Privacy Policy

Last updated: 11 October 2026 · Version 1.0

ENIMPORTANT — This document is provided in English only. By accessing or using this website, the CASASAC applications or any related service, you declare that you are able to read and fully understand English and that you accept the terms set out below. If you cannot read and understand English, or if you do not accept these terms, you must not use this website or application.

ESIMPORTANTE — Este documento se facilita únicamente en inglés. Al acceder o utilizar este sitio web, las aplicaciones CASASAC o cualquier servicio relacionado, usted declara que puede leer y comprender plenamente el inglés y que acepta las condiciones expuestas a continuación. Si no puede leer y comprender el inglés, o si no acepta estas condiciones, no debe utilizar este sitio web ni la aplicación.

FRIMPORTANT — Ce document est fourni uniquement en anglais. En accédant à ce site web, aux applications CASASAC ou à tout service associé, vous déclarez être en mesure de lire et de comprendre pleinement l'anglais et accepter les conditions ci-dessous. Si vous ne pouvez pas lire et comprendre l'anglais, ou si vous n'acceptez pas ces conditions, vous ne devez pas utiliser ce site web ni l'application.

CAIMPORTANT — Aquest document es facilita únicament en anglès. En accedir o utilitzar aquest lloc web, les aplicacions CASASAC o qualsevol servei relacionat, declareu que podeu llegir i comprendre plenament l'anglès i que accepteu les condicions exposades a continuació. Si no podeu llegir i comprendre l'anglès, o si no accepteu aquestes condicions, no heu d'utilitzar aquest lloc web ni l'aplicació.

NLBELANGRIJK — Dit document wordt uitsluitend in het Engels verstrekt. Door deze website, de CASASAC-applicaties of enige gerelateerde dienst te gebruiken, verklaart u dat u het Engels volledig kunt lezen en begrijpen en dat u de onderstaande voorwaarden aanvaardt. Als u het Engels niet kunt lezen en begrijpen, of als u deze voorwaarden niet aanvaardt, mag u deze website of applicatie niet gebruiken.

DEWICHTIG — Dieses Dokument wird ausschließlich auf Englisch bereitgestellt. Durch den Zugriff auf diese Website, die CASASAC-Anwendungen oder damit verbundene Dienste erklären Sie, dass Sie Englisch vollständig lesen und verstehen können und die nachstehenden Bedingungen akzeptieren. Wenn Sie Englisch nicht lesen und verstehen können oder diese Bedingungen nicht akzeptieren, dürfen Sie diese Website oder Anwendung nicht nutzen.

ITIMPORTANTE — Questo documento è fornito esclusivamente in inglese. Accedendo o utilizzando questo sito web, le applicazioni CASASAC o qualsiasi servizio correlato, Lei dichiara di essere in grado di leggere e comprendere pienamente l'inglese e di accettare le condizioni riportate di seguito. Se non è in grado di leggere e comprendere l'inglese, o se non accetta queste condizioni, non deve utilizzare questo sito web né l'applicazione.

1. Who is responsible for your data

The data controller is , a company incorporated under the laws of the Principality of Andorra, with registered office in Andorra (the "Company", "we", "us"). Contact: info@casasac.com. We process personal data in accordance with Andorran data-protection law (Law 29/2021, LQPD) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. Data we collect

  • Account data — name, e-mail address, phone number (optional), country, language, hashed password, and the version of these terms you accepted.
  • Household data — the households you belong to, their members and roles, invitations, and the lists, products, stores, stock, coupons, loyalty card numbers, budgets and categories you and your household enter.
  • Purchase and expense data — receipts and bills you photograph or type in (merchant, date, lines, amounts, categories), income you choose to record, and the statistics computed from them. Income is visible to adult members only.
  • Photos — receipt, coupon, shelf-label and product photos you take, stored in cloud object storage so you can see them again. Pantry and package photos are read and not kept.
  • Voice data — on phones, speech is transcribed by your device's own speech service and only the resulting text is sent to us. In the browser app, the recorded audio of one command is sent to our cloud to be transcribed and is not kept. The text of your command, with the names of your products and lists, is used to apply it.
  • AI feature data — the text of your commands and the photos you ask the app to read are processed by our AI provider (see Section 5) solely to provide the feature, and are not used to train AI models.
  • Subscription and billing data — plan, billing period, payment status and history. Card payments are processed by Redsys; we receive only a payment reference and a card token, never your full card number.
  • Technical data — device and notification identifiers used to keep your devices in sync, and standard server logs (IP address, timestamps) kept for security.
  • Website data — the strictly necessary cookies and browser storage described in Section 8.

3. Why we process it (purposes and legal bases)

  • To provide the Service (contract performance): accounts, households, lists, sync between devices, receipts and statistics, subscriptions, support.
  • Billing and legal obligations (legal obligation): invoicing, accounting, tax, consumer-law records.
  • Security and abuse prevention (legitimate interest): logs, rate limits, fraud checks.
  • Shared price observations (consent): only if your household turns price sharing on, prices you record are shared with other users without your identity, store loyalty details or photos, and with dates rounded to the day. You can turn it off at any time.
  • Service communications (contract performance): verification codes, payment and subscription notices. Marketing is sent only with your consent.

4. Where your data lives

Data is stored on Microsoft Azure infrastructure. Where data is transferred internationally, we rely on appropriate safeguards (such as EU standard contractual clauses and the recipient's certifications).

5. Who we share it with

We do not sell personal data. We share it only with: (a) processors that help us run the Service: Microsoft Azure (hosting and storage), Redsys (payments), our transactional e-mail provider, OpenAI (voice understanding, transcription in the browser app, photo reading, meal ideas and savings advice, under a data-processing agreement and not used to train its models) and Open Food Facts (product look-ups by barcode, which receive the barcode only); (b) the members of your household, who see what the household shares according to their role; and (c) authorities where the law requires it.

6. How long we keep it

Account and household data: for the life of your account and up to 12 months after deletion (backups). Purchase history stays in your household until you delete it or the household is deleted. Billing records: as long as tax and accounting law requires. Security logs: up to 24 months. Photos you delete are removed from active storage promptly and from backups on their normal rotation.

7. Your rights

You may request access, rectification, erasure, restriction, portability (the app exports your household's data as JSON or CSV), and object to processing based on legitimate interest, by writing to info@casasac.com or using the account deletion page. You may also lodge a complaint with the Andorran Data Protection Agency (APDA) or your local supervisory authority.

8. Cookies and browser storage

The website uses only strictly necessary, first-party items: the cas_lang cookie (your language), the cas_site_theme cookie (your theme), technical session and anti-forgery cookies, and browser storage for your signed-in session and your basket while you check out. We use no advertising or cross-site tracking cookies.

9. Security

We apply appropriate technical and organisational measures: encrypted transport (TLS), hashed passwords and session tokens, signed payment messages, access controls and the principle of least privilege. No system is perfectly secure; notify us immediately of any suspected breach of your account.

10. Children

Accounts are opened by adults. An adult may add a child to a household with a child role: the child can propose items and use the shared lists, cannot buy subscriptions, and does not see income or business expenses. The adult who adds a child is responsible for having the authority to do so. We do not knowingly collect other data from children.

11. Changes

We may update this Policy; material changes will be notified (e.g. by e-mail or in the app) before they take effect. The date at the top indicates the current version.

12. Contact

— Principality of Andorra · info@casasac.com