Draft, not yet legally reviewed.
Cenavo Privacy Policy
Controller
[Provider name, address, email address]
In short
Cenavo reads menus and helps you order. We only process what the app needs for that. No ads, no tracking, no selling of data.
Your account
On first launch Cenavo creates an anonymous account with a random identifier. Its key stays in your device's keychain.
Optionally you sign in with Apple. We then store the identifier Apple provides for Cenavo so we can find your account on several devices. We don't ask for your name or email address.
What we process
Your profile: language, allergies and intolerances, diet, dislikes, goals and notes you confirm to the food coach. Allergies, intolerances and goals such as pregnancy or blood sugar are health data. We only process them because you enter them so the app can show you suitable dishes (consent, Art. 9(2)(a) GDPR). You can change or delete them at any time.
Menus: photos, links and PDFs you give Cenavo and what is read from them. Photos stay in your history as a reference until you delete the menu or your account. Menus from the web are also stored without any link to you in a shared store so they don't have to be read again.
Orders, ratings and photos of your plate. We remove location data (EXIF) from photos before storing them.
Conversations with “Ask the menu” and the food coach are sent to the AI model to answer and are not stored in your account; only what you explicitly confirm goes there. The AI gateway (Cloudflare AI Gateway) logs requests to the models, including profile details, for debugging and cost control. [Check and enter how long gateway logs are kept.]
Credit purchases: Apple's transaction identifier, so a purchase is credited only once. Cenavo never sees payment details.
Location
Cenavo asks for your location only to find the restaurant for a menu or restaurants nearby. It goes to our server and to Google for that one search and is not stored.
For “Want to go”, the coordinates of saved restaurants stay on your device only. Your iPhone itself triggers the reminder nearby.
Waiter card via QR code
When you show your order as a QR code, Cenavo keeps it for 12 hours under a random link. Anyone with the link sees the order and your allergy note, but no name. Then it is deleted.
Public ratings (community)
Only if you switch it on and are signed in with Apple, your dish ratings become public: dish, stars, your short text, the restaurant with address and city, the date and a display name you choose. Never public: your profile, allergies, diet, notes, orders, photos and your location.
Before publishing, an AI model checks the display name and text for prohibited content. Others can report entries; reports are stored without names. We review reported entries and may remove them.
If you switch sharing off or delete a rating or your account, the public entries disappear immediately.
Friends, feed and shared lists
Only with Sign in with Apple, a display name and accepted terms of use. You become friends only mutually, through an invite link or QR code you pass on yourself (valid for 7 days, usable once); there is no search by name. For this we store a random friend ID, your display name and who is friends with whom, not your user ID.
For each rating you choose who sees it: only you, your friends or everyone (public, see above). Friends see a copy in their feed: dish, stars, your short text, your plate photo, restaurant and city, date and your display name. Never: allergies, diet, notes, orders, location or coordinates. Before sharing, an AI model checks your text; friends don't see what it holds back.
In shared lists all members see the dishes anyone adds, with the same details. The owner decides who is a member.
If you remove a friend, you no longer see their ratings and they don't see yours; shared lists are separated. Blocking also prevents new invites. If you change or delete a rating or your account, the copies change or disappear immediately.
Shared table and listening to the waiter
Anyone who gets the host's link or QR code can join a shared table. For as long as the table exists (until it is closed, at most 12 hours) we store the menu, your display name (otherwise “Guest”), your order and, per dish, only whether it is “avoid” or “ask first” for you. The others see orders and names, and for dishes only how many people must avoid them, not who or why. The table does not store your allergies; for the shared waiter card the host fetches them as finished sentences from your account, unless you switch off the allergy note in your order. Afterwards the table is deleted; your copy of the menu stays in your history.
“Listen to the waiter” uses your iPhone's speech recognition (on the device or via Apple). Only the recognised text reaches us, never the recording. We keep it with the menu so it can be read again, and delete it with the menu or your account.
Planning together (“Where shall we eat?”)
Whoever creates a plan shares a link. People join with the app or on the web page. For the plan we store your name, your neighbourhood or postcode (turned once into an approximate point, rounded to about 100 m, via Google), how you travel, your budget and your votes. With the app, only your allergies (EU-14) and your diet come from your profile; on the web page, the boxes you tick. Allergies and diet are health data (Art. 9 GDPR); we process them only with your consent and only to filter restaurants and dishes for the group. The others see your name, your rough travel time and whether you have voted, never your allergies, your diet or your starting point; they only see how many restrictions are considered in total. Travel times come from our own routing server. Everything is deleted 24 hours after the meet-up, immediately when the host deletes the plan, and your details immediately with “Delete my details” or “Leave plan”. On the web page a cookie (for this plan only) remembers that you joined.
Service providers
Cloudflare (servers, storage, AI gateway), Anthropic (AI models for reading menus, answers and the filter), Google (restaurant search via the Places API), Apple (sign-in and purchases). They process data on our behalf, partly in the USA. [Check legal basis for transfers: EU-US Data Privacy Framework or standard contractual clauses.]
How long
Until you delete the data in the app. “Me” → “Delete account” removes your account with all menus, photos, ratings, notes, credits, public entries, friendships, feed entries and shared lists. Only the identifiers of redeemed purchases remain, so a purchase isn't credited twice.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time. You can complain to a data protection authority. Write to us at [email address].