Who processes your data
The controller is Murabi OÜ, registry code 17470796, with its address at Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia. Contact: contract@murabi.io. This English text is a courtesy translation; the Spanish version is the operative one.
The company is established in Estonia, inside the European Union, so it needs no EU representative. The lead supervisory authority is the Estonian Data Protection Inspectorate; if you live in Spain you can also complain to the AEPD.
In short
The essentials, in six lines:
- We keep your email and Firebase account so you can sign in.
- We keep your preferences and plans so you can repeat and adjust the week.
- Allergens are health data: we only process them if you mark them, and you can withdraw them.
- We send one recipe photo and ingredient names to Google Gemini to read and match them; we do not send your account, plans or allergens.
- Lemon Squeezy charges subscriptions as merchant of record; Cuadra never sees your card.
- You can export your data and delete your account in Settings; deletion removes the account and its content.
What we process
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email and Firebase account | identify you and give access | contract (Art. 6(1)(b)) | while the account exists; deleted with it |
| Preferences: household, diet, exclusions, time, store | narrow the menu | contract (Art. 6(1)(b)) | while the account exists |
| Allergens and their severity | never plan recipes or products containing them | consent (Art. 6(1)(a) and 9(2)(a)) | while the account exists; withdrawn by unticking |
| Plans, meals, budget and prices | generate and review the week | contract (Art. 6(1)(b)) | while the account or the plan exists |
| Basket, swaps and shopping events | price the shop and reconcile the store | contract (Art. 6(1)(b)) | while the account or the plan exists |
| Your own recipes | keep your private drafts | contract (Art. 6(1)(b)) | while the account exists; deleted with it |
| Shared link: token and hashed password | let another person see the plan | consent (Art. 6(1)(a)) | until it expires (365 days maximum) or you revoke it |
| Billing: identifiers and status | charge and manage the subscription | contract and legal obligation | while the account exists; invoices stay with Lemon Squeezy |
| MCP agent tokens and counters | allow the access you authorise | contract (Art. 6(1)(b)) | access 900 s; refresh 30 days; counters until the account is deleted |
| Problem reports: message, page and browser context | diagnose failures and reply | legitimate interest (Art. 6(1)(f)) | while the account exists; deleted with it |
| Technical logs, without IP address | security and debugging | legitimate interest (Art. 6(1)(f)) | per the cloud provider’s policy |
Account data is necessary for the contract: without it we cannot provide the service. Allergens are optional; if you do not provide them, the plan does not filter by them.
The legitimate interest behind ingredient matching is improving the catalog without building profiles: only ingredient strings travel, never your account or your plan.
Allergens and health data
To avoid allergens we need to know which ones you must avoid. That is health data, so we only process it with your explicit consent, you can withdraw it in Settings at any time, and it affects only that feature.
We do not ask for allergens to create an account, and we do not use them for advertising, profiling or sharing with third parties. We do not send them to the model. If you withdraw them, we stop filtering by them and the plan includes those ingredients again.
Cuadra does not guarantee that a product or recipe is free of traces: always check the label. Allergen information depends on the store catalog and Open Food Facts and may be incomplete.
Consent is given by marking allergens during onboarding or in Settings. We do not keep a separate timestamped consent record yet; if you need to prove your consent or withdraw it by email, write to contract@murabi.io.
Use of artificial intelligence
We use Google Gemini for two things: reading a recipe photo you upload, and matching ingredient names against our catalog. Plan and basket arithmetic is deterministic and no model performs it.
The plan is not an automated decision under Article 22 GDPR: it is a suggestion you can edit or discard, it has no legal effect and it does not significantly affect you.
Who else sees it
The processors acting on our behalf are listed on the subprocessors page: Google Cloud (Firebase Authentication, Gemini, Cloud Run and logs) and the managed PostgreSQL provider in the EU.
Lemon Squeezy is not a processor: it acts as merchant of record and is an independent controller for purchase data. It receives your email and subscription identifiers; it collects the card details.
If you authorise an agent through MCP, that agent receives the data you authorise and is responsible for its own processing.
International transfers
Account data, preferences, plans and baskets are hosted in the European Union. Google Cloud may process data in the United States under the standard contractual clauses and a transfer impact assessment. Lemon Squeezy is in the United States and uses the same mechanism.
The provider list, its location and each mechanism are on the subprocessors page.
How long
The account, preferences, plans, basket, pantry, favourites, problem reports and your own recipes are kept while the account exists. Deleting it removes them in the same operation, and the Firebase account is deleted right after.
A shared link is kept until it expires or you revoke it. Agent access tokens last 900 seconds and refresh tokens 30 days. Daily usage counters are deleted with the account.
Technical logs do not include the IP address and are kept under the cloud provider’s policy. The rate limiter keeps the IP in memory for 60 seconds and never writes it to the database.
Lemon Squeezy keeps invoices and purchase data under its own tax obligations.
Your rights
You can exercise these rights by writing to contract@murabi.io:
- Access: download a JSON file with your account, preferences, plans, basket, pantry, own recipes, favourites and problem reports from Settings.
- Rectification: fix your email, locale and preferences in Settings. If the account email is wrong, write to us.
- Erasure: delete the account and its content in Settings, without waiting for us.
- Restriction and objection: write to us and we stop processing that specific item while we review it.
- Portability: the export is a JSON file you can take elsewhere.
- Withdraw consent: untick allergens in Settings; the rest of the service keeps working.
The lead supervisory authority is the Estonian Data Protection Inspectorate (aki.ee). If you live in Spain, you can complain to the Spanish Data Protection Agency, C/ Jorge Juan 6, 28001 Madrid, aepd.es.
Security
We use TLS on all traffic, Firebase authentication, per-user queries, secrets in Secret Manager and restricted database access. We do not claim certifications we do not hold.
Minors
The service is not aimed at children under 14. If you believe we have received a child’s data, write to contract@murabi.io and we will delete the account.
Changes to this policy
Every version of this policy carries a date and a number. We publish the new version on this page and keep the change history. We never edit the text of a published version: if something changes, the version changes.