Foodiy Passport Privacy Policy

1. Responsible entity

The controller or personal information handler is the Foodiy operator identified in the service, order, or contract. Your organization may separately control member profile and access information.

2. Information we process

• Account identifiers, primary email, phone, locale, and verification status
• Strongly hashed passwords, passkey public-key metadata, TOTP and recovery state
• Session, IP, browser or device, authentication method, and security logs
• OAuth/OIDC clients, scopes, external identity links, and organization SSO relationships
• Verification delivery, audit, and support records

3. Purposes and legal bases

• Create and maintain accounts; sign in, authorize, recover, and verify devices
• Perform a contract or take requested pre-contract steps
• Use consent for optional identity links, delivery, or non-essential cookies where required
• Meet legal duties and prevent fraud, abuse, and security incidents
• Use legitimate interests where available and balanced against user rights

4. Providers and disclosure

We use infrastructure, delivery, security, and support providers only as needed and restrict them by contract, access control, and audit. We may disclose information in a valid legal process or to protect users and services. We do not sell account passwords or authentication credentials.

5. International transfers

Where processing crosses borders, we use the notices, consent, contracts, certifications, or assessments required by applicable law and minimize transferred data. Production notices must identify actual regional recipients and safeguards.

6. Retention and security

We keep active account data while needed for the account and legal duties; short-lived codes and sessions expire promptly; security logs follow limited risk and compliance schedules. We use encryption in transit, strong password hashing, least privilege, MFA, revocation, rate limits, and audit controls.

7. Your rights, children, and contact

Depending on location, you may access, correct, delete, restrict, object, withdraw consent, obtain portability, close an account, or complain to a regulator. See Privacy rights and Children & teens. Submit requests through the account center or support@foodiy.net.