PRIVACY POLICY Effective date: 1 August 2025\t\tLast updated: 1 August 2025 1 Who We Are Apptractive Pty Ltd ("Company", "we") operates Pantry Pic. ABN 376 273 798 00 Address: 3/79 O’Donnell Street, North Bondi NSW 2026, Australia Email: hello@apptractive.com.au 2 Scope This Policy applies to the Pantry Pic website, App and related services ("Services"). 3 Information We Collect Category\tExamples\tSource Account data\tname, email, hashed password, country\tYou Subscription & payment\ttransaction ID, plan, currency\tApple/Google/Stripe Photos & content\tpantry/fridge images, recipe notes\tYou Preferences\tdietary restrictions, cooking level\tYou Device & usage\tIP, device ID, OS version, app interactions, cookies\tAutomatic Location (coarse)\tderived from IP/device\tAutomatic / optional Support\thelp-desk tickets, chat logs\tYou We do not knowingly collect data from children under 13. 4 Legal Bases (GDPR concepts) Contract – to provide the Services Legitimate interests – improve Services, prevent fraud, analyse usage Consent – marketing, push notifications, optional health data Legal obligation – tax, accounting, consumer-protection compliance 5 Uses of Data Perform ingredient detection and recipe generation with AI. Personalise content and conduct analytics/A-B testing. Process payments and manage subscriptions. Provide customer support. Ensure security and comply with law. 6 Sharing & Disclosure Recipient category\tIllustrative example Cloud hosting & infrastructure\tAmazon Web Services AI & image-processing partners\tOpenAI, AWS Rekognition Subscription & payment platforms\tApple, Google, Stripe, RevenueCat Analytics & diagnostics\tAmplitude, Sentry Professional advisers\taccountants, auditors, lawyers Authorities\twhen legally required Business transferees\tin merger, sale or acquisition We do not sell personal data for monetary consideration. A list of current sub-processors is available on request. 7 International Transfers Because we use global cloud infrastructure, data may be processed outside your jurisdiction. We rely on contractual safeguards or legally recognised transfer mechanisms where required. 8 Security We protect data with TLS 1.3 in transit, encryption at rest, least-privilege IAM and periodic penetration tests. No system is 100 % secure; you use the Services at your own risk. 9 Data Retention Data is kept only as long as necessary for the purposes above or as required by law. Unsaved photos are deleted within 30 days; backups purge within 90 days after account deletion. 10 Your Rights Depending on your region you may have rights to access, correct, delete, restrict or port your data, or object to processing. Submit requests to hello@apptractive.com.au; we will verify identity and respond within statutory timeframes. 11 Cookies & Tracking We use essential cookies and SDKs for authentication, analytics and crash reporting. In jurisdictions that require it we obtain consent via a cookie banner. You can disable cookies in your browser/device settings. 12 Marketing Communications We send marketing emails or push notifications only with consent or under “soft opt-in” rules. Unsubscribe at any time via the link in the email or in-app settings. 13 Children’s Privacy The Services are not directed to children under 13. If we learn we have collected such data without parental consent, we will delete it. 14 Changes to This Policy We may update this Policy. Material changes will be notified by email or in-app. Continued use after the effective date signifies acceptance. 15 Contact hello@apptractive.com.au 3/79 O’Donnell Street, North Bondi NSW 2026, Australia