you open it.
- Approximate location — only when you choose device location in price comparison. We do not track you in the background.
- Bluetooth — printing labels on your printer; that data does not leave your device.
- Notifications — reminders about dates, chores, bills and shopping.
You can deny any permission in Android settings; the app then works without that feature.
Your rights
You have the right to:
- access — a copy of the data we process about you;
- rectification — you can change your name and language in the app; for anything else, write to us;
- erasure (“right to be forgotten”);
- restriction of processing;
- data portability — the data you entered in a machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting processing carried out before.
Send your request to info@spremli.com from the address linked to your account. We will reply within one month; in exceptional cases this may be extended by two further months, and we will let you know.
If you believe the processing of your data breaks the law, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr, or with the supervisory authority in the country where you live.
Deleting your account
You can delete your account yourself in the app: More → Settings → Profile → Delete account (confirmed with your password); the deletion happens immediately and we confirm it by email. If you no longer have the app, request deletion by email from the address linked to your account — instructions are on the Delete account page; we carry out such requests within 30 days at the latest.
We delete your email, name, password, device sign-ins, notifications and personal settings. Households where you are the only member are deleted in full, with all content and files. In households with other members, shared content stays for them and shows “Deleted user” instead of your name; if you were the owner, ownership passes to another member.
In the app you can also leave a household yourself, and the owner or an admin can permanently delete selected household data (Settings → Delete data).
We keep only what we must: invoices for paid subscriptions (11 years) and a record in the admin log that the deletion was carried out.
Children
Spremli is intended for people aged 16 and over. Children under 16 may use the app only as members of a household run by a parent or guardian, with their consent, in the “Child” role with limited permissions (by default no bills, AI chef, price comparison or inviting members).
If we learn that a child under 16 has opened an account without parental consent, we will delete it. Parents or guardians can contact us at info@spremli.com.
Security
The connection between the app and the server is encrypted (HTTPS). Passwords and device sign-ins are stored only as cryptographic hashes, and household data is accessible only to its members according to their permissions. Only an authorised person has access to the administration, with limited sign-in attempts.
If a personal data breach nevertheless occurs that could put your rights at risk, we will notify AZOP and, where required, you.
Changes to this policy
We update this policy when the app or the law changes. The date of the last update is shown at the top. We will tell you about important changes in the app or by email before they take effect.