Privacy and your data

Without an account

A menu photo is used only to read the menu and is not stored. If you save a menu, we keep the recognised text without the photo, the place and a random install ID of your browser, so that independent visitors can confirm the same menu. IP addresses are kept only as salted daily hashes or as the network prefix (/24, /48).

If you also photograph the place, the photo is published on its page under CC BY 4.0 with the credit "Tastavo visitor"; location data is removed on your phone before upload, and a rejected photo is deleted at once.

With an account

E-mail code: your e-mail address and language. Sign-in links and codes are stored only as hashes and expire after 15 minutes.

Google or Apple: the account ID the provider gives us ("sub"), your e-mail address, whether the provider confirmed it, and your name. With Apple's "Hide My Email" we receive a private relay address. We never receive your password, contacts or other data, and we do not store the provider's access tokens.

Menus you save while signed in are linked to your account so you see them under My menus and so that they count more in the confirmation of a place.

Why

To sign you in, to show your menus on any device, to protect your account (for example a notice when a new sign-in method is added) and, for venues and developers, to manage verified venues, API tokens and invoices.

How long

Sessions: 30 days after the last use; a sign-in for payments or new tokens counts as fresh for 10 minutes.

Account data: until you delete the account. Invoices: 7 years, as tax law requires.

Saved menus are facts about a restaurant (dishes and prices); after deletion they stay on the site without any link to you.

Cookies

__Host-sid: your session, only after sign-in. __Host-oauth: for 10 minutes while you sign in with Google or Apple, to make sure the sign-in started in your browser. lang: your language. Analytics only with your consent.

Deleting your account

Write to privacy@tastavo.com from the address of your account; we delete the account, its sign-in methods and sessions within 30 days and confirm by e-mail. You can also remove Tastavo's access at any time: Google at myaccount.google.com/permissions, Apple under Apple ID → Sign in with Apple.

Contact

Tastavo, Vienna, Austria. privacy@tastavo.com. You have the right of access, correction, deletion, restriction, portability and objection, and you may complain to the Austrian Data Protection Authority (dsb.gv.at).