Privacy Policy

The controller responsible for processing your personal data is Ferreira Cruz Digital, Inhaber Artur Ferreira Cruz, Unterwasserstrasse 1, 6260 Reiden LU, Switzerland. For any privacy question or to exercise your rights, contact artur@ferreiradigital.ch.

We process the following categories of data:

• Account data: name, email address, and authentication identifiers, handled by our authentication provider (Clerk).
• Household content: inventory items, shopping lists, recipes, and household membership — the data you create by using the product.
• Usage & device data: pages viewed, features used, approximate interactions, browser/device type, and similar technical signals (only if analytics are enabled — see section 5).
• Communications: household invitation emails and messages you send us for support.
• Legacy beta and feedback data: application email, household size, selected problem, optional application note, invitation state, activation milestones, consent versions, and feedback previously submitted through the beta programme.
• Food-related data: product, recipe, expiry, allergy, and nutrition information you choose to enter. This can reveal sensitive preferences, so household members should only add information they are entitled to share.

• To provide the service and your account — performance of a contract.
• To import a recipe from a URL you submit — performance of a contract.
• To send household invitations you request — performance of a contract.
• To keep the service secure, prevent abuse, and improve it — legitimate interest.
• To close and retain legacy beta records for the periods below and honour earlier entitlements — performance of the earlier agreement and legitimate interest.
• To send optional product marketing — consent. Declining has no effect on your application.
• To understand product usage via PostHog — explicit consent only.

When a recipe page does not contain usable structured recipe data, the page content and source URL may be sent through OpenRouter to extract the recipe you requested. We do not send your household inventory with that request. Always review an imported recipe before saving or cooking it.

Tevori uses a PostHog Cloud EU project, hosted in Frankfurt, only after you explicitly allow analytics. Autocapture and session replay are disabled. We capture pageviews, pageleaves, and a small allow-listed event catalogue using opaque internal user and household identifiers. We do not send names, emails, household names, products, shopping contents, recipe URLs, barcodes, written feedback, query strings, or invitation tokens to PostHog.

You can withdraw consent at any time. Withdrawal resets the local analytics identity and prevents further event capture.

We rely on the following categories of providers, who process data on our behalf under appropriate agreements:

• Authentication & identity (Clerk)
• Application database & backend hosting (Convex)
• Application hosting and delivery (Vercel)
• Product gateway and response cache (Cloudflare)
• Recipe import processing (OpenRouter)
• Transactional email (Resend)
• Consent-based product analytics in PostHog Cloud EU (Frankfurt)
• Product reference data from Open Food Facts, whose database is licensed under ODbL and whose product images are licensed under CC BY-SA. Lookups involve product barcodes/names, not your identity. Tevori does not import retailer catalogs.

Some providers may process data outside Switzerland or the EU/EEA. Where this happens, we rely on appropriate safeguards (such as adequacy decisions or standard contractual clauses) to protect your data. PostHog analytics are processed in its EU cloud region; analytics remain optional and use only the limited event data described above.

• Pending, declined, and expired legacy beta applications: deleted or anonymised within 90 days after the public-launch migration.
• Accepted applications, legal acceptances, account, and household content: while the account is active, then deleted or anonymised within 30 days after a verified deletion request unless a legal duty requires longer retention.
• Written legacy beta feedback: deleted or anonymised within 180 days after the public-launch migration.
• Security and operational logs: normally up to 30 days, longer only when needed to investigate an incident.
• PostHog event data: no longer than 12 months; it remains subject to the consent choice above.
• Marketing consent records: until withdrawal plus the minimum record needed to prove that withdrawal was honored.

Subject to applicable law, you have the right to access, rectify, delete, and restrict processing of your personal data, to data portability, and to object to certain processing. You may also withdraw consent at any time without affecting prior processing. To exercise any right, contact artur@ferreiradigital.ch. You also have the right to lodge a complaint with your competent data protection authority (in Switzerland, the FDPIC; in the EU, your national authority).

We use strictly necessary cookies and local storage to keep you signed in and to remember preferences (for example your theme). Where analytics are enabled, additional identifiers may be set as described above.

We may update this policy as the product evolves or legal requirements change. Material changes will be reflected by updating the date at the top of this page.

Send a request from your account email to artur@ferreiradigital.ch. We may request proportionate identity verification. We aim to acknowledge requests promptly and complete ordinary access, export, correction, or deletion requests within 30 days, subject to applicable law.

Suspected personal-data incidents are documented, contained, assessed, and notified to affected people and authorities where the applicable law requires it.