1. Access your data
What you get: a copy of the personal data we hold about you — account details, saved recipes, meal plans, chat history, billing records.
How to request:
- In-app: Account → Privacy → Request my data
- Or email [email protected] with subject "Data Rights Request" from the address on file
This right is provided under APP 12 in Australia, IPP 6 in New Zealand, and DPDP §11 in India.
2. Export your data (portability)
Under DPDP §11 (and honoured across all launch regions), you can receive your data in a structured, machine-readable format for use with another service.
What you get: a downloadable bundle containing your account profile and preferences, all your generated recipes and favourites, your weekly meal plans and grocery lists, your pantry items and expiry data, your recent Pepper conversations, and your invoice history.
How to request: Account → Privacy → Export my data. On the app you can bundle and share it instantly; by email we send it as promptly as we can.
3. Correct your data
Most account information can be corrected directly in Account settings. For anything you can't edit yourself (e.g. billing history corrections), email [email protected] with subject "Data Rights Request". This right is provided under APP 13, IPP 7, and DPDP §12.
4. Delete your account
Under DPDP §12 (and honoured across all launch regions where retention is no longer necessary), you can request that we permanently delete your account.
What happens:
- You request deletion via Account → Delete Account, or by email.
- We show a confirmation screen listing what will be lost (recipes, plans, pantry).
- If you have an active, auto-renewing subscription, cancel it first in your App Store or Google Play settings — we can't cancel store subscriptions for you, and this stops Apple or Google billing a deleted account.
- Once nothing is set to renew (or on the free plan), your account and data are wiped immediately — there is no grace period, and deletion cannot be undone.
- Your store subscription itself is held by Apple or Google; if it still has paid time left, it remains restorable through your store account.
- Personal data is removed from our active systems straight away and cleared from routine backups within 30 days.
What we keep: anonymised, aggregated statistics that cannot identify you; records we are legally required to keep for tax purposes (largely held by our payment providers, not on our servers); and a one-way hashed marker plus a deletion audit record that prove compliance and help prevent trial abuse without identifying you.
5. Withdraw consent
Anywhere we processed data on the basis of your consent (sensitive personal information such as allergens and dietary restrictions, marketing emails, optional analytics), you can withdraw that consent in Account → Privacy, or by unsubscribing from any marketing email. Withdrawal does not affect processing that already happened but stops future processing on that basis. This right is provided under DPDP §6(4), and equivalent rights under Australian and New Zealand privacy law.
6. Nominate someone to act on your behalf
Under DPDP §14, Indian users may nominate another person to exercise these rights in the event of death or incapacity. Similar arrangements can be made in Australia and New Zealand on request. Email [email protected] with subject "Nominee — DPDP §14" and the nominee's contact details plus a signed authorisation.
7. Lodge a complaint with a regulator
You always have the right to complain to a regulator without going through us first:
- Australia — Office of the Australian Information Commissioner (oaic.gov.au)
- New Zealand — Office of the Privacy Commissioner (privacy.org.nz)
- India — Data Protection Board of India, once operational under DPDP Act 2023
8. Response timeline
- Data access + export requests — as promptly as we can, within the timeframes required by applicable privacy law.
- Correction requests — promptly.
- Deletion requests — immediate once nothing is set to auto-renew (cancel an active store subscription first); there is no grace period and deletion can't be undone.
- Grievance — DPDP — acknowledged and resolved within the timeframes required by the DPDP Act.
- Complex requests — where a request is complex we may need more time and will let you know, consistent with applicable law.
- Identity verification — for security we may ask you to confirm the email on your account before actioning any request.
Questions? Email [email protected] — please include a clear subject line ("Data Rights Request", "Grievance — DPDP", "Privacy Enquiry — APP", etc.) so we can route your query to the right team.
Registered business address: Chef Happens, Level 1, 63-73 Ann Street, Surry Hills, NSW 2010, Australia.