Privacy Policy

Last updated: 26 October 2026 · Version 2.1

1. Who is responsible for your data

The data controller is EBOX3, SLU (the "Company", "we", "us"), with postal address Apartat de correus 1033, AD500 Andorra la Vella, Andorra, tax identification number (NRT) L714284H, registered in the Register of Companies of the Principality of Andorra (Registre de Societats Mercantils). Contact for any data-protection matter: info@casasac.com. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the applicable national data-protection law (including, where applicable, Spanish Organic Law 3/2018, LOPDGDD, and Andorran Law 29/2021, LQPD).

2. Data we collect

• Account data — name, e-mail address, phone number (optional), country, language, hashed password, and the version of these terms you accepted and when.
• Household data — the households you belong to, their members and roles, invitations, and the lists, to-dos, products, stores, stock, coupons, loyalty card numbers, budgets and categories you and your household enter.
• Purchase and expense data — receipts and bills you photograph or type in (merchant, date, lines, amounts, categories), income you choose to record, and the statistics computed from them. Income is visible to adult members only.
• Photos — receipt, coupon, shelf-label and product photos you take, stored in cloud object storage so you can see them again. Pantry and package photos are read and not kept.
• Voice data — on phones, speech is transcribed by your device's own speech service and only the resulting text is sent to us. In the browser app, the recorded audio of one command is sent to our cloud to be transcribed and is not kept. The text of your command, with the names of your products and lists, is used to apply it.
• AI feature data — when you use the assistant or photo reading, we send our AI provider (see Section 5) what you say or type, the photos you ask the app to read, the first names of your household members and the products, lists, stock and spending needed for a fitting answer, solely to provide the feature. It is not used to train AI models.
• AI usage data — for each account we record the number and type of AI requests, the amount of AI processing used (tokens, photos read) and its computed cost, to apply the AI allowances of your plan, to prevent abuse and to manage our costs.
• Subscription and billing data — plan, billing period, payment status and history. Card payments on our website are processed by Redsys; we receive only a payment reference and a card token, never your full card number. In-app purchases are processed by Apple (or Google), which shares with us only the information needed to confirm the subscription.
• Referral program data — your referral code and chosen alias, who invited you and whom you invited, visits and sign-ups through your link, commissions, wallet balance and payouts, and, if you ask for a cash payout, the account holder's name and your bank account (IBAN) or PayPal address and any identity verification.
• Age data — whether you are 18 or older. Where a law requires apps to check age (for example in some US states), the iPhone app asks Apple for your age range; Apple tells us only the range (such as "18 or older"), never your birth date or any identity document. On iPhones without that service, we record your own confirmation that you are 18 or older.
• Advertising attribution — on iPhone, whether the app was installed after you tapped one of our ads in the App Store, and if so which campaign, ad group and keyword (Apple's AdServices attribution). It is linked to your account only to measure which ads bring real customers, is not used for advertising to you, and involves no tracking across other companies' apps or websites.
• Ad measurement — on iPhone, the app uses Apple's privacy-preserving ad measurement (SKAdNetwork / AdAttributionKit) to report, through Apple, how far an install that followed one of our ads got (signed up, used a feature, subscribed) as a single number between 0 and 63. Apple delays and groups these reports and removes anything that could identify you or your device; neither we nor the ad network can link them to you. No advertising identifier is read and you are never tracked across other companies' apps or websites.
• Technical data — device and notification identifiers used to keep your devices in sync, on Android the install-referrer value from Google Play (to recognise the referral link that led to the installation), and standard server logs (IP address, timestamps) kept for security.
• Website data — the cookies and browser storage described in Section 8.

3. Why we process it (purposes and legal bases)

• To provide the Service (contract performance): accounts, households, lists, sync between devices, receipts and statistics, subscriptions, support.
• AI features (your consent, asked in the app before anything is sent): voice assistant, photo reading, meal ideas and savings advice through our AI provider. You can withdraw consent at any time in the app (Settings, Privacy and data); the AI features then pause.
• AI allowances and usage metering (contract performance and our legitimate interest in preventing abuse and controlling costs).
• Referral program (contract performance, for those who take part): attribution, commissions, holding periods, payouts; and our legitimate interest in preventing fraud and self-referral.
• Billing and legal obligations (legal obligation): invoicing, accounting, tax, consumer-law records, and payout records.
• Security and abuse prevention (legitimate interest): logs, rate limits, fraud checks.
• Age checks (legal obligation where an age-assurance law applies; otherwise our legitimate interest in keeping the Service, its subscriptions and its payments to adults).
• Measuring our advertising (legitimate interest): knowing which of our App Store ads bring customers, so that we spend less on ads that do not.
• Shared price observations (consent): only if your household turns price sharing on, prices you record are shared with other users without your identity, store loyalty details or photos, and with dates rounded to the day. You can turn it off at any time.
• Improving the Service (legitimate interest): statistics and analysis on aggregated or anonymised data that no longer identifies you.
• Service communications (contract performance): verification codes, payment and subscription notices. Marketing is sent only with your consent, and you can withdraw it at any time.

Providing account data is necessary to conclude the contract; without it we cannot provide the Service. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

4. Where your data lives

Data is stored on Microsoft Azure infrastructure ([Azure region]). Some processors are located, or may access data, outside the European Economic Area, in particular OpenAI in the United States. For such transfers we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework, where the recipient is certified) or on EU standard contractual clauses, together with the recipient's security commitments. You may ask us for a copy of the safeguards.

5. Who we share it with

We do not sell personal data. We share it only with:

• Processors that help us run the Service, under data-processing agreements: Microsoft Azure (hosting, databases, storage); OpenAI (United States: voice understanding, transcription in the browser app, photo reading, meal ideas and savings advice; it does not use our API data to train its models and may retain it for a limited period for abuse monitoring under its API data policy); our transactional e-mail provider ([e-mail provider name]); and Open Food Facts (product look-ups by barcode, which receive the barcode only).
• Payment providers: Redsys and the banks involved for website payments; Apple for purchases made in the iPhone app, which it processes as an independent controller under its own privacy policy; PayPal or our bank for referral payouts.
• The members of your household, who see what the household shares according to their role.
• Authorities, courts and professional advisers where the law requires it or to establish, exercise or defend legal claims, and a successor in case of a merger or transfer of the business, under this Policy.

6. How long we keep it

Account and household data: for the life of your account and up to 12 months after deletion (backups). Purchase history stays in your household until you delete it or the household is deleted. Billing, referral commission and payout records: as long as tax and accounting law requires. AI usage records (counters and costs only): for the life of the account; they are reset when the account is deleted. Security logs: up to 24 months. Photos you delete are removed from active storage promptly and from backups on their normal rotation. Data may be kept longer, blocked, where needed to defend legal claims.

7. Your rights

You may request access, rectification, erasure, restriction, portability (the app exports your household's data as JSON or CSV), and object to processing based on legitimate interest; where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Write to info@casasac.com, delete your account in the app (Settings), or use the account deletion page. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es), the Andorran Data Protection Agency (APDA) or the supervisory authority of your country of residence.

8. Cookies and browser storage

The website uses only first-party items: the cas_lang cookie (your language), the cas_site_theme cookie (your theme), technical session and anti-forgery cookies, browser storage for your signed-in session and your basket while you check out, and, when you arrive through a referral link, the cas_ref cookie, which remembers the referral code for 30 days so that the person who invited you is credited if you sign up. We use no advertising or cross-site tracking cookies.

9. Security

We apply appropriate technical and organisational measures: encrypted transport (TLS), hashed passwords and session tokens, signed payment messages, access controls and the principle of least privilege. No system is perfectly secure; notify us immediately of any suspected breach of your account.

10. Children

The Service is intended for adults: accounts are opened by, and households may only invite, persons aged 18 or over. Where the law requires it, the app checks this through the age range your app store shares (see Section 2), and a person under 18 cannot use the app or buy a subscription in it. We do not knowingly collect personal data from children, including children under 13 within the meaning of the US Children's Online Privacy Protection Act (COPPA). If you believe a child's data has been provided to us, contact us and we will delete it.

11. Changes

We may update this Policy; material changes will be notified (e.g. by e-mail or in the app) before they take effect. The date at the top indicates the current version.

12. Contact

EBOX3, SLU — Apartat de correus 1033, AD500 Andorra la Vella, Andorra · info@casasac.com

13. Additional information for United States residents

This section applies to residents of the United States, including residents of California, Colorado, Connecticut, Virginia, Utah, Texas and other states with consumer privacy laws, to the extent those laws apply to us.

• Categories of personal information we collect, from you and from your use of the Service: identifiers (name, e-mail address, account and device identifiers); commercial information (subscriptions, purchases and receipts you record); financial information you choose to record (income, budgets) and, for referral payouts only, bank or PayPal details; audio converted to text (voice commands); photos you take in the app; age range (whether you are 18 or older); internet activity within the Service (usage and AI-usage counters, logs); approximate location derived from your country setting and IP address; and inferences limited to your household's own shopping and spending statistics. The purposes, sources and recipients are described in Sections 2, 3 and 5, and retention in Section 6.
• No sale or sharing. We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in California law. We have not done so in the past 12 months. Because we do neither, we do not offer an opt-out link; we honor Global Privacy Control signals as a request not to sell or share.
• Sensitive personal information (such as financial account details for payouts) is used only to provide the Service you asked for, never to infer characteristics about you.
• Your rights: to know and access the personal information we hold about you, to receive it in a portable format, to correct it, and to delete it, and to appeal a decision we make about your request. Make a request by writing to info@casasac.com, or delete your account in the app (Settings). We will verify your request by confirming control of your account e-mail, may accept a request from an authorized agent with your signed permission, and will answer within 45 days (extendable as the law allows). If we deny your request, you may appeal by replying to our answer; if the appeal is denied, you may contact your state Attorney General.
• Non-discrimination: we will not deny you the Service, charge you a different price or provide a different quality of service because you exercised these rights.
• California "Shine the Light": we do not disclose personal information to third parties for their own direct-marketing purposes.