Privacy Policy

buysmart only processes personal data that is necessary to operate a given feature. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) for the app's core features, and Art. 6(1)(f) GDPR (legitimate interest) for technical operating data.

Sign-in is handled by Firebase Authentication (Google, Apple, or as a guest). Firebase, a service of Google Ireland Limited, manages your credentials and sign-in information; buysmart itself never stores a password. In our own database we only create an internal record linked to your Firebase identifier, together with the time your account was created.

When you save a product as a favorite, create a shopping list, or leave a rating, we store the information needed for that feature (e.g. product name, price, retailer, your review text) linked to your account, so these features remain available across sessions.

If you use the AI chat assistant, we store your messages and its replies so you can continue a conversation. To generate a reply, we send the conversation so far to Google LLC's Gemini API; no account data such as your name or email address is included, but the content of your messages is.

The photo-scan feature sends the captured image to Google LLC's Gemini API once, solely for product recognition. We do not store the image itself on our servers — only the result (the recognized product name) is used for the subsequent price search.

If you enable push notifications, we store the device token needed for that, delivered via Firebase Cloud Messaging (Google).

For a buysmart Premium subscription, we process the purchase confirmation provided by the App Store (Apple) — such as the product ID and expiry date. Payment details such as credit card information are handled exclusively by Apple and never reach us.

To provide the app, we work with the following processors: Google LLC / Google Ireland Limited (Firebase Authentication, Cloud Messaging, Gemini API), Apple Inc. (subscription handling via the App Store), and, where applicable, Brevo (Sendinblue) for sending system emails. Where this involves transferring data to the US, it relies on the safeguards provided by the respective provider, such as EU Standard Contractual Clauses.

We store your data for as long as your account exists. If you delete your account in the app, the data linked to it (favorites, shopping list, ratings, chat history, device token) is permanently removed from our database.

You have the right to access, rectify, erase, and restrict the processing of your data, as well as the right to data portability and to object to processing. Contact us using the address below. You can also lodge a complaint with the Austrian data protection authority (www.dsb.gv.at) at any time.