Privacy Policy

1. Controller

The controller is upIT s. r. o., registered office Pribinova 17954/10, 811 09 Bratislava, Slovakia, company ID (IČO) 35 947 713, tax ID (DIČ) 2022045432, VAT ID SK2022045432, registered in the Commercial Register of the Bratislava III Municipal Court, section Sro, file no. 36984/B.

Contact for data protection matters: ema@foodsignal.app.

We have not appointed a data protection officer because the law does not require us to [lawyer to check].

2. What data we process

• Business data: name, address, links to profiles (Google Maps, website, Wolt, Bolt Food), price lists, menus and ratings — from public sources or from you.
• Contact details of businesses and their representatives: name, work email and phone that the business has published or given us, and a record of our communication.
• User account: name, email, password (stored only as a one-way hash), chosen language and email summary settings.
• Reviews from public sources (Google Maps, TripAdvisor): text, star rating, date and the business’s reply. We do not collect reviewers’ names or profiles.
• Technical data: cookies (see Cookies and browser storage), records of events in the app (e.g. sign-in, settings changes) without passwords, records of emails the app sent to users (recipient, subject and the first 200 characters of the text), and the IP address and browser details in the hosting provider’s access logs; on the website also traffic data without cookies (see Website analytics).

3. Request for the free Analysis

When you send the Analysis request form on the website, we store the name of the business, your email and what you write in the form (address or link, competitors, note, link to a price list or an uploaded price-list file), together with the form version, language and time of sending. We use the data to prepare and send the Analysis you ask for — Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). We keep them for 12 months from sending, then delete them together with the file; they may remain in backups for at most 89 days. An internal Slack message with only the business name and a link to our admin tells our team about a new request — your email, note and other form data are not included. So that we can compare two versions of the form, your browser remembers in the functional cookie fs_form (1 year) which version you got, and in browser storage the day of your last visit to the form; they contain no identifier and are used only to count visits and requests for each version.

4. Requesting a diagnosis in the app

When you request an in-depth diagnosis in the Reports section of the app, we store which business the request concerns, which account sent it, your optional note, the time of sending and its status. We use the data to prepare the diagnosis you ask for — Art. 6(1)(b) GDPR. We keep them for 12 months from sending and then delete them, or earlier when your account is deleted; they may remain in backups for at most 89 days. The business’s requests are also included in the data export in the app settings. An internal Slack message with only the business name, the plan, whether a note is attached and a link to our admin tells our team about a new request — the note, your name and email are not included.

5. Ordering Signal by invoice

When you order Signal by invoice on the website, we store the company name, company ID (IČO), tax or VAT number, registered office, the email for invoices and, optionally, the venue name, together with the language and time of the order. We use the data to issue the invoice and start the subscription — Art. 6(1)(b) GDPR. We keep the order record for 12 months, then delete it; it may remain in backups for at most 89 days. Issued invoices are archived for as long as accounting and tax law requires. An internal Slack message with only the company name and a link to our admin tells our team about a new order — the company ID, address and email are not included. If card payment is offered on the website and you choose it, you enter your card details directly with Stripe; we neither see nor store them.

6. Website analytics

On the public website (pages in Slovak, Czech and English, including articles and legal texts) we measure traffic with PostHog. We record page views (the address, the page title and where you came from, including campaign parameters in the link), clicks on links and buttons with their text, the position of clicks, mouse movement and scroll depth for heatmaps, the device type, operating system, browser, its language and window size, and, for the Analysis request form, when it is viewed, sent and its result, with the form version and language. What you type into form fields (for example the business name or email) is not sent to PostHog. We use no cookies or browser storage, create no visitor profile, do not record sessions and do not combine the data with other data. To count visitors, PostHog computes on its server a one-way identifier from the IP address, browser details and the website domain with a salt that changes every day and is then deleted, so it cannot recognise a visitor on a visit on another day; it stores neither the IP address nor a location derived from it [owner to check: PostHog project settings]. We use the data to learn how the website is used and what to improve — legitimate interest, Art. 6(1)(f) GDPR. We keep the records for 12 months. The app, admin, sign-in and the pages for businesses’ guests (QR menu, loyalty cards, QR campaigns) have no website analytics.

7. Purpose and legal basis

• Providing the service under the contract (Analysis, account, business data, alerts and email summaries) — Art. 6(1)(b) GDPR.
• Approaching a business in person or by phone with an offer of the Analysis and keeping a record of communication — legitimate interest in offering the service to businesses, Art. 6(1)(f) GDPR. We send an offer by email only to a business that has asked for it or consented; every such email includes an option to unsubscribe.
• Security and abuse prevention (event records, access logs, limits on sign-in attempts) — legitimate interest, Art. 6(1)(f) GDPR.
• Measuring traffic on the public website without cookies (PostHog) — legitimate interest in knowing how the website is used and improving it, Art. 6(1)(f) GDPR [lawyer to check].
• Processing public reviews and competitors’ price lists — the business’s legitimate interest in knowing its market [lawyer to check].
• Accounting and invoicing — legal obligation, Art. 6(1)(c) GDPR.

8. Data of businesses’ guests

If a business uses QR campaigns with private feedback or digital loyalty cards, the business is the controller of the guests’ data (for example a voluntary contact in feedback, name and email on a loyalty card) and we process it as its processor under the Data Processing Agreement. The guest finds the loyalty programme terms with the controller’s name when registering the card. We delete the contact from feedback 90 days after the feedback is resolved and an inactive loyalty card after 24 months; guests can delete their card themselves at any time.

We also process, as a processor, personal data in point-of-sale exports that a business gives us (for example staff names on bills).

For a business’s QR menu we record, for its statistics, menu views and opened parts of the menu with the language, source (QR code or link), table number from the QR code and the time rounded to the minute. We count unique guests within a day using a daily pseudonymous identifier derived from the IP address and browser details with a secret key; we store neither the IP address nor the browser details. We keep these records only until they are merged overnight into daily totals, which contain no identifier. We process this data as the business’s processor as well.

9. How long we keep data

• The business’s Private Data (for example point-of-sale exports): for the duration of the contract; after it ends we return it on request and delete it within 90 days at the latest, as stated in the Terms and Conditions.
• User account: for the duration of the contract; after it ends we delete it at your request. We continue to use public information about the business (for example menu, prices, ratings and reviews from public sources) in comparisons after the contract ends, as stated in the Terms and Conditions.
• Invoices: 10 years under the Slovak Accounting Act.
• Analysis requests: 12 months from sending.
• Diagnosis requests in the app: 12 months from sending; earlier if the account is deleted.
• Signal orders by invoice: 12 months from sending.
• Contact details of businesses we have approached: 24 months from the last communication; after a refusal we keep only the email on a do-not-contact list.
• Event records, records of sent emails, and technical and access logs: at most 12 months.
• Website analytics records (PostHog): 12 months [owner to check].
• Backups: deleted data may remain in daily database exports for 7 days and in hosting backups for 89 days.

10. Recipients and processors

We do not sell data or provide it for advertising. To run the service we use these processors [owner to check: contracts and place of processing; standard contractual clauses for providers outside the EU]:

• Railway — hosting of the app and database (EU region, Amsterdam).
• Resend — sending emails from the app.
• Stripe — card payments, where offered on the website: subscriptions and invoices for card payments (the business’s billing details and email; card details are processed only by Stripe).
• HubSpot — records of contacts and communication with businesses (CRM).
• Slack — internal team notifications about requests and orders; it receives only the business or company name, for a diagnosis request also the plan and whether a note is attached, and a link to our admin — never emails or notes.
• Apify — collection of public reviews, ratings and price lists (Google Maps, TripAdvisor, Wolt, Bolt Food).
• Firecrawl — collection of public ratings, reviews and price lists (TripAdvisor, Wolt, Bolt Food, menus on the business’s website); only public addresses of business pages are sent.
• OpenRouter — routing AI requests to Anthropic’s Claude models, which, as OpenRouter chooses, are run by Anthropic or hosted by Amazon Web Services or Google Cloud (draft replies to reviews in the Signal plan, translations and QR menu import; the review text without the reviewer’s name and the business’s reply tone, menu texts and files are sent; the provider may not store them for training).
• Anthropic — provider of the Claude AI models (USA): on a commercial Claude plan we analyse point-of-sale data whose exports we store in a Claude project (see the Data Processing Agreement), and it also processes the requests that OpenRouter routes to it; it may not use the inputs for training.
• PostHog — analytics of the public website (PostHog, Inc., USA; data stored in the EU, in Frankfurt): page views, clicks on links and buttons, heatmap data and device and browser details, without cookies and never the content of forms. PostHog may also process the data in the USA (for example for support); the transfer is covered by the EU–US Data Privacy Framework and standard contractual clauses.
• WhatsApp (WhatsApp Ireland Limited, Meta group) — if you contact us via WhatsApp, your phone number, profile name and messages are processed by WhatsApp as an independent controller under its own terms, including transfer to the USA. We use the messages only to reply and to keep a record of our communication with the business (24 months from the last communication); if you prefer not to use WhatsApp, email or call us.
• Our accountant and lawyer, where needed to meet our obligations.

11. Your rights

• access to your data and a copy (you can find the data export in the app settings),
• correction of inaccurate data,
• erasure and restriction of processing,
• data portability,
• objection to processing based on legitimate interest, including being approached with offers — after an objection we will not approach you again,
• a complaint to the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

Send your request to ema@foodsignal.app; we will reply within one month at the latest.

12. Cookies and browser storage

The website and app use only necessary and functional cookies:

• fs_locale — chosen language of the website and app, 1 year.
• gr_session — sign-in to the app, 30 days; extended while you use the app.
• gr_staff — staff sign-in to the loyalty card scanner, 12 hours.
• gr_active_restaurant — chosen venue in the app, 1 year.
• fs_okno — chosen time period of charts in the app, 1 year.
• fs_gate — access to the website during the pilot phase, 30 days.
• fs_form — the version of the Analysis request form you got, 1 year (see Request for the free Analysis).
• fs_menu_lang — the language a guest chose in a business’s QR menu, 1 year; on menu pages only.
• fs_card_lang — the language a guest chose on loyalty card pages, 1 year; on card pages only.

In browser storage (localStorage and sessionStorage) the following is remembered: by the loyalty card scanner, the signed-in staff member and venue until they sign out or the sign-in expires, the last organisation, and transactions entered offline until it sends them (at most 24 hours); by the app, recommendations on the Overview page that you marked as done; by the Analysis request form, the day of your last visit; by a business’s QR campaign, until the browser tab is closed, a mark that the visit has already been counted. This data stays in your browser until the time stated or until you delete it.

We do not use analytics, tracking or advertising cookies, and we measure website traffic without cookies or browser storage (see Website analytics); neither cookies nor browser storage contain an identifier used to track you.

13. Changes to this document

We publish changes on this page together with the effective date.