Last updated: 2026-05-21
Chez Vous ("we", "us") operates a B2B food intelligence API. This policy explains what personal data we collect from dashboard users (you, our B2B customer) and how we use it. The API data itself contains no PII — it is anonymised aggregate statistics.
| Data | Purpose | Retention |
|---|---|---|
| Email address | Account authentication, transactional emails | Until account deletion |
| Password (bcrypt hash) | Authentication | Until account deletion |
| API request logs | Usage billing, abuse detection | 90 days |
| Stripe customer ID | Billing | Until account deletion |
| IP address (login) | Rate limiting | 30 days |
We process your account data under: (a) contractual necessity — to provide the Service; (b) legitimate interest — security and fraud prevention; (c) legal obligation — where required by law.
We share data only with: Stripe (billing), Resend (transactional email), and our hosting provider. All processors are GDPR-compliant and bound by data processing agreements.
Under GDPR you have the right to: access, rectification, erasure ("right to be forgotten"), portability, restriction, and objection. To exercise these rights, email privacy@chez-vous.co. We respond within 30 days.
The dashboard uses an httpOnly, SameSite=Strict session cookie (cv_session) to authenticate you. This cookie cannot be accessed by JavaScript. Your API key is stored in localStorage for convenience. No third-party cookies are set.
Data is hosted in EU data centres. If processed outside the EU, we use Standard Contractual Clauses.
Data controller: Fernando Petrulio, operating Chez Vous.
Email: privacy@chez-vous.co