Back to Bun-Bun

Privacy Policy

Last updated June 2026 · Bun-Bun v0.1.0

• Email & name — from Google Sign-In. Used to identify your account. Nothing else.
• Dishes you stamp or wishlist — stored so you can access your food journal from any device, and so friends in your buddies can see your recommendations.
• Photos you upload — stored securely and visible only to you and friends you've connected with.
• Outlet location — the address and coordinates of restaurants where you've stamped or wishlisted a dish. Stored as part of each dish record.
• Your location — used in two ways: while the app is open, to show nearby dishes in your feed; and in the background, to alert you when you are within walking distance of a dish on your wishlist or one stamped by someone in your circle. Your coordinates are processed entirely on your device and are never sent to our servers.
• Social media links you parse — the Instagram or YouTube URL you submit. The caption or transcript is processed to extract dish names, then deleted immediately once you approve or cancel the parse job.
• Push notification token — stored when you grant notification permission, used only to send you in-app alerts.
• Friend connections — who you've added to your buddies, and friend requests sent or received.
• Payment records — transaction ID, product purchased, amount, and currency. We do not store card numbers or full payment details.
• Accessibility preference & votes — your mobility assistance setting and outlet accessibility votes. Only aggregate scores are shown publicly; your individual vote is never attributed.

• To provide the app — your food journal, feed, buddies, and parser.
• To show your dishes to friends you've connected with.
• To send you notifications you've consented to — re-stamps, friend requests, and proximity alerts when you are near a wishlisted dish or a buddy's stamp.
• To process payments and maintain your parse credit balance.
• We do not use your data for advertising, profiling, or behavioural targeting.

These services act as data processors on our behalf. They may only use your data to provide their service to us.

• Google Firebase — authentication, database (Firestore), file storage, and push notifications.
• Google Maps & Places — map view, outlet search, and geocoding.
• Anthropic Claude — AI used to extract dish names from social media captions. Caption content is not retained by Anthropic for training.
• Apify — fetches publicly available Instagram Reel captions. Only the URL is sent; no personal data about you is transmitted.
• YouTube Data API — fetches publicly available video descriptions. Only the video ID is sent.
• Google Cloud Storage — secure cloud storage for dish photos you upload. Stored in Google's asia-south1 region (Mumbai).
• Resend — email delivery service used to send friend invitations on your behalf.
• RevenueCat — in-app purchase processing with Apple and Google.

• Account data — kept until you delete your account.
• Social media captions & transcripts — deleted immediately when you approve or cancel your parse job. If a job fails or is left unreviewed, the raw content is automatically deleted within 24 hours. Only the source URL is retained.
• Payment records — retained for 7 years as required by financial regulations.
• Push token — deleted when you opt out, or when your device reports the token as invalid.

Under the Digital Personal Data Protection Act 2023 (India) and applicable laws, you have the following rights:

• Access — request a summary of the personal data we hold about you and a list of third-party processors we have shared it with.
• Correct & update — request correction or completion of inaccurate or incomplete data.
• Portability — request your data in a machine-readable format (JSON export available immediately from Profile → Settings → Export my data).
• Erasure — delete your account from Profile → Settings → Delete account. All stamps, wishlists, buddy connections, and activity data are permanently removed immediately. Deleting your account also constitutes withdrawal of consent for all data processing.
• Nominate — under the DPDP Act 2023, you may nominate another individual to exercise your data rights on your behalf in the event of your death or incapacity. To register a nominee, email hello@bunbun.food.
• Opt out of notifications — disable push notifications from Profile → Settings or revoke device permission at any time.
• Limit location use — revoke location permission via device settings at any time. Revoking background location disables proximity alerts but does not affect any other app features.
• Lodge a complaint — if you believe we have handled your data unlawfully, you may file a complaint with the Data Protection Board of India (once operational) or your local data protection authority.

To exercise any of these rights, email hello@bunbun.food. We acknowledge within 48 hours and respond fully within 30 days.

Bun-Bun does not sell, rent, or share your personal information with third parties for their own commercial purposes. This includes compliance with the CCPA and similar laws. To submit a "Do Not Sell or Share" request, email hello@bunbun.food.

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act 2023, the following Grievance Officer has been appointed:

• Name: Sarita C
• Designation: Founder, Bun-Bun
• Contact: hello@bunbun.food

Complaints will be acknowledged within 48 hours and resolved within 30 days of receipt, as required under the DPDP Act 2023.

Bun-Bun's designated Copyright Agent is registered with the US Copyright Office (Registration #DMCA-1073675). To submit a copyright takedown notice, email hello@bunbun.food. Full contact details are on file with the US Copyright Office — search the public directory at copyright.gov/dmca-directory.

All data is transmitted over HTTPS. Your photos are stored in access-controlled cloud storage. API access requires authentication on every request. We never log your passwords or payment card details.

Bun-Bun is operated from India. Your data is stored and processed on Google Cloud servers in the asia-south1 region (Mumbai, India) and Google's global infrastructure (Firebase Auth, Firestore, FCM). All infrastructure runs entirely within Google Cloud — no data is transferred to AWS or other third-party cloud providers. Cross-border transfers (e.g. to Anthropic for AI processing, Apify for reel fetching) are made in accordance with Section 16 of the Digital Personal Data Protection Act 2023. These providers maintain Standard Contractual Clauses (SCCs) approved by the European Commission, which provide an adequate level of protection for personal data transferred internationally.

In the event of a personal data breach, we will notify the Data Protection Board of India and all affected users without undue delay, as required under the DPDP Act 2023. Notification will describe the nature of the breach, the data affected, and the steps we have taken to contain it.

Bun-Bun is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. Users confirm they are 18 or older during account creation. If we become aware that a minor has provided personal data, we will delete it promptly. If you believe a minor has registered, please contact us at hello@bunbun.food.

This policy is governed by the laws of India, including the Digital Personal Data Protection Act 2023. California residents have additional rights under the CCPA/CPRA, described in the "Your rights" section above.

This service is not currently directed at residents of the European Union, European Economic Area, or United Kingdom. If you are accessing Bun-Bun from those regions, please do not use the app until we formally extend service there.

Last updated June 2026 · Bun-Bun v0.1.0 · Questions: hello@bunbun.food