Privacy

Eataaa helps restaurant guests choose a dish. We built it to work without collecting personal data from guests.

Guests (people who scan a table card)

• No account, no login, no advertising trackers, no fingerprinting, and no Google Analytics on a restaurant's menu pages. If you pick a language yourself, we remember that choice in one small cookie (eataaa_lang) so the menu opens in your language next time. That's the only cookie on those pages.
• We store anonymous usage events: a random session ID kept only in your browser tab, the answers you tap, which dishes were shown and opened, your browser language and the menu version. We do not store your IP address with these events.
• If you choose to rate a dish (“Would order again”), that anonymous answer is stored and may help the restaurant and other guests.
• If you choose to share a dish photo, we store it privately. The restaurant decides whether to use it. We remove location data from photos before upload. Please don't photograph other people.
• Purpose and legal basis: providing the service you requested and improving recommendations (legitimate interest, Art. 6(1)(f) GDPR). Photos: your consent, which you can withdraw by emailing us.

Restaurants

• Account email (for sign-in codes), restaurant details, uploaded menus, dish photos and settings. Billing is handled by Stripe; we don't store card numbers.
• Menu files are processed by an AI model provider to read dishes, prices and ingredients. We don't use your data to train third-party models.
• When you create an account, we note how you found Eataaa: the short tag in the link you arrived through (for example “?ref=…” or a campaign name), or else the name of the website that referred you (such as a search engine), and the first page you landed on. We keep it with your account to learn which channels work (legitimate interest, Art. 6(1)(f) GDPR). It uses no cookies or browser storage and no IP address, and it is deleted with your account. Guests are never tracked this way.
• You can delete a restaurant at any time in Settings. This deletes its menus, analytics and photos.

Website analytics (Google Analytics)

On our own website (eataaa.com, the public demo, sign-in and the restaurant dashboard) we use Google Analytics 4 to understand how people find Eataaa and which parts they use, for example whether visitors look at pricing, try the demo, sign up, publish a menu or upgrade. It is not used on a restaurant's menu pages that guests open from a table card.

• Only with your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Until you choose “Allow”, the Google tag is not loaded and nothing is sent to Google. If you choose “No thanks”, it stays that way.
• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google may process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. See Google's privacy policy at policies.google.com/privacy.
• What is collected: pages viewed, referring site, approximate location (country/region, derived by Google from a shortened IP address that Google does not store for Analytics), device and browser type, and product events such as “pricing viewed”, “menu uploaded” or “demo recommendation completed” with non-identifying details (for example the plan interval or the number of files). We never send names, email addresses, menu or photo contents, free-text feedback, or anything you tap about diet or allergies.
• Cookies: Google Analytics sets the cookies _ga and _ga_<ID> (up to 2 years) to recognise repeat visits. Advertising features, Google signals, remarketing and ad personalisation are switched off.
• Your choice is stored in your browser (localStorage, key eataaa_analytics_consent) for 12 months, then we ask again. This stores no personal data.
• Change your mind anytime via “Analytics settings” in the site footer or here: Analytics settings. Withdrawing stops analytics immediately and deletes the Google Analytics cookies. Withdrawal does not affect processing before it.
• Event data is kept in Google Analytics for at most 14 months.

Processors

• Neon (database, including sign-in data; EU region, Frankfurt), Vercel (hosting, file storage in the EU region, and AI Gateway), Stripe (billing), Resend (email), Google (Google Analytics on our website after consent; optionally linking your Google Maps place ID).

Retention

Anonymous guest events are kept for up to 24 months. Restaurant data is kept while the account exists and deleted on request.

Your rights

You can request access, correction or deletion, or object to processing, by emailing hello@eataaa.com. You may also complain to your data protection authority.

Controller

Ichii GmbH, Kollwitzstraße 76, 10435 Berlin, Germany, represented by its Managing Director Kunichi Kisaki · info@ichii.de