Privacy & Cookies

# FoodX Privacy & Cookies — internal working draft

**Last updated:** [DATE]

This worldwide draft explains how FoodX may process information when the Services are used, subject to mandatory local law. The final notice must identify the legal controller, contact route, vendors, retention periods, and lawful bases for each relevant jurisdiction.

## Information we may handle

- account and contact details;
- content, prompts, files, feedback, and communications;
- device, log, diagnostic, and security information;
- usage, preference, and approximate location information;
- payment or business information where a paid feature is introduced.

## Why we use it

To provide and secure the Services, respond to requests, improve reliability, understand usage, prevent abuse, comply with law, and communicate product changes. Any model-training or product-improvement use must be described accurately and offer required controls.

## Sharing

We may use infrastructure, analytics, communications, support, payment, and security providers under appropriate agreements. We may disclose information for legal compliance, safety, business transfers, or with your direction.

## Cookies

FoodX may use essential cookies and similar technologies. Optional analytics or advertising technologies require the controls and consent required in the relevant jurisdiction.

## Rights and choices

Depending on location, people may have rights to access, correct, delete, export, restrict, object, withdraw consent, or complain to a regulator. The final notice must provide the correct route for exercising them.

## Security and retention

We use proportionate technical and organisational safeguards. Retention depends on the purpose, legal duties, disputes, backups, and account status; the final notice must state actual periods.

FoodX has retention controls for the information it handles. The launch notice must document the actual periods by category rather than promise indefinite deletion or a universal fixed period.

**Launch version must add:** controller identity, address/contact, lawful bases, vendor list or categories, transfer mechanism, retention schedule, children’s rules, and complaint authority.