Privacy Policy

Version: February 2026

This privacy policy describes how the IN MY FRIDGE service (the Telegram bot "IN MY FRIDGE") collects, uses and protects users' personal data. It is drafted with regard to Regulation (EU) 2016/679 (GDPR) and applicable national data protection laws.

1. Who we are (data controller)

The data controller is the operator of the IN MY FRIDGE project: KORABLEVA SOFYA, NIF Z1314086D, Barcelona, Spain. Email: breathespace09@gmail.com

The service is provided via a Telegram bot; storage and processing take place on servers located in the European Union (Germany, Contabo hosting).

2. What data we process

Category	Description	Basis
Telegram identifier	Numeric `user_id` assigned to the user in Telegram	Necessary for access to the Bot and profile linking (contract)
Profile	Country and interface language chosen at onboarding	Localisation and billing by country (contract)
Subscription and usage	Current plan (Free / Lite / Standard / Max), recipe count per billing period, request dates, subscription status, registration date	Service provision, limits, billing (contract)
Referral programme	"Who invited whom" link, referral Stars balance, bonus records	Performance of referral terms (contract/consent)
Photos	Images sent by the user to the Bot (photos of products/fridge)	Sent to a third-party service for ingredient recognition; we do not store photos on our servers permanently — only temporary transfer to the API
Technical data	Last request time, access logs to the extent needed for operation and security	Legitimate interest (operation, security)

We do not store chat message history — only data needed for plans, limits and the referral programme.

3. Purposes of processing

Providing access to the Bot and delivering the service (ingredient recognition, recipe generation, plan limits).
Determining country and language for pricing and interface.
Managing subscription, counting recipe usage, activating paid features.
Running the referral programme: linking invitees, crediting Stars bonuses, displaying balance.
Processing payments (via Stripe and/or Telegram Stars) — to the extent required by payment providers.
Security, abuse prevention, technical support.
Improving the service (analytics in anonymised/aggregated form where applicable).

4. Legal basis (GDPR)

Art. 6(1)(b) GDPR — contract: user ID, profile, subscription data and counters are necessary for the service.
Art. 6(1)(a) GDPR — consent: where we rely on consent (e.g. additional analytics, optional features), it is requested separately; tapping the payment button and using the Bot after reading the consent document constitutes consent for processing as described in this policy and the consent text.
Art. 6(1)(f) GDPR — legitimate interest: security, abuse prevention, technical operation.

5. Disclosure to third parties and international transfers

Personal data may be disclosed to:

Recipient	Role	Data	Location	Safeguards
Contabo	Hosting (server, DB)	All data stored in the Bot	EU (Germany)	Data in EU
Anthropic	Image recognition and text generation	Photos and text prompts	USA	EU-US Data Privacy Framework and/or SCCs
Stripe	Payment provider	User ID, payment session data, amount	EU/USA	Per Stripe terms and applicable law
Telegram	Telegram Stars payment	User ID, payment linking	Per Telegram infrastructure	Per Telegram rules

We do not sell personal data to third parties.

6. Retention

Profile and subscription: for the duration of use; after termination — for the period necessary for contract performance, dispute resolution, tax and accounting.
Referral data: for the duration of the referral programme and after — to the extent needed for accounting and disputes.
Photos: not stored on our servers; retention by third-party providers is per their respective policies.
Logs and technical data: generally no longer than 12 months or the period needed for incident management.

7. Your rights (GDPR)

You have the right to:

Access (Art. 15): obtain confirmation as to whether your data are processed and a copy in a structured form.
Rectification (Art. 16): request correction of inaccurate data.
Erasure (Art. 17): request deletion of personal data ("right to be forgotten").
Restriction (Art. 18): in cases provided by law.
Data portability (Art. 20): receive data in a machine-readable format.
Object (Art. 21): object to processing based on legitimate interest.
Withdraw consent: at any time; withdrawal does not affect prior processing.
Lodge a complaint with a supervisory authority in your country of residence.

How to exercise your rights: send a request to the contact email or use Bot commands /my_data and /delete_my_data.

8. Security

We implement technical and organisational measures to protect personal data:

Storage on servers in the EU (Germany) with data protection commitments from the host.
Access limited to what is necessary; use of secure channels (HTTPS, encryption in transit).
Accounting for transfers to third countries and application of GDPR mechanisms.

9. Children

The service is not directed at children under 16 (or the applicable age of consent in your jurisdiction). If you become aware that a child has provided us with personal data without parental consent, please contact us and we will take steps to delete such data.

10. Changes to this policy

We may update this policy. The current version is published via the link in the Bot and on this page. Material changes may be communicated via the Bot or email. Continued use after publication of changes constitutes acceptance of the updated policy.

11. Contact

For personal data and rights: breathespace09@gmail.com

Document prepared for IN MY FRIDGE service. Publication date: February 2026.