Privacy Policy

Last updated: 13 August 2026. This policy explains what the DishDraw app and website (“DishDraw”, “we”) process and why. Controller: Ibrahim Gazaloglu, Prenzlauer Promenade 9, 13086 Berlin (see Impressum), contact legal@dishdraw.de.

What we process

• Location (approximate & precise) — only when you use “near me”, to find restaurants around you. Processed on request; not stored to a profile.
• Camera / photos / video — when you scan a menu page, or submit a photo or a short video of a dish. Submitted media is stored and, once approved by us, shown publicly.
• Contributor name — if you add it when submitting content.
• Reservations: name & phone number — when you request a table, so the restaurant can reach you about your booking. Visible to that restaurant only; deleted automatically no later than 30 days after the reservation date.
• Email address — only for restaurant owners signing in to the owner portal (the login code is sent to it), for listing requests you send us, and when you start a live demo of the restaurant tools (your email becomes your demo sign-in, and we may contact you once about listing your restaurant).
• Device identifier & IP address — to prevent automated scraping/abuse and to keep the service available (security; rate-limiting).
• Push token — only if you enable notifications: a device token so we can tell you when your order or reservation is confirmed. You can disable notifications in the app at any time, which deletes the token.
• Restaurant & menu data — factual business information compiled from public sources and community contributions.
• Website usage statistics — on this website only (not in the app), we count visits with Umami, a privacy-friendly analytics tool we host on our own server. It sets no cookies and stores nothing on your device. Per page view it records the page address, the referring site, and your browser, operating system, device type, screen size and country. Your IP address is used only to derive the country and to generate a daily-changing, non-reversible identifier for counting unique visitors — it is not stored, and the identifier cannot be linked to you or traced across days or websites. The pages used to open a table or accept a staff invite are excluded from counting entirely. We also record when the App Store / Google Play buttons are clicked, together with which store and which page — no other data is attached to this event.

Legal bases (GDPR Art. 6)

Consent (Art. 6(1)(a)) for camera/location access and push notifications; performance of a contract / pre-contractual steps (Art. 6(1)(b)) for table reservations; legitimate interests (Art. 6(1)(f)) for security/abuse-prevention, operating a menu directory, and measuring website traffic in aggregate. We rely on legitimate interests for the website statistics rather than asking for consent because the tool stores no information on your device and produces no personal profile; you can object at any time using the contact address below.

Sharing

We do not sell your data and show no ads. Hosting is provided by our server provider (in the EU). Approved restaurant/menu content is shown publicly.

The app also calls the following third-party services directly from your device, so they receive your IP address and — where noted — the coordinates or place name you are searching for. We use them only to turn places into coordinates and to draw maps and routes; none of them receive your submitted content:

• OpenStreetMap (map tiles, tile.openstreetmap.org) and Nominatim / Overpass (address and venue lookup) — receive the map area or search area you are looking at.
• Photon (komoot, photon.komoot.io) — receives the place text you type when searching for an address or a venue.
• OSRM (router.project-osrm.org) — receives the start and destination when you ask for restaurants along a route.

If you enable notifications, your device's push token is processed by Google Firebase Cloud Messaging (and, on iPhones, Apple Push Notification service) to deliver the message. We send only order/reservation status updates — no marketing. Disabling notifications in the app deletes the token from our systems.

We do not use advertising SDKs and we do not track you across apps or websites. The DishDraw app contains no analytics SDK. The website statistics described above stay on our own server and are never shared with an analytics company.

Retention

Security logs are kept only as long as needed to prevent abuse. Submitted content remains until removed by you/the restaurant or by us. Reservation details (name, phone, party, time) are deleted automatically no later than 30 days after the reservation date. Activity in the shared demo restaurant (test orders, reservations, photos) is wiped automatically every night. Website usage statistics are kept in aggregate only; because no IP address or reusable identifier is stored, they cannot be traced back to a visitor.

Your rights

You may request access, correction, deletion, restriction, or object to processing, and lodge a complaint with a supervisory authority. Contact legal@dishdraw.de. Restaurants can also use the “For restaurants” section on the home page.