BiteWise
Privacy Policy

Master Version for Legal Review

Effective Date: [To be completed]
Last Updated: July 4, 2026
Version: 1.0 Draft

Important: This document is a product-specific master draft prepared for review by qualified legal counsel. It is not legal advice. German, EU, consumer, app-store, tax and sector-specific requirements should be reviewed before publication.

Table of Contents

1. Introduction

2. Data Controller

3. Scope of this Privacy Policy

4. Categories of Personal Data We Process

5. Purposes and Legal Bases for Processing

6. Registration, Authentication and User Accounts

7. Client App Data

8. Chef App, Restaurant Profiles and Professional Food Data

9. Photos, Uploaded Files and Public Content

10. Recipes, Dishes, Ingredients and Food Database Data

11. OCR, AI-Assisted and Automated Processing

12. Communications, Support and Notifications

13. Chef Pro Subscription, Billing and Payments

14. Cookies and Similar Technologies

15. Analytics, Diagnostics and Security Logs

16. Service Providers and Recipients of Data

17. International Data Transfers

18. Data Retention

19. Account Deletion

20. Your GDPR Rights

21. Security Measures

22. Children and Minimum Age

23. Third-Party Links and App Stores

24. Changes to this Privacy Policy

25. Contact Information

Schedule 1. Processing Summary

Schedule 2. Account Deletion Summary

Schedule 3. Service Provider Checklist

1. Introduction

This Privacy Policy explains how BiteWise collects, uses, stores, shares and protects personal data when you access or use BiteWise, including the BiteWise chef application, the BiteWise client application, related websites, software, databases, support channels, subscription features and services (collectively, the "Service"). This Privacy Policy is intended to be read together with the BiteWise Terms of Service, Cookie Policy, Account Deletion Policy, Subscription and Refund Policy and any other policy or notice referenced in the Service. BiteWise is designed to help restaurants, chefs and food-service professionals manage restaurant profiles, dishes, recipes, ingredients, menus, allergens, additives and related food information, and to help end users browse, save, rate, comment on or otherwise interact with restaurant and food information. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), applicable German data protection law and other laws that may apply depending on your location and use of the Service.

2. Data Controller

The controller responsible for the processing of personal data under this Privacy Policy is: BiteWise Legal entity: [To be completed] Registered address: [To be completed] Germany Email: [To be completed] Privacy contact: [To be completed] Before publication, the legal entity, registered address, privacy contact, company registration number and VAT ID, if applicable, should be completed and reviewed by legal counsel.

3. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed when you:

• visit a BiteWise website or landing page;

• create or use a BiteWise account;

• use the BiteWise Client App as a guest or registered user;

• use the BiteWise Chef App as a restaurant owner, chef, sous chef, administrator, manager or other authorized professional;

• create, upload or manage restaurant profiles, dishes, recipes, ingredients, menus, photos, ratings, comments or reports;

• subscribe to, purchase or manage Chef Pro or other paid features;

• contact support or communicate with BiteWise;

• interact with cookies, analytics, diagnostics, security and similar technologies.

This Privacy Policy does not replace any separate data processing agreement that may be required where BiteWise acts as a processor for a business customer. If a separate data processing agreement applies, it governs the relevant processor activities in addition to this Privacy Policy.

4. Categories of Personal Data We Process

Depending on how you use the Service, we may process the following categories of personal data.

5. Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis under the GDPR or another applicable law. The most relevant legal bases are listed below.

6. Registration, Authentication and User Accounts

When you create an account, we process the data required to register, authenticate and manage your account. At the time of this Master Version, BiteWise primarily supports registration and sign-in by email and password. BiteWise may later add other supported authentication methods. Authentication data may include your email address, password hash, user ID, session information, password reset records, account role, account status and related security metadata. We do not store your password in plain text. We may send transactional emails necessary for account security and service operation, including email verification, password reset emails, account deletion confirmation, account restoration notices, security alerts and important service notices. These emails are not marketing emails. If email address changes are not supported by the Service, the email used during registration remains the account email unless BiteWise provides another method.

7. Client App Data

The BiteWise Client App may be used by customers, guests and end users who browse or interact with restaurant and food information. The Client App may support guest mode and registered accounts. For Client Users, we may process nickname, avatar, city, favorites, saved restaurants or dishes, ratings, comments, reports, account settings, support messages and other information submitted through the Client App. Some Client App actions may be private, such as favorites, while other actions may be public or visible to restaurants or other users, such as comments or ratings. The Service interface should indicate where content is public or account-linked.

8. Chef App, Restaurant Profiles and Professional Food Data

The BiteWise Chef App is intended for restaurant owners, chefs, sous chefs, administrators, managers and other authorized food-service professionals. When you use the Chef App, we process information required to create and manage restaurant and professional food-management content. Restaurant profile data may include restaurant name, country, city, address, street, map point, latitude, longitude, restaurant photo, description, website, number of tables, average bill, account status and similar information. Chef Users are responsible for ensuring that restaurant and professional food data is accurate, lawful and submitted with the necessary authority. If a restaurant profile or professional account is disputed, inaccurate, misleading or unauthorized, BiteWise may review, restrict, suspend or remove the relevant account or content.

9. Photos, Uploaded Files and Public Content

The Service may allow users to upload images and files, including avatars, restaurant photos, dish photos, label photos and other uploaded materials. These files may be stored by BiteWise or its service providers and may be processed to provide the Service. We may resize, compress, convert, generate thumbnails, cache, store and display uploaded images as necessary to operate and improve the Service. Certain images may be made public if they are attached to public restaurant profiles, dishes, comments, ratings or other public features. Public Content may include restaurant profiles, restaurant photos, dish photos, dish details, comments, ratings, reviews and similar materials. Do not upload personal data, confidential information, private images, third-party content or trade secrets unless you have the necessary rights and are comfortable with that content being processed in accordance with this Privacy Policy and the Terms of Service.

10. Recipes, Dishes, Ingredients and Food Database Data

BiteWise processes Food Data to provide structured food-management and discovery features. Food Data may include dishes, recipes, ingredients, recipe components, nested recipes, dish-as-ingredient logic, menu categories, allergens, additives, calories, nutrition, labels, OCR results, AI-assisted outputs and Food Database entries or revisions. Some Food Data may be created by Chef Users, some may be part of a shared Food Database, and some may be reviewed, approved, rejected, quarantined, deleted or otherwise moderated by administrators. Approved changes to shared Food Database entries may affect multiple users or restaurants. Food Data may not always be personal data. However, it can become personal data if linked to a user account, restaurant profile, identifiable chef, reviewer, moderator or other identifiable person. We process such data in accordance with this Privacy Policy.

11. OCR, AI-Assisted and Automated Processing

BiteWise may provide or later introduce OCR, label recognition, AI-assisted extraction, automated classification, ingredient matching, allergen detection, additive detection or similar automated features. These features may process uploaded images, labels, text, recipes, ingredients or Food Data to help organize information. Automated outputs may be incomplete, inaccurate or outdated. They are provided for organizational and informational purposes and should be reviewed by a human before being relied upon, especially in professional, allergen-sensitive, dietary, medical or food-safety contexts. Where required by law, we will provide additional information about automated decision-making. BiteWise does not intend to make legally significant decisions about users solely by automated means without appropriate safeguards.

12. Communications, Support and Notifications

When you contact BiteWise, submit a report, send feedback, request support, appeal a moderation decision or communicate with us, we process the information you provide and related metadata to respond, investigate, resolve issues, improve the Service and enforce our Terms. We may send transactional and service-related messages, such as password reset emails, account security notices, deletion confirmation emails, subscription notices, payment-related messages, product-critical updates and legal notices. If we offer newsletters or marketing emails, we will send them only where we have a lawful basis, such as your consent where required. You may withdraw consent at any time using the unsubscribe link or another method we provide.

13. Chef Pro Subscription, Billing and Payments

BiteWise may offer Chef Pro as a paid subscription for Chef Users. The planned standard price is EUR 39 per month unless another price, billing period, discount, promotion, tax treatment or plan is shown in the Service at checkout. For subscription and billing purposes, we may process subscription status, subscription plan, subscription start and end dates, renewal status, billing provider, billing customer ID, payment status, invoice data, tax-related data and payment event history. Payments may be processed by an app store, payment processor or other billing provider. BiteWise should not store full payment card details unless expressly stated and technically required. Payment providers may process payment information under their own privacy notices and legal responsibilities. Billing, invoice, tax and payment records may be retained longer than account content where required for legal, tax, accounting, fraud prevention, dispute resolution or compliance purposes.

14. Cookies and Similar Technologies

BiteWise may use cookies, local storage, SDKs, device identifiers and similar technologies to provide essential functionality, maintain sessions, secure accounts, remember preferences, measure performance, diagnose issues and, where used, provide analytics or marketing features.

Where legally required, we will ask for your consent before using non-essential cookies or similar technologies. You can manage cookie choices through the cookie banner or settings where available.

15. Analytics, Diagnostics and Security Logs

We may process technical and usage data to operate, secure, debug and improve the Service. This may include IP address, device information, app version, operating system, language, time zone, crash logs, server logs, request timestamps, accessed pages or screens, error messages and security events. Server logs are used to maintain stable and secure operation, diagnose errors, detect attacks, prevent abuse and protect the Service. Logs are retained only as long as necessary for these purposes unless longer retention is required for security, legal or compliance reasons.

16. Service Providers and Recipients of Data

We may share personal data with carefully selected service providers and recipients where necessary to operate, secure, improve or legally administer the Service. Service providers process personal data under appropriate contractual safeguards, such as data processing agreements where required.

Current providers and infrastructure should be completed before publication. Based on the current product architecture, likely providers may include Supabase for backend, authentication, database and storage; Vercel or AWS for hosting or infrastructure; email service providers for transactional emails; and future payment providers or app stores for billing. The final provider list should be verified before publication.

17. International Data Transfers

Some service providers may process personal data outside the European Economic Area (EEA), including in countries that may not provide the same level of data protection as the EEA. Where personal data is transferred internationally, we use appropriate safeguards where required, such as adequacy decisions, EU Standard Contractual Clauses, data processing agreements, transfer impact assessments and supplementary measures where appropriate. Users should be aware that infrastructure providers, app stores, payment processors, analytics providers, OCR providers, AI providers and support tools may operate internationally. The specific providers and safeguards should be reviewed before publication and described in the final version where required.

18. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The retention period depends on the type of data, the purpose of processing, legal obligations, account status, security requirements and whether the data is part of public or shared structures.

19. Account Deletion

BiteWise provides or may provide account deletion flows for Client Users and Chef Users. Account deletion is separate from subscription cancellation unless the Service or billing provider clearly states otherwise.

19.1 Client account deletion

Client Users may be able to delete their account through account settings. The deletion process may require confirmation, such as entering the word DELETE. After confirmation, BiteWise may delete the Client profile, avatar, favorites and other account-linked data, and may delete or anonymize comments, ratings or reviews where appropriate. Restoration after final Client account deletion may not be available.

19.2 Chef account deletion

Chef Users may be able to request deletion through the Chef App. Because Chef accounts may include restaurant profiles, dishes, recipes, ingredients, menu structures, photos and professional data, deletion may require email-code verification and may enter a 30-day pending deletion period. During this period, the account may be restricted and scheduled for deletion. The Chef User may be able to cancel the deletion request before final deletion.

19.3 Final deletion and retained data

After final deletion, BiteWise may delete or anonymize the account, profile, restaurant data, dishes, recipes, menu categories, photos, uploaded files, local saved account data and authentication credentials, subject to technical feasibility, database integrity and lawful retention requirements. Certain data may be retained where necessary for legal, tax, accounting, billing, fraud prevention, security, moderation, dispute resolution, enforcement, audit, compliance or legitimate business purposes. Deleted data may also remain temporarily in backups, logs or disaster-recovery systems until overwritten or deleted according to retention cycles.

20. Your GDPR Rights

Subject to the conditions and limitations of the GDPR, you may have the following rights:

• Right of access (Art. 15 GDPR) - to obtain information about whether and how we process your personal data.

• Right to rectification (Art. 16 GDPR) - to correct inaccurate or incomplete personal data.

• Right to erasure (Art. 17 GDPR) - to request deletion of personal data in certain circumstances.

• Right to restriction of processing (Art. 18 GDPR) - to request that processing be restricted in certain circumstances.

• Right to data portability (Art. 20 GDPR) - to receive certain data in a structured, commonly used and machine-readable format.

• Right to object (Art. 21 GDPR) - to object to processing based on legitimate interests, including profiling based on such interests.

• Right to withdraw consent (Art. 7(3) GDPR) - where processing is based on consent, you may withdraw consent at any time for the future.

• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise your rights, contact us using the contact details in this Privacy Policy. We may need to verify your identity before responding. We will respond within the time limits required by law.

21. Security Measures

We use reasonable technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These measures may include TLS/HTTPS, password hashing, access controls, role-based permissions, audit logs, backups, secure infrastructure, limited administrative access and monitoring for abuse or security incidents. No system is completely secure. You are responsible for protecting your login credentials, using strong passwords and notifying us promptly if you suspect unauthorized access to your account.

22. Children and Minimum Age

The Service is not intended for children under 16. You must be at least 16 years old to use the Service. If the law of your country requires a higher age or parental consent for online services, you may use the Service only if you meet that requirement or have valid consent from a parent or legal guardian. If we learn that we have collected personal data from a child without appropriate consent where required, we will take reasonable steps to delete the data or obtain appropriate consent, as required by law.

23. Third-Party Links and App Stores

The Service may contain links to third-party websites, restaurants, app stores, payment providers or other services. This Privacy Policy does not apply to third-party services that are not controlled by BiteWise. Their own privacy policies and terms apply. If you download BiteWise from Apple App Store, Google Play or another app store, the app store may process personal data under its own privacy terms. If you purchase a subscription through an app store or payment provider, that provider may process payment, billing and refund information under its own policies.

24. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Service, legal requirements, service providers, app-store rules, business practices or data processing activities. The updated version will show a new Last Updated date. For material changes, we may provide notice through the Service, email or other reasonable means where required. Continued use of the Service after the updated Privacy Policy becomes effective means that the updated version applies to future processing, subject to applicable law.

25. Contact Information

Questions about this Privacy Policy or the processing of personal data may be sent to: BiteWise Privacy Contact: [To be completed] Email: [To be completed] Registered Address: [To be completed] Company Registration Number: [To be completed] VAT ID: [To be completed, if applicable] Users in the European Union also have the right to lodge a complaint with a data protection supervisory authority. The competent authority may be the authority of your habitual residence, place of work or the place of the alleged infringement.

Schedule 1. Processing Summary

Schedule 2. Account Deletion Summary

Schedule 3. Service Provider Checklist

Before publication, BiteWise should complete and verify the current list of service providers and data processing agreements. The following checklist is intended for internal legal review.