Privacy Policy

Last updated: June 25, 2026
Application: Humidor AI

Data Controller
Humidor Etc., a division of Quadriom Son & Image Inc.
A corporation registered in Quebec, Canada — Quebec Business Number (NEQ): 1165048894
CP 31, Bureau-Chef, Vaudreuil-Dorion (Quebec) J7V 5V8, Canada
Legal representative: Paul Genest, President
Email: support@humidor-ai.com

Humidor Etc ("we", "our", "us") operates the Humidor AI mobile application (the "App"). This policy explains what information we collect, why, on what legal basis, how long we keep it, who we share it with, and how you can exercise your rights.

1. Information we collect

1.1 Account information

Email address and name (via Google Sign-In, or a one-time code sent to your email)
Profile picture (only if you sign in with Google)

1.2 Information generated through your use

Cigars in your humidor: name, brand, origin, strength, format, personal notes, date added, photos taken
Spirits in your bar: name, type, region, profile, notes
Tastings recorded: rating, flavors, selected pairings, photos
Pairing history requested from AI
Preferences (language, subscription plan)

1.3 Technical information

Anonymous unique app identifier
Error logs (no personal data)

What we do NOT collect: precise geolocation, contacts, calendars, health data, browsing history outside the App, advertising identifiers. We do not collect any sensitive data within the meaning of GDPR Article 9.

2. Purposes of use

Authentication and account security
Cloud backup of your data so you can access it on another device
Personalized pairing generation via artificial intelligence
Cigar identification from photos you submit
Subscription validation and management for the paid plans (billing is handled by Google Play for purchases made in the Android application, and by our reseller Paddle for purchases made on our website)
Technical support upon request

3. Legal bases for processing (GDPR Article 6)

For users residing in the European Economic Area (EEA), the United Kingdom, or Switzerland, the following legal bases apply to each processing activity:

Processing activity	Legal basis (GDPR art. 6)
Account creation and authentication	Performance of contract (art. 6(1)(b))
Backup of your humidor, bar and journal	Performance of contract (art. 6(1)(b))
AI-generated pairings	Performance of contract (art. 6(1)(b))
Cigar identification from a photo	Performance of contract (art. 6(1)(b))
Pairing history for personalization	Legitimate interest (art. 6(1)(f))
Pro subscription validation and management	Performance of contract (art. 6(1)(b))
Technical support on request	Legitimate interest (art. 6(1)(f))
Notifications of important updates	Legitimate interest (art. 6(1)(f))

You may object at any time to processing based on legitimate interest by writing to support@humidor-ai.com.

4. Service Providers (third parties processing your data)

To deliver the App, we use the following services. Each has its own privacy policy and is bound to us by a data processing agreement (DPA) including, where applicable, the European Commission's Standard Contractual Clauses for transfers outside the EEA.

Anthropic, PBC (United States) — AI to generate pairings and identify cigars. Photos and queries are sent to their API. Policy
Supabase Inc. (United States) — database and photo storage. Policy
Vercel Inc. (United States) — hosting our API. Policy
Google LLC (United States) — in-app subscription billing via Google Play, for purchases made in the Android application. Payments are processed entirely by Google; we never receive or store your payment or banking information. Policy
Paddle.com Market Ltd (United Kingdom, company no. 08172165) — Merchant of Record for purchases made on our website. Processes your email address, billing country and payment details in order to complete the order, issue the invoice, calculate applicable taxes and handle refunds. Payments are processed entirely by Paddle; we never receive or store your payment or banking information. Policy
RevenueCat, Inc. (United States) — subscription management and purchase validation. Receives a pseudonymous app user identifier and your subscription status. Policy
Google LLC (United States) — Google Sign-In authentication and Play Store distribution. Policy
Hostinger International Ltd (European Union) — email delivery for one-time sign-in codes. Receives your email address. Policy

5. Retention periods

Data category	Retention period
Account data (email, name, profile picture)	While your account is active, then deleted within 30 days after account deletion
Inventory (humidor, bar, tasting journal, photos)	While your account is active; deleted immediately upon account deletion
Pairing history	The 50 most recent entries are retained; older entries are automatically purged
Technical error logs	90 days maximum
Billing data	Processed and retained by Google and by Paddle according to their own policies; we do not store any banking data

Your data is stored on secure servers with encryption in transit (HTTPS) and encryption at rest.

6. Your rights

Under applicable laws (including the General Data Protection Regulation — GDPR — for residents of the EEA, the UK, and Switzerland; Canada's Personal Information Protection and Electronic Documents Act — PIPEDA; and the California Consumer Privacy Act — CCPA — in the United States), you have the following rights:

Right of access (GDPR art. 15) — obtain confirmation that your data is processed and receive a copy
Right to rectification (art. 16) — correct inaccurate or incomplete data
Right to erasure ("right to be forgotten", art. 17) — request the deletion of your data
Right to restriction of processing (art. 18)
Right to data portability (art. 20) — receive your data in a structured, machine-readable format
Right to object (art. 21) — to processing based on legitimate interest
Right to withdraw consent at any time (where processing is based on consent)
Right not to be subject to automated decision-making producing legal effects (art. 22) — our pairing suggestions are advisory and produce no legal effect
Right to lodge a complaint with a supervisory authority

To exercise these rights, contact support@humidor-ai.com. We will respond within one month, extendable by two additional months for complex requests (GDPR art. 12(3)). Permanent account deletion is also available directly in the App: Account → Delete my account.

Supervisory authorities:

France: Commission nationale de l'informatique et des libertés (CNIL) — www.cnil.fr
Belgium: Data Protection Authority (APD/GBA) — www.dataprotectionauthority.be
Canada: Office of the Privacy Commissioner of Canada — www.priv.gc.ca
Quebec: Commission d'accès à l'information du Québec — www.cai.gouv.qc.ca
For other jurisdictions, the competent authority of your place of residence

7. Children's Privacy

The App is intended for adults (18+, or 21+ in some jurisdictions). We do not knowingly collect data about minors under 13 (in compliance with COPPA in the United States) or under 16 (GDPR art. 8). If you are a parent and believe your child has provided us information, contact us for immediate deletion.

8. Cookies and Trackers

The App uses your device's local storage (localStorage) to maintain your session and preferences. We do not use any advertising cookies or third-party trackers. No specific consent is required as this storage is strictly necessary for the operation of the App.

9. International Data Transfers

Your data may be processed in Canada (our place of business) and the United States (at our technical service providers listed in section 4).

For users in the EEA, the United Kingdom, and Switzerland, these transfers are protected by:

The European Commission's Standard Contractual Clauses (SCCs) — Implementing Decision (EU) 2021/914 — incorporated into the data processing agreements with each service provider (Anthropic, Supabase, Vercel, RevenueCat, Google)
The EU-U.S. Data Privacy Framework where the service provider is certified under it
The European Commission's adequacy decision recognizing Canada as providing an adequate level of protection for data processed by Canadian private-sector organizations

You may obtain a copy of the applicable safeguards on request at support@humidor-ai.com.

10. Representative in the European Union

In accordance with Article 27(2) of the GDPR, we benefit from the exemption from designating a representative in the EU because our processing concerning EU residents is occasional, does not involve the special categories of data referred to in Article 9 or data relating to criminal convictions (Article 10), and is unlikely to result in a risk to the rights and freedoms of natural persons.

For any question relating to the protection of your data, please contact us directly at support@humidor-ai.com.

11. Security

We apply technical (encryption in transit and at rest, authentication, per-user data isolation via Supabase row-level security policies) and organizational (access restricted to strict necessity) measures to protect your data.

As no system is infallible, in the event of a data breach likely to result in a risk to your rights and freedoms, we will notify you within the legally required timeframes (72 hours under GDPR, art. 33-34).

12. Changes to This Policy

We may modify this policy. The date at the top indicates the last update. Material changes will be communicated via the App or by email.

13. Contact

Humidor Etc., a division of Quadriom Son & Image Inc.
Quebec Business Number (NEQ): 1165048894
CP 31, Bureau-Chef
Vaudreuil-Dorion (Quebec) J7V 5V8, Canada
Email: support@humidor-ai.com