FindDish Privacy Policy
The short version
- You can use FindDish as a guest, with no name and no email.
- Your saved allergies and diets are kept on our server, with encrypted backups at Cloudflare, and are used to leave dishes out of your recommendations. They can reveal your health or beliefs, so we keep them only with your explicit consent, and we delete them if you take it back.
- Menu photos, your voice and what you write go to outside AI services, some of them in the United States, and only after you agree on the first screen; the app does not open without it. These services can keep what they receive for a time, to detect abuse. If you mention an allergy or your health in what you say or write, those words go too. Please do not.
- We do not sell your data, we show no ads, and we do not track you across other apps.
- You can export your data or delete your account from the app.
- FindDish does not guarantee that a dish is free of an allergen. AI reads the menu and can be wrong. Always check with the waiter.
1. Who is responsible for your data
Konstantin Kosolapov, sole trader (autónomo), NIF ESZ1846937L, 08027, Barcelona, Carrer de Coll, 59, Baixos 1a, Spain. Contact for anything about your data: support@finddish.app.
2. What we use, what for, and on what basis
"Contract" means it is needed to give you the service you asked for (GDPR art. 6.1.b). "Consent" means you said yes and can take it back (art. 6.1.a). "Legitimate interest" means we need it to run the service safely, and it does not override your rights (art. 6.1.f). You can read how we weighed this by writing to us.
| What | What for | Basis |
|---|---|---|
| Account: an account ID, language, settings. If you sign in: your Apple or Google identifier and your email. If you sign in with Apple: a token that lets us end that sign-in when you delete your account. If you choose: a name, city and picture | Giving you an account and keeping you signed in | Contract |
| Taste: your answers, cuisines, foods you love and avoid, goals, budget, portion, and the taste profile we work out from them | Recommending dishes (section 5) | Contract |
| What you do with dishes: viewed, ordered, saved, skipped, how you rated them, your comments | Learning your taste and showing your history. Ratings and orders also adjust, without your name, a dish's own data and popularity for everybody | Contract; the shared part is our legitimate interest in better data for everyone |
| Allergies (section 3) | Leaving out of your recommendations the dishes that contain them according to the menu as read by AI, marking them in the full menu and in search, and the card for the waiter | Explicit consent (art. 9.2.a) |
| Diets (section 3) | Leaving out dishes that do not fit, and the card for the waiter | Explicit consent (art. 9.2.a) |
| Menu photos, or the page a menu's QR code opens | Reading dishes and prices, which is what you asked for (section 4) | Contract. The app asks your permission on the first screen |
| Your voice, and what you write in free text boxes | Understanding what you like (section 4) | Contract, and explicit consent if you mention your health. The app asks your permission on the first screen |
| Search words | Finding dishes and places by meaning (section 4). Nothing about you goes with them | Contract |
| Precise location, only while the app is open and if you allow it | Showing what is near you and working out which restaurant a scan is from | Consent, through your phone's permission. You can turn it off there |
| Photos of dishes you add | Showing them to other people, after checking them (section 6) | Contract; checking them is our legitimate interest in keeping the app safe |
| Reports, blocks and account restrictions: whether a moderator has stopped your account adding photos or closed it, when, and the reason given | Keeping the app free of objectionable content, and answering reports as the EU Digital Services Act requires | Legitimate interest; legal obligation |
| Reminder token (iPhone only) | Asking how the dish was, about 50 minutes after you order. Off unless you allow it | Consent |
| Error reports and logs: account ID, device, system, what failed | Finding and fixing faults, and preventing abuse. Your IP address is used to limit requests, and is not kept in our access logs | Legitimate interest in a service that works and is safe |
| Emails you send us | Answering you, and handling your rights | Legitimate interest; legal obligation for rights |
| Records of your acceptance and consents: which, when, which version | Proving what you agreed to (art. 7.1) | Legal obligation |
3. Allergies and diets
Allergies. Allergies are health data. We ask for separate, explicit consent before storing them, on their own screen, and not bundled with anything else. We keep the allergens you choose, and any allergy you add in your own words, on our server in Helsinki.
- Your saved list does not go to AI services. It is compared with the dishes on our server.
- An allergy you add in your own words goes once through an AI service, as the name of a food and without your name, to suggest search words, which you confirm, and to translate it for the card for the waiter.
- Words you say or write are different: see section 4.
Diets. You can choose vegetarian, vegan, gluten-free, halal or kosher. Some of these can reveal religious beliefs or health, so they need the same explicit consent. We use them only to leave out dishes and for the card for the waiter, never to work out anything about you, and they do not go to AI services.
Taking it back. In Profile, at any time. We delete your saved allergies and diets, your voice recordings, and the past recommendations in which an allergy held a dish back. Our backups keep them for up to 30 days (section 9). From then on, the app no longer takes them into account. Comments you wrote about dishes stay: we cannot tell which mention your health. Delete your account or write to us to remove them.
You do not have to tell us any of this. Without it the app works, but does not hide anything for you.
This does not guarantee anything. We go by what the menu says, and AI reads it and works out allergens, so it can be wrong or incomplete. Always check with the waiter. See the terms.
4. What goes to AI services
You agree to this on the first screen, in a box of its own next to the terms and your age, and the app does not open without it. You can take this back in Profile, and it applies to what you send from then on. The app then opens as usual, without asking again. The map and catalogue keep working, and search keeps going by meaning, as the last row says. Scanning, voice and reading what you write stop working, and ask you to turn the switch back on.
| What | Who receives it | Why |
|---|---|---|
| Menu photos, and pages opened from a QR code | OpenRouter and the AI models it passes requests to | To read dishes and prices |
| Your voice | ElevenLabs, then the text goes to OpenRouter | To turn it into text and understand it |
| What you write or say about your taste, about a dish, or in the note on a scan | OpenRouter | To understand what you like |
| Photos of dishes you add | OpenRouter | To check each one before publishing |
| Words typed into search, for everybody. Nothing about you goes with them | OpenRouter | To search by meaning |
We do not add your name, email, account ID or saved allergy list to these requests. But if you mention allergies, your health or who you are in what you say or write, those words go too, and a photo goes as it is.
Please do not mention allergies or your health in a recording or in a free text box. The app reminds you before you record. If you do mention them, you agree to them being handled in this way: that is what you say yes to on the first screen.
What these companies keep. They receive it to do the job for us. As far as they publish:
- OpenRouter says it does not keep requests and answers unless a customer opts in or content is flagged as suspected child sexual abuse material, and that it keeps metadata. On our account we have turned off the logging of requests and their use by OpenRouter.
- Behind OpenRouter, requests can be handled by OpenAI or Microsoft Azure, and hard menu pages and translations of dishes by Google (Gemini). We do not limit requests to services that keep nothing, so OpenRouter or these companies can keep a request for a time to detect abuse, including any words of yours in it. Google says 55 days. OpenAI says up to 30 days. For Azure we could not confirm the period. They say they do not use requests to train models under these terms.
- PDF menus can be handled by Cloudflare or Mistral.
- ElevenLabs keeps recordings and transcripts, and we could not confirm for how long. We have turned off its use of them for training.
Our own copy of your voice. A recording stays in our storage for up to 30 days and is then deleted. Text of a recording you made for the questionnaire is not stored. Text of a recording you made about a dish, like one you typed, is kept as your comment.
5. Your taste profile
We work out a profile of your taste, automatically, from your answers and from what you do and say about dishes. Then we compare it with each dish and show a match percentage. This is profiling. It decides which dishes come first and which are left out: it has no legal effect on you and nobody else sees it. You can see it in Profile, change your answers at any time, and object by writing to us. A dish left out can still be seen in the full menu and in search, with a warning.
6. What other people see
Other people never see your name, profile, scans or comments. They see:
- Photos of dishes you add, once approved. Every one is checked automatically first, and anything unclear waits for a person. Approved photos are public to anybody with the link. An identifier that is not your name goes with them so that other people can block you. It is not enough to find you.
- What is read from a menu you photographed: dishes, prices and descriptions join the catalogue, without your name. Your photographs themselves are not shown.
If you add a place that was not on our map, we record it where you were when you scanned. Other people only see it once another source confirms the place or we approve it.
7. Who receives your data
We use companies that process data for us under contract. We do not sell data.
| Who | Where | What for |
|---|---|---|
| Hetzner Online GmbH | Germany, servers in Helsinki | Server and database |
| Cloudflare, Inc. | A US company. Files and backups are stored in the EU | File storage and encrypted backups, DNS |
| OpenRouter, Inc. | USA | Passing requests to AI models |
| OpenAI, Microsoft Azure, Google, Mistral, Cloudflare (behind OpenRouter) | USA, EU and others | AI models |
| Eleven Labs Inc. | USA | Turning voice into text |
| Functional Software, Inc. (Sentry) | Stored in Frankfurt; account data in USA | Error reports |
| Plus Five Five, Inc. (Resend) | USA | Sending sign-in codes |
| Google (Workspace) | EU, USA and other countries where Google has data centres | Our support mailbox |
Apple and Google handle their own sign-in, the App Store, Google Play and the map (Apple Maps on iPhone, Google Maps on Android) under their own privacy policies, not on our behalf. In the EU the companies responsible are Apple Distribution International Ltd. in Ireland and Google Ireland Limited. If you sign in with one of them, we receive an identifier and your email. On Android, Google receives your IP address, details of your device, and the location shown on the map. See the Apple and Google privacy policies and the Google Maps terms.
We may share data if the law requires it, or to defend a legal claim.
8. Transfers outside the EU
Some of these companies are in the United States or use subcontractors elsewhere, so your data can leave the EU. The safeguards are:
- Cloudflare: the EU-US Data Privacy Framework (GDPR art. 45), and the EU's standard contractual clauses (art. 46).
- OpenRouter: the standard contractual clauses. The providers behind it are covered by OpenRouter's own agreements with them.
- ElevenLabs, Sentry and Resend: the standard contractual clauses. They also say that they take part in the Data Privacy Framework.
- Google Workspace: the standard contractual clauses.
You can ask for a copy at support@finddish.app.
9. How long we keep it
| What | How long |
|---|---|
| Your account, taste, what you did with dishes, comments, menu photos | Until you delete your account. A guest account goes by itself: see below. An account you can sign in to is not deleted automatically |
| Allergies and diets | Until you take back consent or delete your account |
| Voice recordings | Up to 30 days, or until you take back consent or delete your account |
| What goes to AI services, at those companies | As section 4 says: up to 55 days at the longest period they publish; for ElevenLabs and Azure we could not confirm the period |
| Location of a scan | Deleted once the menu is filed under a restaurant. If it finds no restaurant, or the scan is never sent, deleted 7 days after the scan last changed. The location used to show what is near you is not saved |
| Search words | Not saved against you. The numeric vector made from them is kept for one day |
| Sign-in code | 10 minutes in our system. Up to 30 days in the email service |
| Apple sign-in token | Until you delete your account or sign in again |
| Error reports | Up to 90 days |
| Server logs | Rotated by size, three files of 50 MB per service, so not for a fixed number of days |
| Backups | Up to 30 days. If new backups stop being made, the last one stays until they start again. A copy taken just before we update our server stays on that server for up to 15 days |
| Emails to us | 24 months after the last message. Requests about your rights: 3 years after we close them, to be able to show we answered |
| Account restriction, with its date and reason | Until it is lifted or you delete your account |
| Records of your consents | Until you delete your account, then up to 30 days in backups. After that we keep no record of them |
A guest account can only be opened from its phone. If you remove the app, sign out, or do not open it for 30 days, you can no longer reach or delete it from the app, so delete it first. Once you cannot reach it and nothing has been saved in it for 90 days, we delete it, with its files, as if you had deleted it yourself.
When you delete your account, in the app under Profile, your data and files are deleted immediately, and backups follow within 30 days. If you signed in with Apple, we also ask Apple to end that sign-in. What stays, with nothing saying it was yours: photos of dishes, reports, what was read from menus, places you added, and our record of what each AI request cost. A photo or a report may still show or say something about you: to remove one, write to support@finddish.app.
10. Do you have to give us this data?
No law requires it. The app cannot work without an account ID, created for you, and does not open without your agreement on the first screen to the use of AI services. Everything else is your choice, with these consequences: if you take that agreement back, no scanning or voice; no allergies or diets, no filter; no location, no "near you"; no notifications, no reminders.
11. Your rights
You can ask to access your data, correct it, delete it, restrict its use, object to its use, and take it with you. You can take back any consent at any time, as easily as you gave it: this does not affect what was done before.
- In the app: Profile → Export my data gives you a JSON file. Your files, such as menu photos and voice recordings, are links in it that work for one day: anyone who has the file can open them, so keep it private, and export again for fresh links. It does not say who has blocked you. If something is missing, write to us. Edit your profile, take back consents, or Delete your account, all in Profile.
- By email: support@finddish.app. It is free, and we answer within one month. We may need to check it is you. A guest account has no email, so tell us anything that helps us find it.
If you are not happy, you can complain to the Spanish data protection authority, the AEPD, or the authority where you live. We would like to hear from you first.
12. Age
FindDish is for people aged 14 or over. You confirm your age when you first open the app, and if you say you are younger, no account is created. We do not knowingly keep data of anybody younger. If you think we do, tell us at support@finddish.app and we will delete it.
13. Security
Traffic is encrypted. Our database is on a server in the EU with restricted access. Menu photos, recordings and profile pictures are private, reachable only by short-lived signed links. Storage is encrypted by the provider, and backups leave our server encrypted with a key of our own that is on no server. Administrators sign in with a password and a second factor. No system is perfectly secure: if there is a breach that puts you at risk, we will tell you and the AEPD as the law requires.
14. On your phone
The app keeps your sign-in tokens and settings on your phone, because it cannot work without them. It uses no advertising identifiers and no analytics. The website sets no cookies.
15. Changes
If we change this policy in a way that matters, we will tell you in the app before it takes effect, and ask for your consent again if it is needed. The version and date at the top tell you which text applies.
16. If your business is on our map, or you appear in a photo
Places. The map shows names, addresses and contact details of places, from OpenStreetMap, Foursquare OS Places and Overture Maps. If a place belongs to a sole trader, this can be personal data. We use it because of our legitimate interest in showing places, only in connection with the business (art. 19.2 of the Spanish data protection act). To correct it or object, write to support@finddish.app.
Photos and voices. If you appear in a photo or can be heard in a recording by accident, write to support@finddish.app and we will remove what we can find. Our terms ask people not to photograph others without permission, and photos of dishes are checked before anybody sees them.
If this text and the Spanish version differ, the Spanish version prevails.