1. Who We Are

This Privacy Policy describes how Virtus Communications Publishing Group, LLC ( “VCPG,” “we,” “us,” “our”), a California limited liability company located in Redlands, CA 92374, collects, uses, and protects your personal information when you use the Steadykept platform. The platform is designed and developed by Virtus Development Enterprise (VDE), the development-services brand of Virtus Communications Publishing Group, LLC. For the purposes of the GDPR and UK GDPR, Virtus Communications Publishing Group, LLC is the Data Controller.

2. Scope

This Policy applies to all personal information collected through the Steadykept web application, mobile application, APIs, and any related services operated by VCPG (collectively, the “Platform”). It does not apply to the privacy practices of third-party services linked from the Platform. We encourage you to review the privacy policies of any third parties you interact with through the Platform.

3. Information We Collect

3.1 Information You Provide Directly:

Account information: name, email address, and password (stored as a bcrypt hash — we never store plaintext passwords)
Household inventory data: item names, categories, quantities, locations, purchase dates, and expiration dates
Scan events: barcode scans, UPC lookups, and manually entered product data
Household configuration: room names, storage areas, and household size (optional)
Communications: support requests, feedback, bug reports, and other messages you send us

3.2 Information Collected Automatically:

Usage data: features accessed, session duration, pages visited, and actions taken within the Platform
Device and browser information: browser type and version, operating system, and screen resolution
IP address: collected in hashed or truncated form for security and fraud prevention; not used for advertising or tracking
Authentication session tokens: used to maintain your signed-in state
Error and performance logs: used to identify and fix bugs and improve platform stability

3.3 Information We Do NOT Collect: We do not collect Social Security numbers, government-issued IDs, precise real-time geolocation, or biometric data. If and when paid subscriptions launch, payment card details will be handled directly by a PCI-DSS-compliant third-party payment processor; we do not store your full card number.

4. How We Use Your Information

We use your personal information only for the following purposes, and will not use it for any incompatible purpose without obtaining your prior consent:

Platform operation — authentication, inventory management, replenishment list generation, and account administration
Personalized analytics — consumption velocity, restock timing estimates, and household usage pattern tracking
AI-powered features — replenishment predictions, recipe suggestions, and savings discovery (see Section 8)
Security and fraud prevention — detecting unauthorized access, protecting platform integrity, and responding to security incidents
Platform improvement — analyzing aggregated, anonymized usage patterns to improve features and user experience
Legal compliance — fulfilling our obligations under applicable law and responding to valid legal process
Communications — sending service-related notices, billing alerts, security warnings, and (with your opt-in consent) product announcements

4.1 Legal Bases for Processing (EEA/UK). Where the GDPR or UK GDPR applies, we rely on the following legal bases: (a) performance of a contract — to provide the Platform, operate your account, and deliver features you request; (b) legitimate interests — to secure the Platform, prevent fraud, and improve our services using aggregated, anonymized data, where not overridden by your rights; (c) consent — for optional communications and any non-essential processing, which you may withdraw at any time; and (d) legal obligation — to comply with applicable law and respond to valid legal process.

5. Data Stewardship Commitment

Virtus Communications Publishing Group, LLC is committed to acting as a responsible steward of your data. This means:

No sale of your data. We do not sell, rent, or broker your personal information, household inventory data, purchasing habits, or usage patterns to any third party for commercial gain. The only exception is a business transfer as described in Section 6.4, in which any successor is required to honor commitments at least as protective as this Policy.
Aggregation threshold. Any community-level or market-level analytics derived from user data are aggregated across a minimum of one hundred (100) distinct households before use or disclosure, preventing re-identification of any individual household.
Purpose limitation. Data collected for one stated purpose will not be repurposed for an incompatible use without your explicit prior consent.
Data minimization. We collect only the personal information genuinely necessary to operate the Platform effectively.

6. Data Sharing and Third-Party Processors

6.1 We Do Not Sell Your Data. We do not sell personal information to third parties under any circumstances.

6.2 Service Providers (Data Processors). We share limited personal information with third-party service providers strictly as necessary to operate the Platform. These providers act as our data processors and are contractually required to: (a) process data only on our documented instructions; (b) implement appropriate technical and organizational security measures; (c) not use data for their own independent purposes; and (d) comply with applicable data protection law. Categories of processors include: cloud infrastructure (hosting and storage), payment processing, transactional email delivery, error tracking and logging, and barcode/product databases.

6.3 Legal Disclosure. We may disclose personal information if required to do so by a valid legal process (court order, subpoena, or enforceable government demand), or to protect the rights, property, or safety of VCPG, our users, or the public. We will provide affected users with notice before complying with such a demand, where legally permitted.

6.4 Business Transfers. If Virtus Communications Publishing Group, LLC undergoes a merger, acquisition, or sale of substantially all assets, your personal information may be transferred as part of that transaction. We will provide notice of any such transfer and you will have the opportunity to export your data before any transfer takes effect.

6.5 Aggregated Data. We may share anonymized, aggregated data (subject to the 100-household threshold in Section 5) for research, benchmarking, or product improvement, provided such data cannot reasonably be used to identify you.

7. Data Retention

7.1 Active Accounts. We retain your personal information for as long as your account is active and for as long as necessary to provide the Platform and fulfill the purposes described in this Policy.

7.2 Account Deletion. When you delete your account, we will delete or irrevocably anonymize your personal information within thirty (30) calendar days, except where retention is required by applicable law (such as financial record-keeping obligations under tax or accounting law).

7.3 Post-Termination Export Window. Following account deletion or termination, your User Data remains available for export for thirty (30) calendar days. After that period, it will be permanently deleted.

7.4 Backup Retention. Deleted data may remain in encrypted backups for up to ninety (90) days before permanent deletion from all backup systems.

7.5 Legal Holds. Where retention is required by law or for the defense of legal claims, we retain only the minimum necessary data for the minimum legally required period.

8. AI and Automated Processing

The Platform uses algorithmic processing and AI Features (including replenishment predictions, recipe suggestions, and consumption analytics). Key disclosures regarding automated processing:

AI Features process your User Data to generate personalized recommendations; these are informational suggestions only and are NOT professional dietary, medical, nutritional, financial, or safety advice.
We do not use fully automated decision-making that produces legal or similarly significant effects on you without human oversight.
If you are in the European Economic Area (EEA), you have the right under Article 22 GDPR to request human review of any automated decision that significantly affects you.
AI processing is performed by trusted processors under Data Processing Agreements (DPAs) as described in Section 6.2. VCPG does not transmit your raw User Data to external AI providers without your knowledge and without appropriate DPA protections.

9. Your Privacy Rights

Depending on your jurisdiction, you have the following rights regarding your personal information. We will respond to verified requests within thirty (30) days (or sixty (60) days where legally permitted for complex requests).

9.1 Rights Available to All Users:

Access. Request a copy of the personal information we hold about you.
Correction. Request correction of inaccurate or incomplete information.
Deletion. Request deletion of your personal information, subject to lawful retention requirements.
Export / Portability. Receive your data in a machine-readable format (JSON or CSV).
Opt-Out of Non-Essential Processing. Opt out of analytics or marketing communications beyond what is strictly necessary to operate the Platform.

9.2 California Residents (CCPA/CPRA): In addition to the above, California residents have the right to: know the specific categories of personal information collected and the business purpose for collection; opt out of the “sale” or “sharing” of personal information (we do not sell or share personal information as those terms are defined under the CCPA/CPRA, but you may exercise this opt-out at any time through your account settings or by contacting us at the address in Section 14); limit use and disclosure of sensitive personal information; and be free from discrimination for exercising your privacy rights.

9.3 EEA and UK Residents (GDPR / UK GDPR): In addition to the above, EEA and UK residents have the right to: object to processing based on legitimate interests; restrict processing while a dispute is resolved; lodge a complaint with your local data protection supervisory authority; and request human review of significant automated decisions under Article 22 GDPR.

9.4 How to Exercise Your Rights. Exercise your rights through your account settings, or through our contact form (see Section 14). We may need to verify your identity before fulfilling a request to protect against unauthorized access.

10. Children’s Privacy

The Platform is NOT directed to children under the age of thirteen (13), and we do not knowingly collect personal information from children under 13.

Under 13 — Strictly Prohibited. If we discover we have collected information from a child under 13 without verifiable parental consent, we will delete that information promptly and without delay, consistent with our obligations under the Children’s Online Privacy Protection Act (COPPA) as amended.
Ages 13 to 17. As a matter of VCPG policy (and not a COPPA requirement, which applies only to children under 13), users between 13 and 17 must have permission from a parent or legal guardian before using the Platform. By allowing a minor to access the Platform, a parent or guardian accepts this Privacy Policy on the minor’s behalf and is responsible for supervising that use.
Parental Rights. Parents and guardians of users between 13 and 17 may request access to, correction of, or deletion of their child’s personal information by contacting us at the address in Section 14.
Reporting. If you believe a child under 13 has submitted personal information to the Platform without parental consent, please contact us immediately so we can investigate and remove the information.

11. Security and Breach Notification

11.1 Security Measures. We implement industry-standard technical and organizational security measures, including: TLS encryption for all data in transit; bcrypt-hashed passwords (minimum cost factor 12); encryption of sensitive data at rest; role-based access controls limiting employee access to personal data; regular security assessments; and audit logging of data access events.

11.2 Inherent Risks. No security system is impenetrable. By using the Platform, you acknowledge the inherent risks of transmitting information over the internet. VCPG cannot guarantee the absolute security of your personal information.

11.3 Breach Notification. In the event of a personal data breach that is reasonably likely to result in risk to your rights and freedoms, VCPG will: (a) notify affected users without undue delay after becoming aware of the breach; (b) describe the nature of the breach, the categories and approximate volume of personal data affected, and the likely consequences; (c) describe the measures taken or proposed to address and mitigate the breach; and (d) notify the appropriate regulatory authority where required by law. Notifications will be sent to your registered email address, and where email is unavailable, posted prominently on the Platform.

12. International Data Transfers

The Platform is operated from the United States. If you access the Platform from outside the United States, your personal information may be transferred to and processed in the United States or other countries where our service providers operate.

EEA and UK Users. For transfers from the European Economic Area or United Kingdom to countries not recognized as providing adequate data protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards required by the GDPR and UK GDPR, to protect your personal information during transfer.
Other International Users. By accessing the Platform from outside the United States, you acknowledge that your personal information will be transferred to the United States subject to the protections described in this Policy.

13. Cookies and Tracking

13.1 Essential Cookies Only. We use strictly necessary cookies and session tokens solely to: authenticate your identity and maintain your signed-in session; preserve your account preferences and settings; and protect against cross-site request forgery (CSRF). We do NOT use third-party advertising cookies, behavioral tracking pixels, or cross-site tracking technologies.

13.2 No Third-Party Tracking. We do not embed third-party tracking scripts, advertising network pixels, or social media tracking tags that monitor your behavior across other websites or applications.

13.3 Cookie Management. You can configure your browser to refuse or delete cookies. However, disabling essential session cookies will prevent you from accessing your account and using the Platform’s core features.

14. Contact and Complaints

For privacy inquiries, to exercise your rights, or to report a concern about how we handle your personal information, contact us at:

Virtus Communications Publishing Group, LLC
Attn: Privacy & Data Protection
Redlands, CA 92374

To reach us directly — including to exercise your privacy rights — please use our contact form, which is monitored and routes to our privacy and data-protection team.

If you are located in the EEA or UK and believe we have not adequately addressed your concern, you have the right to lodge a complaint with your local data protection supervisory authority (for example, the ICO in the UK or the relevant EU DPA).

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. For material changes — including changes to the categories of data we collect, how we use data, our data-sharing arrangements, or your rights — we will provide at least thirty (30) days’ prior written notice by email to your registered address before the change takes effect. For non-material updates (such as clarifications and grammatical corrections), the updated Policy will be posted on the Platform with a revised “Effective Date.” Your continued use of the Platform after the notice period constitutes your acceptance of the updated Policy. If you do not agree to a material change, you may close your account and export your User Data before the change takes effect.