Legal

Ecosystem Privacy Notice

How information is handled when you use Allspice services provided by a publisher.

Last updated: August 10, 2026

1. Introduction

This Allspice Ecosystem Privacy Notice ("Ecosystem Privacy Notice") describes how Allspice Labs, Inc. and its subsidiaries and affiliates ("Allspice," "we," "us," or "our") collect, use, store, disclose, and otherwise process information in connection with tenant-specific services that Allspice provides on behalf of a participating publisher, business, creator, or other entity (the "Ecosystem Publisher"). The Ecosystem Publisher applicable to you is the publisher identified on the website, application, or other property through which you create or access your Ecosystem Account. The Ecosystem Publisher uses Allspice technology to provide account, recipe, shopping, pantry, meal-planning, artificial intelligence, membership, commerce, content-access, entitlement, customer-management, analytics, and related functionality (collectively, the "Ecosystem Services"). Your Ecosystem Account is separate from any standard Allspice account and from an account associated with another Ecosystem Publisher. Information associated solely with a separate standard Allspice account or another Ecosystem Publisher is not made available to the applicable Ecosystem Publisher merely because you use the same email address, name, device, or other identifier. This Ecosystem Privacy Notice applies to Allspice's processing through the Ecosystem Services. The Ecosystem Publisher's own privacy policy or notice separately governs the Ecosystem Publisher's collection and use of information, including information made available to it through the Ecosystem Services. We encourage you to review the Ecosystem Publisher's privacy policy.

For purposes of this Ecosystem Privacy Notice, "Publisher Customer Data" means personal information associated with an Ecosystem Account or generated through a user's interaction with the Ecosystem Services for a particular Ecosystem Publisher, but does not include information associated solely with a separate standard Allspice account or another Ecosystem Publisher's tenant. "Aggregate Data" means information relating to a group or category of users from which individual identities have been removed and that is not linked or reasonably linkable to an individual or household. "Deidentified Data" means information that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual and that Allspice maintains in deidentified form.

Please note the following sections containing important disclosures relating to the Ecosystem Services:

Cookies and Tracking Technologies: See Cookies and Related Online Tracking Technologies below.
Your Choices: See Your Rights and Choices below.
AI Processing: Information concerning data processed through AI-powered Ecosystem Services is described in What Type of Information Do We Collect? and How Do We Use Your Information? above.

If you are resident of certain states or countries, you may be entitled to additional rights. Please see the following quick-links below for easy access to additional information for such residents:

CA Residents: If you are a resident of California, please see our California Privacy Notice below.
Nevada Residents: If you are a resident of Nevada, please see our Nevada Privacy Notice below.
Washington Residents: If you are a resident of Washington, please see our Washington Health Privacy Notice below.
Connecticut Residents: if you are a resident of Connecticut, please see our Connecticut Health Privacy Notice.
Virginia, Colorado, Utah, Texas, Oregon, and Other State Residents: If you are a resident of Virginia, Colorado, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Kentucky, Nebraska, Rhode Island, Indiana, or Florida, please see our Additional State Privacy Rights below.
EU/EEA Residents: If you are a resident of the European Union or European Economic Area, please see our EU/EEA Privacy Notice below.

2. Allspice's Role and the Ecosystem Publisher's Role

Except for the limited processing purposes described below for which Allspice may independently determine the purposes and means of processing, Allspice processes Publisher Customer Data through the Ecosystem Services on behalf of the applicable Ecosystem Publisher. Depending on the applicable law, Allspice may act as a service provider, contractor, or processor to the Ecosystem Publisher.

The Ecosystem Publisher determines the purposes for which it establishes its customer relationship, makes the Ecosystem Services available, offers memberships or products, communicates with customers, configures integrations, accesses or exports Publisher Customer Data, and otherwise uses information made available through the Ecosystem Services. The Ecosystem Publisher is responsible for its own use, disclosure, security, retention, and other handling of information under its control, including information it exports or transmits to systems or providers it selects.

Allspice may independently process limited information where necessary to protect and secure Allspice systems, prevent and investigate fraud or abuse, comply with law and legal process, establish or defend legal claims, enforce Allspice agreements, administer Allspice's business relationship with the Ecosystem Publisher, maintain and troubleshoot the Ecosystem Services, and create and use Aggregate Data and Deidentified Data as described in this Ecosystem Privacy Notice.

Where Allspice acts as a service provider or processor, Allspice processes Publisher Customer Data in accordance with its agreement and instructions from the applicable Ecosystem Publisher and assists the Ecosystem Publisher in meeting applicable privacy obligations.

3. What Type Of Information Do We Collect?

Depending on how you interact with the Ecosystem Services, communicate with Allspice or the Ecosystem Publisher through the Ecosystem Services, and otherwise interact with the applicable Ecosystem Publisher's tenant, we may process the following categories of information:

Basic Identifying and Account Information. Your name, email address, account identifier, username, profile information, account status, authentication information, and similar identifiers.
Device and Security Information. IP address, device identifiers, browser information, cookies, tokens, security events, login activity, and other information used to authenticate, secure, and operate the Ecosystem Services.
Ecosystem Activity and Usage Information. Information regarding your interaction with the applicable Ecosystem Publisher and its Ecosystem Services, such as recipes viewed, searched, saved, or organized; searches; shopping-list information; pantry information; meal plans; feature usage; page and content interactions; engagement history; and similar activity.
Commercial and Membership Information. Publisher Offerings viewed or purchased; memberships and subscriptions; transaction and order history; payment status; membership status; trials; cancellations; refunds; entitlements; benefits; and content-access status.
User Content. Information you submit, save, upload, create, or provide through the Ecosystem Services, including reviews, recipe-related information, images, AI inputs and queries, responses, preferences, and other materials.
Communications and Preferences. Customer-service communications, marketing and communication preferences, Publisher email or CRM preferences, survey responses, and other communications relating to the applicable Ecosystem Publisher.
AI Information. Prompts, queries, files, images, context, responses, and other information processed when you use AI-powered Ecosystem Services.
Geolocation Information. Approximate location derived from IP address and, where enabled and permitted, more precise location information.
Inferences. Inferences derived from information associated with your use of the applicable Ecosystem Services, such as preferences or likely interests.
Aggregate and Deidentified Data. Data derived from use of the Ecosystem Services that has been aggregated or deidentified so it does not identify or reasonably link to an individual.
Consumer Health Information. Certain optional features may allow you to provide information concerning allergies, dietary restrictions, or other information that may constitute consumer health data or sensitive personal information under applicable law. Unless otherwise expressly disclosed to you, such information is not included in Publisher Customer Data made available to an Ecosystem Publisher. If an Ecosystem feature is introduced that makes such information available to an Ecosystem Publisher, we or the applicable Ecosystem Publisher will provide any additional disclosures and obtain any consent or authorization required by applicable law.

You may choose to voluntarily provide other information to us that we do not request, and, in such instances, and in such situations we have no control over what categories of personal information such disclosure may include. Any additional information provided by you to us is provided at your own risk.

4. How Do We Collect Your Information?

We collect or receive information directly from you, automatically through the Ecosystem Services, from the applicable Ecosystem Publisher, and from Publisher-directed or other service providers used in connection with the Ecosystem Services.

Directly from You. When you create or update an Ecosystem Account, use the Ecosystem Services, make purchases, communicate, save content, use AI features, or otherwise provide information.
Automatically. Through cookies, tokens, SDKs, logs, analytics, security technologies, and similar systems used in connection with the applicable Ecosystem Services.
From the Ecosystem Publisher. The Ecosystem Publisher may provide information to Allspice in connection with its customer relationship, including account details, membership information, complimentary access or entitlements, customer status, and instructions relating to your account or services.
From Publisher-Directed and Other Service Providers. We may receive information from payment processors such as Stripe, publisher-selected email or CRM providers, fraud-prevention providers, analytics providers, and other systems used to provide the Ecosystem Services.

5. Cookies and Related Online Tracking Technologies

Cookie preferences. The only optional cookie on this website is the Meta Pixel, and it is set only with your consent. You can change or withdraw your choice at any time: manage cookie preferences.

We use cookies, tokens, and similar technologies to create and maintain secure tenant-specific sessions; authenticate your Ecosystem Account; remember preferences; maintain membership, subscription, entitlement, and benefit status; determine whether you may access gated or premium content; prevent fraud and abuse; troubleshoot errors; and provide analytics and other functionality.

Certain authentication or membership cookies may be set or read through the Ecosystem Publisher's domain as necessary for Allspice to provide the Ecosystem Services on the Publisher's behalf.

The Ecosystem Publisher and its own service providers may separately use cookies or other tracking technologies. Those technologies are governed by the Ecosystem Publisher's privacy and cookie notices.

6. How Do We Use Your Information?

(a) Processing on Behalf of Your Ecosystem Publisher

We process Publisher Customer Data on behalf of the Ecosystem Publisher to create and administer Ecosystem Accounts; authenticate users; provide recipe, search, saved-content, shopping, pantry, meal-planning, and AI functionality; administer Publisher Memberships and Publisher Offerings; facilitate checkout and payment processing; maintain transactions, entitlements, benefits, and access permissions; provide gated or premium content; support customer service; operate Publisher-selected integrations; provide the Ecosystem Publisher with customer-management, analytics, and reporting functionality; transmit Publisher-configured communications; prevent fraud and abuse; and otherwise provide the Ecosystem Services configured by the Ecosystem Publisher.

(b) Limited Allspice Purposes

Allspice may independently process limited information as reasonably necessary to secure and protect Allspice systems; detect, investigate, and prevent fraud, abuse, or illegal activity; troubleshoot and maintain reliability; comply with law and legal process; establish or defend legal claims; enforce agreements; administer Allspice's relationship with the Ecosystem Publisher; and create Aggregate Data and Deidentified Data.

Allspice may use Aggregate Data and Deidentified Data for analytics, benchmarking, research, product and service development, performance measurement, business intelligence, security, and improving Allspice technologies and services.

Allspice does not use identifiable Publisher Customer Data processed on behalf of an Ecosystem Publisher to build Allspice advertising audiences or for Allspice's own cross-context behavioral advertising.

7. How Do We Disclose Your Information?

We may disclose or share your information with affiliated and non-affiliated third-parties, including in the following scenarios:

To Your Ecosystem Publisher. We make Publisher Customer Data associated with your Ecosystem Account and your use of the applicable Ecosystem Services available to the Ecosystem Publisher. Depending on the Ecosystem Services enabled, this may include identifying and contact information, profile information, saved and generated content, recipes and related activity, shopping-list and pantry information, meal plans, AI interactions, membership and subscription information, purchases, transactions, entitlements, benefits, content-access status, engagement information, communications, and preferences.
To Publisher-Selected Service Providers and Integrations. At the Ecosystem Publisher's direction, we may transmit Publisher Customer Data to service providers and integrations selected or configured by the Ecosystem Publisher, including email, CRM, analytics, fulfillment, and customer-management providers. The Ecosystem Publisher is responsible for its selection and use of such providers.
To Payment Processors. We transmit payment and transaction information to payment processors, including Stripe, as necessary to process Publisher Offerings and Publisher Memberships through the applicable Publisher's payment account.
To Allspice Service Providers. We may disclose information to infrastructure, hosting, security, analytics, support, and other providers that assist Allspice in providing the Ecosystem Services, subject to applicable contractual and confidentiality obligations.
For Legal Process, Security, and Protection. We may disclose information where required by law or reasonably necessary to protect rights, security, systems, users, or the Ecosystem Services.
Business Transfers. Information may be transferred as part of a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction, subject to applicable law.
No Cross-Tenant Disclosure Solely Because of Identity. An Ecosystem Publisher does not receive information associated solely with a separate standard Allspice account or another Ecosystem Publisher solely because those accounts use the same email address, name, device, or other identifier.

Once Publisher Customer Data is exported, downloaded, transmitted to a Publisher-selected provider, or otherwise placed under the Ecosystem Publisher's control, the Ecosystem Publisher's privacy and security practices govern its subsequent handling of that information. Allspice is not responsible for such subsequent processing except to the extent attributable to Allspice's own acts or omissions or otherwise required by applicable law.

8. Analytics and Advertising

Allspice may perform analytics necessary to provide, secure, measure, and improve the Ecosystem Services and may provide tenant-specific analytics and reporting to the Ecosystem Publisher.

Allspice may also create and use Aggregate Data and Deidentified Data as described in this Notice.

The Ecosystem Publisher may independently use Publisher Customer Data for its own advertising, marketing, audience, or customer-relationship purposes as described in its own privacy policy and subject to applicable law. Allspice may provide technical integrations or services at the Ecosystem Publisher's direction but does not independently use identifiable Publisher Customer Data processed on behalf of the Publisher for Allspice's own cross-context behavioral advertising or matched-advertising audiences.

9. How Do We Protect Your Information?

Although no system can guarantee the complete security of your information, we take all commercially reasonable steps to ensure your information is protected in alignment with all applicable laws and regulations, as appropriate to the sensitivity of your information. Allspice maintains commercially reasonable administrative, technical, and organizational safeguards designed to protect Publisher Customer Data while such information is processed within systems controlled by Allspice.

The Ecosystem Publisher is responsible for security measures applicable to systems under its control and to copies of Publisher Customer Data that it downloads, exports, receives, or transmits to its own providers. Allspice is not responsible for the security practices of the Ecosystem Publisher or a Publisher-selected provider after information has been transferred to such systems, except to the extent an incident results from Allspice's own acts or omissions.

Nothing in this section limits any security obligation imposed directly on Allspice by applicable law.

10. How Long Do We Keep Your Information?

The Ecosystem Publisher determines the retention requirements applicable to much of its Publisher Customer Data, subject to applicable law and its agreement with Allspice. Allspice retains Publisher Customer Data for as long as necessary to provide the Ecosystem Services, follow the Ecosystem Publisher's instructions, maintain applicable accounts, memberships and transactions, comply with legal requirements, resolve disputes, enforce agreements, and protect against fraud, abuse, or security incidents.

If the Ecosystem Publisher terminates or discontinues the Ecosystem Services, Publisher Customer Data may be returned, exported, retained, or deleted in accordance with Allspice's agreement with the Ecosystem Publisher and applicable law.

Information previously exported to or stored in systems controlled by the Ecosystem Publisher or its selected service providers is subject to the Publisher's own retention practices.

11. Third Party Sites

The Ecosystem Services are provided within or in connection with an Ecosystem Site operated by the Ecosystem Publisher. Allspice does not control the Ecosystem Publisher's website, content, advertising technologies, independent data collection, or other systems that are not part of the Ecosystem Services.

The Ecosystem Publisher's independent collection and processing of personal information is governed by its own privacy policy or notice. Other third-party services and integrations may also operate under their own privacy policies.

12. Your Rights and Choices

A. Account

The Ecosystem Publisher is the primary point of contact for privacy rights requests relating to Publisher Customer Data processed by Allspice on its behalf. Requests to access, correct, delete, restrict, or obtain a copy of Publisher Customer Data should be directed to the applicable Ecosystem Publisher using the contact information provided in its privacy notice.

Allspice assists Ecosystem Publishers with applicable privacy rights requests where required by law and our agreement with the Publisher. If you submit a request concerning Publisher Customer Data directly to Allspice, we may forward or refer the request to the applicable Ecosystem Publisher and assist the Publisher in responding.

For limited information that Allspice processes for purposes for which Allspice independently determines the purposes and means of processing, applicable privacy requests may be submitted directly to Allspice at support@allspicelabs.com.

B. Communications

The following is information about how to opt out of receiving certain communications from us, depending on means of delivery:

E-mails. Promotional communications sent by or on behalf of the Ecosystem Publisher are subject to the Publisher's communication preferences and policies. Transactional, security, membership, purchase, access, or other service-related messages may be sent as necessary to operate the Ecosystem Services.

C. Cookies and Tracking Technologies

The following disclosures relate to your rights and choices in connection with cookies and other tracking technologies:

Do Not Track. Your browser settings may allow you to automatically transmit a "Do Not Track" signal to online services you visit. We do not currently monitor or take action with respect to "Do Not Track" signals. For more information on "Do Not Track," visit http://www.allaboutdnt.com.
Cookies and Pixels. Most browsers accept cookies by default. You can instruct your browser, by changing its settings, to decline or delete cookies. If you use multiple browsers on your device, you will need to instruct each browser separately. Your ability to limit cookies is subject to your browser settings and limitations.
Location Technologies. Where the Ecosystem Services request access to precise location information, you may withdraw that permission through your browser or device settings.

Please be aware that if you disable or remove tracking technologies some parts of the Service may not function correctly.

D. Publisher Advertising and Marketing

The Ecosystem Publisher may use Publisher Customer Data for advertising, marketing, or customer-relationship purposes as described in the Ecosystem Publisher's privacy notice and subject to applicable law. Requests or choices concerning the Ecosystem Publisher's use of Publisher Customer Data for such purposes should be directed to the Ecosystem Publisher. As described in Section 8, Allspice does not independently use identifiable Publisher Customer Data processed on behalf of the Ecosystem Publisher for Allspice's own cross-context behavioral advertising or matched-advertising audiences.

E. Your Legal Rights Under Applicable Laws

Depending on where you reside, you may have certain legal rights in relation to your information.

CA Residents: If you are a resident of California, please see our California Privacy Notice below.
Nevada Residents: If you are a resident of Nevada, please see our Nevada Privacy Notice below.
Washington Residents: If you are a resident of Washington, please see our Washington Health Privacy Notice below.
Connecticut Residents: if you are a resident of Connecticut, please see our Connecticut Health Privacy Notice.
Virginia, Colorado, Utah, Texas, Oregon, and Other State Residents: If you are a resident of Virginia, Colorado, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Kentucky, Nebraska, Rhode Island, Indiana, or Florida, please see our Additional State Privacy Rights below.
EU/EEA Residents: If you are a resident of the European Union or European Economic Area, please see our EU/EEA Privacy Notice below.

For more information about how to exercise applicable legal rights under a respective law, please see Exercising Legal Rights Requests below.

13. Children

The Ecosystem Services are not intended for children under the age of 13. This includes any links to other websites that we provide for our convenience. We don't knowingly collect the information of children under 13 for any reason.

14. Changes to this Ecosystem Privacy Notice

We may change this Ecosystem Privacy Notice from time to time. Any and all changes will be reflected on this page, and where appropriate provided in person or by another electronic method. The effective date will be stated at the top of this Ecosystem Privacy Notice. You should regularly check this page for any changes to this Ecosystem Privacy Notice.

15. Accessibility

To print a copy of this Ecosystem Privacy Notice, please click here.

If you require a copy of this Ecosystem Privacy Notice in an alternative format, please Contact Us.

16. Contact Us

If you have any comments or questions, please contact us through the following methods:

Physical Address: 188 Valley Street, Suite 101, Providence RI 02909

Email: support@allspicelabs.com

17. California Privacy Notice

A. ADDITIONAL CALIFORNIA RESIDENT PRIVACY DISCLOSURES

With respect to Publisher Customer Data for which Allspice processes personal information on behalf of an Ecosystem Publisher, the Ecosystem Publisher is the applicable "business" and Allspice acts as its "service provider" or "contractor" to the extent those terms apply under the CCPA. Allspice processes such information for the limited and specified purposes described in this Ecosystem Privacy Notice and its agreement with the Ecosystem Publisher.

Allspice does not sell or share Publisher Customer Data processed on behalf of an Ecosystem Publisher for Allspice's own cross-context behavioral advertising.

Under the California Consumer Privacy Act of 2018 and any subsequent amendments including the California Privacy Rights Act of 2020 (collectively, "CCPA"), California residents are entitled to the following additional disclosures about our data processing. These disclosures apply solely to individuals who live in the State of California ("California Residents"). All terms used in this section have the same meaning as when used in the CCPA.

In the preceding 12 months, we have collected the categories of Personal Data: identifiers, including name, email, and username; commercial information, including information regarding purchases, transactions, memberships, and subscriptions; internet or other similar network activity; geolocation data; and inferences drawn from other categories of personal information.
The business and commercial purposes for which we collect Personal Data are described in this Ecosystem Privacy Notice. The categories of third parties to whom we "disclose" this information for a business purpose are described in the "How Do We Disclose Your Information?" section above.
Allspice does not sell or share Publisher Customer Data processed on behalf of an Ecosystem Publisher for Allspice's own cross-context behavioral advertising. The Ecosystem Publisher's independent sale, sharing, targeted advertising, or other use of Publisher Customer Data, if any, is governed by the Ecosystem Publisher's own privacy notice and applicable law.
We do not knowingly sell the Personal Data of minors under age 18.

You have certain rights regarding the Personal Data we collect or maintain about you. Please note that these rights are not absolute, and there may be cases when we decline your request as permitted by law. These rights include:

Right to know: You have the right to access categories of Personal Data we process and the purpose.
Right to access: You have the right to request that we disclose what Personal Data we have collected and maintained about you in the past 12 months.
Right to delete: You have the right to request that we delete Personal Data collected or maintained by us, subject to certain exceptions.
Right to correct: You have the right to request that we correct any inaccurate Personal Data that we maintain about you.
The right to request information concerning the categories of Personal Data (if any) that we disclose to third parties or affiliates for their direct marketing purposes.
The right to opt-out of the sale of your Personal Data.
Right to limit the use of sensitive personal information: You have the right to direct businesses to only use your sensitive personal information for limited purposes.
The right to appeal: You can appeal any decision by us to deny your privacy rights under applicable laws.
The right to non-discrimination: You will not receive any discriminatory treatment when you exercise one of your privacy rights.

For Publisher Customer Data that Allspice processes on behalf of an Ecosystem Publisher, California privacy rights requests should be submitted to the applicable Ecosystem Publisher. The Ecosystem Publisher is responsible for evaluating and responding to such requests, and Allspice will assist the Ecosystem Publisher as required by applicable law and our agreement with the Ecosystem Publisher. If a request concerning Publisher Customer Data is submitted directly to Allspice, we may refer or forward the request to the Ecosystem Publisher.

For personal information that Allspice independently controls for the limited purposes described in this Notice, you may submit applicable requests directly to Allspice using the contact information below. We may take reasonable steps to verify your identity and will respond as required by applicable law.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before fulfilling your request.

B. CALIFORNIA'S "SHINE IN THE LIGHT" LAW

If you are a California resident and have an account with us, you have the right to request information from us once per calendar year regarding the customer information we share with third parties for the third parties' direct marketing purposes. To request this information, please send an email to support@allspicelabs.com with 'Request for California Privacy Information' in the subject line and in the body of your message. We will provide the requested information to you via an email response.

C. CALIFORNIA'S "ERASER BUTTON" LAW

If you are a California resident under 18 years old and a registered user of the Ecosystem Services (as defined above), you can request that we remove content or information that you have posted to our website or other online services. Fulfillment of the request may not ensure complete or comprehensive removal (e.g., if the content or information has been reposted by another user). To request removal of content or information, please send an email to support@allspicelabs.com.

18. Nevada Privacy Notice

A. Sale Of Personal Information

If you are a Nevada resident, you have the right to submit a request directing us not to make any sale of your personal information. We do not sell your personal information as defined under Nevada law. However, to request email confirmation that we do not sell your personal information, please send an email to support@allspicelabs.com with "Nevada Opt-Out of Sale" in the subject line and in the body of your message. We will provide the requested information to you via an email response.

B. Health Data Privacy Notice

You have certain rights over how we process your health data under Nevada law. For the purpose of this section, "health data" refers to information that is linked or reasonably capable of being linked to you and that is used to identify any past, present, or future health status of you. This may include any health condition or treatment.

What categories of health data do we collect from you, and why do we collect it? When you engage with the Ecosystem Services we offer to help identify applicable products and recipes, we may collect information related to your allergies or other general health information related to dietary needs. The purpose of this collection is to provide you with product recommendations.
Who do we collect your health data from, and how do we collect it? We collect your health data when you directly engage with us through the Ecosystem Services to use our shopping list features, recipe selections, and other uses related product recommendations.
How do we use your health data? We use your health data to determine appropriate product recommendations.
Do we share your health data, and with whom? Your consumer health data is shared with Google Firebase and Google Cloud, for the purpose of data storage.
How will you notify me of any material changes to this notice? See the section entitled Changes above.
Will any third parties track my health data across other websites? No third parties other than Google Firebase and Google Cloud will collect your health data over time and across different websites or online services when you use the Ecosystem Services.
Your Nevada Health Data Rights. You have a right to submit a request for access, deletion, and appeal. To exercise these rights, see Exercising Your Legal Rights below.

19. Washington Health Privacy Notice

If you are a Washington resident, the following disclosures are provided to you pursuant to the Washington MY Health MY Data Act. For the purpose of this section, the phrase "health data" means information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Physical health status can include individual health conditions or treatment.

What categories of health data do we collect from you, and why do we collect it? When you engage with the Ecosystem Services we offer to help identify applicable products and recipes, we may collect information related to your allergies or other general health information related to dietary needs. The purpose of this collection is to provide you with product recommendations.
Who do we collect your health data from, and how do we collect it? We collect your health data when you directly engage with us through the Ecosystem Services to use our shopping list features, recipe selections, and other uses related product recommendations.
How do we use your health data? We use your health data to determine appropriate product recommendations.
Do we share your health data? Your consumer health data is shared with Google Firebase and Google Cloud, for the purpose of data storage.
What rights do you have concerning your health data? You have a right to submit a request for access, deletion, and appeal. To exercise these rights, see Exercising Your Legal Rights below.

20. Connecticut Health Privacy Notice

If you are a Connecticut resident, the following disclosures are provided to you pursuant to the Connecticut Data Privacy Act as it relates to consumer health data. For the purpose of this section, the phrase "consumer health data" means any personal data used to identify a consumer's physical or mental health condition or diagnosis.

What categories of consumer health data do we collect from you, and why do we collect it? When you engage with the Ecosystem Services we offer to help identify applicable products and recipes, we may collect information related to your allergies or other general health information related to dietary needs. The purpose of this collection is to provide you with product recommendations.
Who do we collect your consumer health data from, and how do we collect it? We collect your consumer health data when you directly engage with us through the Ecosystem Services to use our shopping list features, recipe selections, and other uses related product recommendations.
How do we use your consumer health data? We use your consumer health data to determine appropriate product recommendations.
Do we share your consumer health data? Your consumer health data is shared with Firebase and Google Cloud, for the purpose of data storage.
What rights do you have concerning your health data? You have a right to submit a request for access, correction, deletion, and portability. In addition, we will not sell your consumer health data without first obtaining your consent. To exercise these rights, see Exercising Your Legal Rights below.

21. Additional State Privacy Rights

If you are a resident of Virginia, Colorado, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Kentucky, Nebraska, Rhode Island, Indiana, or Florida, you may have certain rights under your state's comprehensive privacy law. These rights may include:

Right to Access: You have the right to confirm whether we are processing your personal data and to access such data.
Right to Correct: You have the right to correct inaccuracies in your personal data.
Right to Delete: You have the right to delete personal data that you have provided to us, subject to certain exceptions.
Right to Data Portability: You have the right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format (available in certain states).
Right to Opt Out: You have the right to opt out of: (a) the processing of your personal data for purposes of targeted advertising; (b) the sale of your personal data; (c) profiling in furtherance of decisions that produce legal or similarly significant effects (available in certain states).
Right to Appeal: If we decline to take action on your request, you have the right to appeal our decision.
Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights.

Please note that certain states have specific requirements regarding health data, sensitive data, or data concerning minors. We process such data in accordance with applicable state law requirements. To exercise these rights, see Exercising Your Legal Rights below.

22. EU/EEA Privacy Notice

If you are located in the European Union (EU) or European Economic Area (EEA), the following additional disclosures apply to our processing of your personal data under the General Data Protection Regulation (GDPR).

Role of the Ecosystem Publisher and Allspice. To the extent the GDPR applies and Allspice processes Publisher Customer Data solely on behalf of the Ecosystem Publisher, the Ecosystem Publisher acts as the controller and Allspice acts as a processor. The Ecosystem Publisher is responsible for determining and communicating the applicable legal basis for such processing.

Allspice processes such Publisher Customer Data pursuant to the Ecosystem Publisher's documented instructions and its agreement with the Ecosystem Publisher.

To the extent Allspice independently processes personal data for the limited purposes described in this Notice, Allspice may rely, as applicable, on performance of its contract with you, legitimate interests such as security, fraud prevention and platform integrity, compliance with legal obligations, or consent where required.

A. Legal Bases for Allspice's Independent Processing

Where Allspice independently determines the purposes and means of processing for the limited Allspice purposes described in this Notice, Allspice may rely, as applicable, on performance of its contract with you, legitimate interests such as security, fraud prevention, service reliability and platform integrity, compliance with legal obligations, or consent where required. The Ecosystem Publisher is responsible for identifying and communicating the legal basis applicable to processing for which it acts as controller.

B. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of Access (Article 15): You have the right to obtain confirmation as to whether we process your personal data and, if so, to access such data and receive information about how it is processed.
Right to Rectification (Article 16): You have the right to request correction of inaccurate personal data and to have incomplete personal data completed.
Right to Erasure / "Right to be Forgotten" (Article 17): You have the right to request deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent, or where you object to processing.
Right to Restriction of Processing (Article 18): You have the right to request restriction of processing of your personal data in certain circumstances, including where you contest the accuracy of the data or object to processing.
Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
Right to Object (Article 21): You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes (including profiling).
Right to Withdraw Consent (Article 7): Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Right Not to be Subject to Automated Decision-Making (Article 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects. Our AI Features provide recommendations and suggestions but do not make automated decisions that produce legal or similarly significant effects concerning you.
Right to Lodge a Complaint (Article 77): You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

To exercise these rights, see Exercising Your Legal Rights below.

23. Exercising Legal Rights Requests

We will take reasonable steps to verify your identity before processing your request. We may request additional information from you to authenticate your request and confirm you are the individual about whom we collected information. You may designate an authorized agent to submit requests on your behalf. We will require written proof that the agent is authorized to act on your behalf and may require you to verify your identity directly with us.

We will respond to verified requests within the timeframes required by applicable law, typically within 45 days of receipt. We do not charge a fee to process your request unless it is excessive, repetitive, or manifestly unfounded. If we determine a fee is warranted, we will notify you of the fee and obtain your approval before proceeding.

There are certain circumstances where applicable law allows us to retain certain information and we will not be able to delete such information. In such instances, we will inform you of what information cannot be deleted.