Zaffo Privacy Policy

This policy covers Zaffo, the AI cooking assistant mobile app published by Pinegrass Technologies Pvt. Ltd. (“Pinegrass”, “we”). It explains what Zaffo collects, why, who processes it, and the rights you hold under India’s Digital Personal Data Protection Act, 2023 (DPDP Act). Pinegrass is the data fiduciary for Zaffo.

For the corporate website and company-level privacy practices, see the Pinegrass privacy notice.

Zaffo collects only what the app needs to function:

• Account information. Your email address, obtained when you sign in with Google Sign-In or Apple Sign-In. We use it to create and secure your account.
• User-generated content. The recipes and meal plans you create, save, or edit, and your cooking history and dietary goals.
• Health-related preferences (optional). If you turn them on, your diabetes-aware and blood-pressure / lower-salt settings. These are health-related preferences you choose to provide; we use them only to steer recipe and meal suggestions, and you can turn them off or delete them at any time. They are not a diagnosis or medical advice.
• Food photos. Images you capture or upload for calorie scanning and recipe suggestions.
• Voice recordings. Audio you record in the app for transcription (for example, dictating an ingredient or a note), processed into text.

Zaffo does not sell your personal data, and does not use it for advertising.

To generate recipes, estimate calories, and transcribe voice, Zaffo sends the relevant content to OpenAI as a data processor on our behalf:

• Text prompts (your ingredients, goals, requests, and any diabetes-aware or lower-salt preference you have enabled) — for recipe generation.
• Food images — for calorie estimation and dish recognition.
• Audio recordings — for transcription into text.

OpenAI processes this content to return results to Zaffo. Its handling of data is governed by OpenAI’s privacy policy. We share only the content needed for the specific feature you invoke.

Your account data and user-generated content are stored in MongoDB Atlas, in the Mumbai region (ap-south-1), within India. Content sent to OpenAI for processing may be handled on OpenAI’s infrastructure as described in its privacy policy above.

Under the DPDP Act, 2023 you have the right to access a copy of your personal data, to correct it, and to request its deletion, along with the right to nominate someone to act on your behalf and the right to grievance redressal. To exercise any of these, email privacy@pinegrass.in with the request type in the subject line. We acknowledge within seven days and resolve within thirty.

You can also delete your account from within the app, which removes your account data and user-generated content from our storage.

Designated under section 8(9) of the DPDP Act, 2023 as the point of contact for grievance redressal on behalf of the Data Fiduciary.

To request removal of content, email privacy@pinegrass.in with the affected content and a copy-of-claim. Acknowledged within 72 hours.

The “Last updated” date above moves whenever anything material changes. Prior versions are available on request to connect@pinegrass.in.