Privacy Policy for Recommendation System

Last Updated: 2025-01-15

1. Introduction

This document outlines the data retention and privacy practices for the HungryHub recommendation system (hh-lion). It addresses data retention policy compliance for recommendation-system audit findings.

2. Data Categories

2.1 Anonymous Session Data

Definition: Data collected from users who have not logged in, identified only by an anonymous_id.

Data Collected:

• Session ID (auto-generated)
• Anonymous ID (cookie/device identifier)
• Viewed restaurants
• Interaction signals (clicks, time spent)
• Geographic context (city/region level)

Retention Period: 30 days

Justification: 30 days provides sufficient history for session-based recommendations while respecting user privacy for non-authenticated interactions.

2.2 Member Session Data

Definition: Data collected from authenticated users with a registered account.

Data Collected:

• User ID
• Booking history
• Restaurant preferences
• Search queries
• Feature vectors for personalization

Retention Period: Duration of account + 90 days after deletion request

Justification: Required for providing personalized recommendations and honoring past bookings.

3. Data Retention Implementation

3.1 Redis Session Store

Anonymous session data in Redis is configured with automatic expiration:

# recsys/config/defaults.py
ANONYMOUS_ID_TTL_DAYS = 30  # Session data retention period

All anonymous session keys are stored with a TTL (Time-To-Live) of 30 days, after which Redis automatically deletes them.

3.2 ClickHouse Historical Data

Historical interaction data in ClickHouse follows a separate retention policy managed by database-level TTL clauses.

4. User Rights

4.1 Right to Access

Users can request their data by contacting support@hungryhub.com.

4.2 Right to Deletion

• Anonymous users: Data automatically expires after 30 days
• Members: Can request account deletion, which triggers data removal within 30 days

4.3 Right to Session Reset (P-002)

Anonymous users can immediately reset their session data:

API Endpoint: POST /identity/reset

{
  "anonymous_id": "your-anonymous-id"
}

This will:

1. Delete all identity links associated with the anonymous_id
2. Clear any session-based recommendation data
3. Reset personalization to default state

Note: This action is immediate and irreversible. Your browsing history will no longer be used for recommendations.

4.4 Right to Opt-Out

Users can opt out of personalized recommendations via account settings.

5. Technical Controls

5.1 Data Minimization

The recommendation system follows data minimization principles:

• Only necessary signals are collected
• Raw interaction logs are not stored long-term
• Aggregated features replace individual events after processing

5.2 Access Controls

• Data access is limited to recommendation serving and model training pipelines
• No manual access to user-level data without approval
• All access is logged for audit purposes

5.3 Encryption

• Data in transit: TLS 1.3
• Data at rest: AES-256 encryption for Redis and ClickHouse

6. Compliance

This policy is designed to comply with:

• PDPA (Personal Data Protection Act) - Thailand
• GDPR (General Data Protection Regulation) - EU users

7. Policy Updates

This policy may be updated to reflect changes in data practices. Users will be notified of significant changes via the application.

8. Contact

For privacy-related inquiries:

• Email: privacy@hungryhub.com
• Support: support@hungryhub.com

Audit Trail