1. Introduction
This Privacy Policy explains how Kuerf ("we", "us", "our") collects, uses, and protects information when you use the Kuerf mobile application and website (collectively, the "Service"). We are committed to protecting your privacy and being transparent about the data we process.
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.
2. Data Controller
The data controller responsible for your information is:
Kuerf
Email: contact@kuerf.lu
Website: https://kuerf.lu
3. Information We Collect
We collect only the minimum information necessary to provide and improve the Service. We do NOT require account creation, login, or registration. We do NOT collect your name, email address, phone number, or any other personal identifier.
3.1 Information You Provide Voluntarily
- Shopping list items: Text you enter into the shopping list feature. This data is stored locally on your device only and is never transmitted to our servers.
- Basket items: Deals you save to your basket. This data is stored locally on your device only and is never transmitted to our servers.
3.2 Information Collected Automatically
(a) Device Location Data
If you grant permission, we access your device's approximate or precise geographic location to show you nearby stores and relevant deals. Location data is processed in real time on your device and is NOT stored on our servers. You may deny or revoke location permission at any time through your device settings; the Service will remain functional using a default location (Luxembourg City).
(b) Analytics Data (Subject to Consent on Web)
We use Google Firebase Analytics to collect anonymised, aggregated usage data, including:
- App opens and session duration
- Screen views and navigation patterns
- Feature interactions (e.g., deal views, search queries, filter usage, basket operations)
- Non-identifying device properties (e.g., whether location or notifications are enabled)
- App version and build number
On the web version, analytics data is collected ONLY if you provide explicit consent via the cookie consent banner. On mobile, Firebase Analytics operates in accordance with its standard SDK behaviour and applicable platform policies.
Analytics data is associated with randomly generated device identifiers managed by Firebase. We do NOT link analytics data to any personally identifiable information.
(c) Advertising Data (Mobile Only)
On mobile platforms, the Service may display advertisements provided by Google AdMob. The Google Mobile Ads SDK may collect certain data as described in Google's privacy policy. On iOS, we request your consent via Apple's App Tracking Transparency framework before any cross-app tracking occurs. You may opt out of personalised ads at any time through your device's advertising settings. Ads are NOT displayed on the web version.
(d) Map Tile Requests
The Service uses OpenStreetMap (OSM) for map display. When you view the map, your device makes requests to OSM tile servers, which may log your IP address in accordance with the OpenStreetMap Foundation's privacy policy. We have no control over data processed by OSM.
3.3 Information We Do NOT Collect
We do not collect, store, or process:
- Names, email addresses, phone numbers, or postal addresses
- Payment information or financial data
- Photographs, contacts, or other device content
- Health, biometric, or genetic data
- Social media identifiers
- Browsing history outside the Service
- Precise location data on our servers
4. How We Use Information
We use the information described above solely for the following purposes:
- To display supermarket deals and store locations relevant to your area
- To enable shopping list and basket functionality on your device
- To analyse aggregated, anonymous usage patterns to improve the Service
- To display advertisements on mobile platforms
- To schedule local deal-expiry reminder notifications on your device
We do NOT use your information for profiling, automated decision-making, or selling to third parties.
5. Data Storage and Retention
5.1 On-Device Storage
Shopping list items, basket contents, user preferences (theme, language), and consent records are stored locally on your device using standard platform storage mechanisms (e.g., SharedPreferences, localStorage). This data remains on your device and is deleted when you uninstall the app or clear the app's data.
5.2 Analytics Data
Firebase Analytics data is retained in accordance with Google's data retention policies. We use the default retention period. Analytics data is anonymised and aggregated and cannot be used to identify individual users.
5.3 Server-Side Data
Deal, store, and chain information is stored on Google Firebase (Firestore) servers. This is public catalogue data and does not contain any user-generated or user-identifying content. We do not store any user data on our servers.
6. Data Sharing and Third Parties
We do not sell, rent, or trade your information to any third party.
We use the following third-party services, each of which may process limited data as described below:
| Service | Purpose | Data Processed | Privacy Policy |
|---|---|---|---|
| Google Firebase Analytics | Anonymous usage analytics | Anonymised device ID, usage events | Link |
| Google AdMob | Mobile advertisements | Advertising ID, device info | Link |
| OpenStreetMap | Map tile display | IP address (via tile requests) | Link |
We require that these third parties process data in compliance with applicable data protection laws.
7. Cookies and Similar Technologies
7.1 Web Version
On the web version, Firebase Analytics may use cookies or similar technologies. These are activated ONLY after you provide explicit consent via the cookie consent banner.
You may withdraw your consent at any time through the cookie settings accessible from the app's footer or settings. Withdrawing consent will disable analytics collection going forward but will not affect data already collected.
7.2 Mobile Version
On mobile platforms, the Service uses standard platform storage mechanisms (SharedPreferences) that are functionally similar to cookies. These are used exclusively for storing your local preferences and are not used for tracking.
8. Your Rights
Under applicable data protection legislation, including the EU General Data Protection Regulation (GDPR) and the Luxembourg Law of 1 August 2018, you have the following rights:
- (a) Right of Access — You may request information about what data we process about you.
- (b) Right to Rectification — You may request correction of inaccurate data.
- (c) Right to Erasure — You may request deletion of your data. Since we store no personal data on our servers, uninstalling the app and clearing browser data effectively erases all data associated with your use of the Service.
- (d) Right to Restriction of Processing — You may request that we restrict the processing of your data.
- (e) Right to Data Portability — You may request a copy of your data in a portable format.
- (f) Right to Object — You may object to the processing of your data, including for analytics purposes.
- (g) Right to Withdraw Consent — Where processing is based on consent (e.g., cookies, location, tracking transparency), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at contact@kuerf.lu. We will respond within 30 days.
You also have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD): https://cnpd.public.lu.
9. Legal Basis for Processing
We process data on the following legal bases under GDPR Article 6:
- Consent (Art. 6(1)(a)): Analytics cookies on web, location access, iOS tracking transparency.
- Legitimate interest (Art. 6(1)(f)): Anonymous analytics on mobile to improve the Service, provided this does not override your fundamental rights.
10. International Data Transfers
Firebase and AdMob services are operated by Google. Data processed by these services may be transferred to and stored in countries outside the European Economic Area (EEA), including the United States. Google participates in the EU–US Data Privacy Framework and implements appropriate safeguards for international transfers. For more information, see: https://policies.google.com/privacy/frameworks.
11. Children's Privacy
The Service is not directed at children under the age of 16. We do not knowingly collect any information from children under 16. If we become aware that we have inadvertently collected data from a child under 16, we will take reasonable steps to delete such data promptly.
12. Data Security
We implement reasonable technical and organisational measures to protect the information processed through the Service. However, no method of electronic storage or internet transmission is 100% secure. We cannot guarantee absolute security.
Since the Service does not collect or store personal data on our servers, the primary security measures are those provided by the device operating system (for on-device storage) and by our third-party service providers (for analytics and advertising).
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will indicate the date of the most recent update at the top of this page.
Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.
For material changes, we will make reasonable efforts to notify you through the Service.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Email: contact@kuerf.lu
Website: https://kuerf.lu