Privacy Policy

1. Controller

The controller is the provider named in the legal notice.

2. Information we collect

• Account data: email address, first and last name, password (stored only as a secure hash).
• Business data: name, contact details and address of the business, logo, brand colours, website address.
• Content: dishes, ingredients, allergen information, templates, print settings and generated PDF files.
• Technical data: IP address, browser information and timestamps in server logs, as well as login sessions.

3. Purposes and legal bases

• Providing the service and performing the contract (Art. 6(1)(b) GDPR).
• Security, abuse prevention and error analysis (Art. 6(1)(f) GDPR).
• Compliance with legal obligations, e.g. retention duties (Art. 6(1)(c) GDPR).

4. AI features

When you use “Fill with AI” or “Describe by voice”, the dish name or the voice recording and the names of your ingredients and categories are sent to Google (Gemini API) for analysis. Catering Cat does not store the recording. Please do not mention personal data in recordings. Using the AI features is optional.

5. Website analysis for your brand design

If you enter your website address, Catering Cat retrieves this publicly accessible page to take over colours, fonts, logo and a short description. Only publicly available content is processed.

6. Recipients and hosting

We do not sell personal data. We use carefully selected service providers as processors, in particular for hosting and database (Railway), delivery of the web app (Vercel) and AI analysis (Google). Transfers to third countries may occur; they are based on appropriate safeguards such as EU Standard Contractual Clauses.

7. Retention

We keep data as long as your account exists or as required for the purposes above. Print jobs stay in the print history until the business is deleted. Statutory retention obligations remain unaffected.

8. Security

We use appropriate technical and organisational measures, including encrypted transport (HTTPS), hashed passwords, role and tenant separation and access-controlled files.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and may lodge a complaint with a supervisory authority. Use the contact address in the legal notice to exercise your rights.

10. Changes

We may update this Privacy Policy. Changes are published on this page with an updated date.