Last updated: 4 October 2026. This policy explains what the DishDraw app and
website (“DishDraw”, “we”) process and why. Controller: Antiochia Software, owner Ibrahim
Gazaloglu, Prenzlauer Promenade 9, 13086 Berlin (see Impressum),
contact legal@dishdraw.de.
What we process
Location (approximate & precise) — when you use “near me”, to find
restaurants around you; when you order at a table, to confirm you are at the
restaurant (we keep only how far away you were, never where you were); and when you
apply for a job whose advert only accepts people living in certain countries, to
confirm which country your phone is in (we keep only the country — see
DishDraw Jobs). The app asks before it first uses your location,
and says so again before a job application checks it. Processed on request; your
position is not stored.
The city your IP address belongs to — when the app opens
and you have neither shared your location nor chosen an area, we look up which city
your IP address belongs to, so the restaurant list can open there. Only a city is
ever derived, never a district or a street. The lookup runs on our own server
against a local database, “IP to City Lite” by
DB-IP (licensed under
CC BY 4.0): your address
is not sent to anyone for it, and the lookup itself keeps nothing.
Camera / photos / video — when you scan a menu page, or submit a photo or a
short video of a dish. Submitted media is stored and, once approved by us, shown
publicly.
Contributor name — if you add it when submitting content.
Reservations: name & phone number — when you request a table, so the
restaurant can reach you about your booking. Visible to that restaurant only;
deleted automatically no later than 30 days after the reservation date. If you
book through a restaurant's own website (the booking form we host for it) you
may also give an email address, used only to send you the confirmation
and a link to view or cancel that booking; it is stored with the booking and
deleted with it.
Pickup orders: name & phone number — when you order ahead for
collection, so the restaurant can reach you about your order (for example if a
dish has run out). Visible to that restaurant only; deleted automatically no
later than 30 days after the order. We take no payment for pickup orders — you
pay the restaurant directly at the counter, so we never see payment details.
Ordering at a table — when you order at a restaurant's
table in the app or in your browser, we store the order: the dishes with their sizes,
choices and extras, how many of each, your notes, the language you read the menu in,
and your first name if you give one (it is optional and only helps staff tell whose
plate is whose). With it we store which phone at the table sent it (the app's device
identifier, or in the browser the random identifier described in the next point),
when each phone joined or left the table or was removed from it by staff, and, if you
call a waiter, the reason, cash or card for the bill, and your note. Besides the other
phones at your table, which share one tab, the order is visible to that restaurant
only, on the staff devices it has paired; staff can also mark on the bill who has
paid. From your location we keep only how far from the restaurant your phone said it
was and how exact that reading was, never where you were; in the browser we ask for
no location at all. Your IP address is not stored with the order; joining a table
uses it only in memory, to limit how often a table code can be tried. Deleted
automatically 30 days after the table is closed.
Ordering at a table in your browser — if you
order on the page the table's QR code opens instead of in the app, and only where
the restaurant has switched this on, the page keeps a few things in your browser's
local storage (not a cookie): a random identifier it creates for this table,
the key to this table's order and when that key runs out, the menu language you
chose, and, only while it is not yet confirmed as received, an order you have tapped
Send on (its dishes, choices and notes). They let your order and your place at the
table survive a reload, let only you take your order back, stop a retry from
ordering twice, and keep a phone that staff removed from the table from simply
joining it again. They are kept for this one table only and are never read on any
other. This storage is strictly necessary for the ordering you asked for (§ 25(2)
Nr. 2 TDDDG), so we do not ask for consent. The page deletes it when you leave the
table, when it finds the table has been closed, and in any case the next time it is
opened more than 12 hours later; you can delete it at any time by clearing this
site's data in your browser. The page asks for no location and loads nothing from
other companies: its fonts and scripts come from our own server.
Email address — for restaurant owners signing in to the owner portal
(the login code is sent to it), for people who sign in to DishDraw Jobs and for
staffing companies with a recruiter account (see DishDraw
Jobs), for listing requests you send us, and when you ask for a demo of the
restaurant tools (we use it to contact you about the demo; once we set one up for
you, it is your demo sign-in).
Demo requests: phone number — if you leave a phone number instead of an
email when you ask for a demo of the restaurant tools, so we can call you to set
it up. It is stored with your request and used only to contact you about it.
Device identifier & IP address — to prevent automated scraping/abuse
and to keep the service available (security; rate-limiting). The device
identifier is also used, as a one-way code, for the install count below.
App integrity check — about once a day the app asks
Google Play Integrity (Android) or Apple App Attest (iPhone) to confirm that it is
our unmodified app on a real device, and sends us that answer. We use it to keep
automated scraping away from the menus. We keep the latest answer for the install
under a one-way code (not the device identifier itself), and, per day, how many
different menus were opened from an install and from an IP address, each under a
one-way code (see Retention).
Server access log — our web server records each request
to dishdraw.de and its subdomains: your IP address, the time, the address
requested, the answer it gave, and the app's or browser's identifier. It is used
only to detect attacks and automated scraping. Sign-in codes, tokens and table
codes are removed before anything is written, and the log is deleted
automatically (see Retention).
Push token — only if you enable notifications: a device token so we can
tell you when your table order, pickup order or reservation is confirmed, and in
DishDraw Jobs when a hirer wants to contact you or writes to you. You
can disable
notifications in the app at any time, which deletes the token.
Crash diagnostics — if the app crashes, it sends us a report so we can fix
it: what went wrong and where in our code, your device model, its operating
system version, the language you had set, and how much memory and storage were
free at that moment. No menu content, no location, no name, email or phone
number, and nothing that identifies you. It carries an identifier generated by
the crash reporter itself, which is not connected to your DishDraw device
identifier or to any account.
Restaurant & menu data — factual business information compiled from
public sources and community contributions.
Website usage statistics — on this website only (not in the app),
we count visits with Umami, a privacy-friendly analytics tool we host on
our own server. It sets no cookies and stores nothing on your device.
Per page view it records the page address, the referring site, and your browser,
operating system, device type, screen size and country. Your IP address is used
only to derive the country and to generate a daily-changing, non-reversible
identifier for counting unique visitors — it is not stored, and the
identifier cannot be linked to you or traced across days or websites. Umami is
not loaded on the pages used to open a table or accept a staff invite; the table
page sends only the anonymous count described in the next point. We also record
when the App Store / Google Play buttons are clicked,
together with which store and which page — no other data is attached to this
event.
Table and booking counts — to learn how many guests at a table get from
scanning its QR code to ordering, we count these events: the table page being
opened and its App Store / Google Play buttons tapped; a table being opened in the
app or in the browser, a phone joining it, and a phone's first order there; an App
Store / Google Play button tapped while ordering in the browser; the booking page
being opened, and a booking being made (on the website or in the app). A count holds
the restaurant, for table events the table, and the time cut to the hour (to the
minute for the table page). It holds no device identifier, no IP address, no
name and nothing about what was ordered, and the table page stores nothing on
your device for this count.
App install count — to know how many phones use the app and how many
come back, without waiting for the app stores' reports. When the app starts or
returns to the screen it already asks our server whether it needs an update,
sending its platform, its version and the app's device identifier. From that we
keep a one-way code of the device identifier (it cannot be turned back into the
identifier), the platform, the first and the latest app version, and the days on
which the app was opened. No IP address, no location, no name and nothing
about what you look at or order is kept with it, and we use it only for
totals (how many installs, how many active on a day, which app versions are in
use).
Terms acceptance — when you accept our terms in the app, we record your
app's device identifier, the version of the terms and the time, as evidence of
the agreement. When a phone joins a table or orders, we also look at when that
device first accepted the terms, to count whether the app was installed within
the last hour; only that yes/no is kept in the count above, never the device.
DishDraw Jobs
Restaurants and approved staffing companies (“hirers”) advertise work in the app, and
people looking for work can keep a profile and apply. Browsing job adverts needs no
account.
Your job account — your email address, to which we send a one-time sign-in
code. No password.
Your profile — the name hirers see, your full name, phone number, the city
you live in (and the country it is in), the roles you do, your languages, years of
experience, a few words about yourself, the days you are free, optionally a
profile photo, optionally your salutation (Ms, Mr or Mx), optionally a link
to your CV, and optionally your work history: for each job, the role, the
workplace, its city if you give one, the months you started and finished (or that
you still work there), and a note on what you did if you add one. A profile is shown
to hirers only while you have switched it to visible, and to staffing agencies only
if you separately allowed that.
Your profile photo — if you add one, we turn it into a small square picture
and keep only that picture. The file you picked is not kept, and neither is the
hidden information phones store inside photos, such as where and when a photo was
taken. You can change or remove the photo at any time; removing it deletes it at
once. Hirers can report a photo that is not appropriate, and we may remove it. While
your profile is suspended after a review, the photo is not shown to anyone.
Your salutation — optional, and your own choice. If you pick one, hirers see
it on your profile; if you leave it empty, nothing is shown. It is
never used to filter, sort or match profiles, or to decide who is notified. You can
change or clear it at any time, and it is removed when you delete your job
account.
What a hirer sees, and when — your display name, your profile photo and your
salutation if you added them, roles, languages,
experience, city, free days and the words about yourself, and for each job in your
work history the role and how long you did it. This is also what hirers see when
they browse profiles. Your full name and CV link, and the workplace, city,
dates and note of each job, reach a hirer only when you release them:
by accepting that hirer's request to share your contact, or by applying to its
advert from an app version whose application screen tells you, before you send,
that applying shares them. Your phone number goes with them only if your
phone setting allows it (see below). Nothing else — not a hirer's request, not a
message — releases them.
Your phone number setting — in your profile you choose whether sharing your
contact with a hirer includes your phone number (“share with employers”, the
default) or not (“messages only”). With “messages only” a hirer can reach you only
by message in the app; in any conversation you can still share your number with
that hirer alone, with one tap, after the app asks you. A number you have
shared cannot be taken back, and sharing it with one hirer changes nothing for the
others.
Your public profile link — if you choose, you can create a link to a page
with your profile that anyone who has the link can open, without an account.
The page shows your display name (never your full name), roles, city, years of
experience, languages, the words about yourself, your free days, your full work
history including workplaces, your CV link, and your profile photo if you added one
(on the page itself, not in the preview a chat app shows when the link is pasted).
Your phone number appears on
it only if you switch that on. We tell search engines not to list the page. This is
separate from making your profile visible to hirers: the page works for as long as
you share the link. When you stop sharing, the link stops working at once,
for everyone who has it; sharing again creates a new link at a different address,
and the old one never works again. The link also stops working if your account is
deleted or we suspend your profile after a review.
Applying — the advert you answer, your optional message, and when you applied
go to that hirer. From the current app version, applying also shares your contact
details with that hirer as described above; the application screen says exactly
what will be shared before you send it. Older app versions do not do this: there,
a hirer first asks and you decide.
Messages — once you have shared your contact with a hirer, either of you
can write to the other in the app. We store what you both write so the conversation can be shown to the two
of you. We do not read conversations, except one you report, which our team then
reviews. A conversation is deleted 30 days after its last message; the record
that you and the hirer were in contact remains.
Reporting and blocking — you can report a message or a whole conversation to
us (for example a fake job, a request for money or documents, abuse or spam), with
an optional note. The hirer is not told. We look at a report within 24 hours and
may remove a message or suspend the hirer. You can also block a hirer: it can no
longer write to you or ask for your contact, and it only sees that the
conversation has ended, not that you blocked it. Details you had already shared
stay with it. You can undo a block in your profile.
Location check for some adverts — a hirer may accept applicants only from
certain countries (for example “living in the EU, the EEA or Switzerland”). For such
an advert the app reads your phone's position when you tap “I'm interested”,
so that you are told at once if the advert cannot take your application, and
again when you send it — each time after telling you it will. Our server works
out which country that position is in using a map stored on our own server — the
position is not sent to any other service — and then discards it. The first check
keeps nothing at all; with an application we keep only the country and the time
of the check, and show that country to the hirer. If you
do not allow location, the application cannot be sent; everything else in the app
works without it. This check is about where you are, never about your
nationality, which we do not ask for.
Safety — hirers can report a profile, and we review reports. To limit fake
accounts we note which install created an account and compare phone numbers
between accounts; a match is only a flag for our review.
Notifications — if you allow them, we tell you when a hirer wants to contact
you or writes to you (see push tokens above); a notification about a message names
the hirer but never contains the message. We also email you when a hirer wants to
contact you. When you write to a hirer, we email the hirer that it has new
messages — at most once every three hours per conversation, with your display name
and never the message itself.
Recruiter accounts — a staffing company signing up on
hire.dishdraw.de gives us its company name, a contact person, a work
email, its website and the country it hires in. We review each account before it
can see anyone.
Hirers' private notes — a restaurant or staffing company can keep a private
note on its own job advert, for example where the vacancy came from. Only that
hirer sees it; it is never shown to people looking for work or on the advert's
public page, and it is deleted 30 days after the advert ends.
How long we keep it. A profile nobody has opened for 45 days is taken off the
board until you open the app again. Thirty days after a request or application is
settled (answered, declined or expired) we delete the message on it and the country
from any location check; the record that it happened remains. Messages in a
conversation are deleted 30 days after its last message. A block stays until you undo
it. A report you make — its reason and your note — is kept as the record of what we
decided about it, until your job account is deleted. When your job account is
deleted, your full name, phone number, CV link, profile photo, salutation, the words about
yourself, your free days, your work history, your conversations' messages, your blocks
and your reports are removed at once, any public profile link stops working
at once, your profile leaves the board, and the account with all its requests and
applications is deleted 30 days later (so an accidental deletion can be undone by
signing in again). An account unused for a year is deleted the same way.
Recruiter accounts are deleted on request, and 30 days after that nothing of them
remains.
Legal bases (GDPR Art. 6)
Consent (Art. 6(1)(a)) for camera/location access and push notifications, for
making your job profile visible to hirers (and separately to staffing agencies), for
an optional profile photo and salutation, for
sharing your contact details (and your phone number) with a hirer, and for a public
profile link you create (and the phone number on it, if you switch that on);
performance of a contract / pre-contractual steps (Art. 6(1)(b)) for
passing a table order to the restaurant you chose,
for table reservations and for your job account, applications and conversations with
hirers, including the location check an advert asks for; legitimate
interests (Art. 6(1)(f)) for security/abuse-prevention, including the app integrity
check and its menu counts
(at a table, limiting how often a table code can be tried,
which holds your IP address in memory only), reviewing reported profiles
and reported conversations, keeping a block in place, operating a menu directory,
opening the restaurant list in the city your IP address belongs to, diagnosing crashes so the app keeps working,
measuring website traffic in aggregate, counting in aggregate how guests use
table ordering and the booking page, and counting app installs and active devices
in aggregate. We rely on
legitimate interests for the website statistics and these counts rather than asking
for consent because they store no information on your device and produce no
personal profile; you can object at any time using the contact address below.
Reading the terms-acceptance record for the install count is compatible with the
purpose it was collected for (Art. 6(4)): it is read at that moment, only a yes/no
is derived from it, and nothing about you is stored with the count. The install
count stores nothing new on your device and sends nothing the app does not
already send with its update check; it keeps only the one-way code described
above, and you can object at the same address.
Sharing
We do not sell your data and show no ads. Hosting is provided by our server
provider (in the EU). Approved restaurant/menu content is shown publicly. Sign-in codes
and notification emails are sent through our email delivery provider. What a hirer
sees of a job profile or application is described under
DishDraw Jobs; a hirer is the restaurant or staffing company you
apply to or that asks you, and is responsible for what it does with your details once
you have shared them. What you write in a conversation is seen by that hirer. A public profile link you create lets anyone who has the link
open your profile page, until you stop sharing it.
The app also calls the following third-party services directly from your device, so
they receive your IP address and — where noted — the coordinates or place name you are
searching for. We use them only to turn places into coordinates and to draw maps and
routes; none of them receive your submitted content:
OpenStreetMap (map tiles, tile.openstreetmap.org) and
Nominatim / Overpass (address and venue lookup) — receive the map area
or search area you are looking at.
Photon (komoot, photon.komoot.io) — receives the place text you
type when searching for an address or a venue.
OSRM (router.project-osrm.org) — receives the start and
destination when you ask for restaurants along a route.
On this website, the coverage map on the home page and on
/for-restaurants loads its map tiles from
OpenStreetMap (tile.openstreetmap.org), which therefore receives
your IP address and the area of the map being drawn. The map software itself is
served from our own server, not from a third party, and the tiles are requested only
once the map itself comes into view — near the top of
/for-restaurants, and only after scrolling on the home
page, where a visitor who never scrolls that far causes no request at all. No cookies
are set, on our side or theirs, and nothing about you is sent beyond the request for
the tile images themselves.
If you enable notifications, your device's push token is processed by
Google Firebase Cloud Messaging (and, on iPhones, Apple Push Notification
service) to deliver the message. We send only order and reservation status
updates and, in DishDraw Jobs, that a hirer wants to contact you or has written to you
(never the message itself) — no marketing. Disabling notifications in the app deletes the token from our systems.
The app integrity check described above is answered by
Google Play Integrity on Android and Apple App Attest on iPhones. They
receive what they need about the device and the installed app to give that answer;
nothing you enter or submit is sent to them.
If the app crashes, the report described above is processed by Google Firebase
Crashlytics. It exists because the app stores tell us only that a crash
happened and never what caused it, which leaves a fault we cannot find and cannot
fix. The reports are kept for at most 90 days and are used for nothing else.
We do not use advertising SDKs and we do not track you across apps or websites.
The DishDraw app contains no analytics SDK — a crash reporter is not one: it
sends something only when the app breaks, and never records what you look at or do. The website statistics described
above stay on our own server and are never shared with an analytics company.
Retention
Security logs are kept only as long as needed to prevent abuse;
the web server's access log is deleted automatically
no later than 14 days after each request. Submitted content
remains until removed by you/the restaurant or by us. Reservation details (name,
phone, email if given, party, time) are deleted automatically no later than 30 days after the
reservation date. Pickup order details (name, phone, the items ordered) are deleted
automatically no later than 30 days after the order.
Table orders (the dishes, choices, notes and first
name, which phone sent them, calls for the waiter and the bill's paid marks) are
deleted automatically 30 days after the table is closed; a table nobody closes closes
itself after three hours without activity, or after twelve hours at the latest.
Activity in the shared demo restaurant (test orders,
reservations, photos) is wiped automatically every night. Website usage statistics
are kept in aggregate only; because no IP address or reusable identifier is stored,
they cannot be traced back to a visitor. Table and booking counts are deleted
automatically after 400 days; they contain nothing that identifies a person.
For the app install count, the record of a day on which the app was opened is
deleted after 400 days, and an install not opened for 400 days loses its one-way
code and remains only as an anonymous number in the total.
For the app integrity check, which menus were opened
is deleted after 2 days, the daily counts after 30 days, and an install's latest
answer 90 days after its last check.
Your rights
You may request access, correction, deletion, restriction, or object to
processing, and lodge a complaint with a supervisory authority. Contact
legal@dishdraw.de. To delete a job account
or a recruiter account, write to that address from the email you sign in with (see
how to delete your account). Restaurants can also
use the “For restaurants” section on the home page.