Your privacy matters.

About this policy

DeshiSpicy provides grocery shopping, delivery, account, notification and AI shopping-assistance services in Phnom Penh, Cambodia. This policy explains how we handle information in the DeshiSpicy website and mobile applications.

Information we collect and how

We collect information you enter or connect to your account, including your name, email address, phone number, account credentials handled through secure authentication, delivery addresses, order details, saved products and customer-support messages.

When you choose location-assisted address entry, the app collects device location and map coordinates needed to select a delivery point. We also collect device push tokens and basic technical information needed for security, sessions and notifications.

How we use information

We use information to create and protect accounts, display the catalogue, process and deliver orders, communicate order status, save delivery preferences, provide requested AI assistance, respond to support, prevent misuse and improve service reliability. DeshiSpicy does not sell personal information.

Optional AI assistant and OpenAI

The AI assistant is optional and available only to signed-in customers. Before the app sends any AI content, it displays a separate consent notice naming OpenAI, LLC, describing the data below and asking the customer to choose “Allow AI data sharing” or “Not now.” No AI data is sent to OpenAI unless the customer affirmatively chooses “Allow AI data sharing.” If the customer chooses “Not now,” no AI message or attachment is sent and normal search, shopping, cart and checkout remain available.

After consent, and only when the customer uses the AI assistant or enables AI-assisted search, DeshiSpicy sends OpenAI the customer’s message or AI search wording, up to ten recent AI conversation messages, selected language, cart product IDs and quantities, and any photo, document or voice recording the customer chooses to attach. Voice audio is sent to OpenAI for transcription. A pseudonymous safety identifier derived from the customer account ID is also sent for misuse prevention. DeshiSpicy does not automatically add the customer’s name, email address, phone number, saved delivery address, precise location, payment information or account credentials to the OpenAI request.

OpenAI processes this information to transcribe an optional voice note, understand the request and generate the requested shopping-assistant response. See OpenAI’s privacy policy. DeshiSpicy requires its service providers, including OpenAI, to use the information only to provide the contracted service and to apply privacy and security protections no less protective than those described in this policy and required by applicable law.

For security, abuse prevention and the customer-specific admin usage report, DeshiSpicy records the signed-in account identity, time, app or website source, language, a brief message excerpt, attachment count, consent-notice version and request outcome. This internal usage record is not sent to OpenAI as part of the assistant request and is removed when the customer account is deleted, except where retention is legally required.

Service providers and international processing

We use Google and Firebase for authentication, maps and notifications, infrastructure providers for hosting, and OpenAI for the optional AI functions described above. These providers may process information outside Cambodia as needed to supply their services under applicable privacy, data-processing and security terms.

Retention and security

We retain account, order, consent and service records only for legitimate operational, legal, accounting, security and support needs. OpenAI processes AI content under its applicable API and business data terms. We use HTTPS in transit, limit the personal data included in AI requests and restrict administrative access. No internet service can guarantee absolute security.

Your choices and rights

You can decline optional AI sharing, location, camera, photo, microphone and notification permissions. The app asks for AI sharing permission before it opens an attachment picker or requests microphone access for the assistant. You can withdraw AI permission at any time from AI → AI privacy & consent; after withdrawal, no new AI content is sent unless you agree again. If location is declined, you can enter an address and adjust the delivery pin manually. You may update saved addresses and account details in the app and request access, correction or a copy of relevant account information.

Account and data deletion

A signed-in customer can permanently delete an account inside the app by opening Account → Delete account → Delete permanently. This immediately removes the active profile, credentials held by DeshiSpicy, saved addresses, saved products, notification devices and private AI usage records. When an available Sign in with Apple refresh token is connected to the account, DeshiSpicy asks Apple to revoke it during deletion. Past order, invoice, payment-status and fraud-prevention records may be retained only where reasonably required for accounting, tax, disputes, security or other legal obligations and are no longer connected to an active account. Customers without app access can use the public account-deletion page.

Children

DeshiSpicy is a general grocery service and is not directed to children under 13.