Privacy

This privacy policy explains what personal data we collect, process and store when you use simpli.menu and dashboard.simpli.menu.

Personal data that restaurants include in their content (e.g. names in the legal notice or persons shown in images) is processed by us on behalf of the respective restaurant under our data processing agreement (simpli.menu/en/dpa); the restaurant is the controller in that respect.

Jannik Thieme

c/o IP-Management #11157

Ludwig-Erhard-Straße 18

20459 Hamburg, Germany

Email: info@simpli.menu

When registering and using simpli.menu, we collect:

– Email address and password (stored only as a hash) for authentication

– First and last name, display name and, optionally, the account holder's company name

– Billing data: billing name, billing address and, optionally, VAT ID

– Delivery address when ordering the Starter Kit

– Restaurant name, address and description, and the restaurant's legal notice (Impressum) details, which are shown publicly on the menu page

– Profile and restaurant images you upload

– Menu content (dishes, categories, prices, allergens)

– Files you upload for the setup service or the AI menu import (PDFs, photos, logos)

– Feedback you send via the dashboard, including the page you were on and browser information

– Your consent to email news, including when it was given or withdrawn

– If you consent to marketing cookies: the Google Ads click ID with which you arrived at simpli.menu (see Section 7a)

– Starter Kit waitlist entries (email address, restaurant name)

– Payment data such as card or bank account details and the SEPA Direct Debit mandate (processed directly via Stripe — we do not store full card or bank account details)

Legal basis: Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(c) GDPR (statutory retention obligations, see Section 3a) and Art. 6(1)(f) GDPR (legitimate interests). Data is not shared with third parties for advertising purposes.

Reports of illegal content: If you report content on a menu page (via the "Report content" link or by email to info@simpli.menu), we process your name, email address, the page concerned and your explanation in order to review the report, inform you of our decision and handle any objection. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA. We keep this data for as long as necessary for these purposes.

We store your personal data only for as long as necessary for the purposes described above:

– Account and menu data: for the duration of the contractual relationship. When you delete your account, your account, restaurant and menu data, setup service requests, feedback, waitlist entries and all uploaded files are deleted immediately and permanently; recovery is not possible afterwards.

– Starter Kit orders (order data including delivery address) and invoices: we keep this data, which is relevant under commercial and tax law, even after an account is deleted until the statutory retention periods expire (6 or 10 years pursuant to § 257 HGB, § 147 AO), and during that time only process it for this purpose.

– Server logs: 30 days (see Section 8).

If you withdraw your consent to Google Analytics: data collection stops immediately; already collected, pseudonymized data is processed according to Google's deletion schedules.

Without your consent, we only store on your device what is technically necessary to run the service:

– "simpli_consent" (cookie, 180 days): stores your cookie banner choice for simpli.menu and dashboard.simpli.menu

– Firebase Authentication sign-in data (LocalStorage or IndexedDB), so you stay signed in to the dashboard

– "theme" (LocalStorage): your choice between light and dark mode

– other LocalStorage entries in the dashboard, e.g. dismissed notices and layout settings

– the language setting on menu pages (see Section 12)

Only if you consent to marketing cookies do we additionally set "simpli_gclid" (cookie, 90 days), which stores the Google Ads click ID (see Section 7a), as well as the cookies listed in Sections 7–7c.

Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR for technically necessary storage; § 25(1) TDDDG and Art. 6(1)(a) GDPR for "simpli_gclid".

We use Firebase by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for:

– Firebase Authentication: user account management

– Cloud Firestore: storage of restaurant and menu data

– Firebase Storage: storage of images and media files

– Firebase Cloud Functions: server-side processing

Data may be transferred to the USA under the EU-US Data Privacy Framework. More: https://firebase.google.com/support/privacy

To protect the dashboard (dashboard.simpli.menu) from abuse by automated access (bots), we use Firebase App Check with Google reCAPTCHA v3, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open the dashboard, device and browser information, your IP address and interaction data are sent to and evaluated by Google. No image puzzles are shown.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our services from abuse) and Section 25(2) No. 2 TDDDG. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. More: https://policies.google.com/privacy

Payments are processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Depending on the payment method, Stripe processes card details or bank account details (IBAN, account holder) and, for SEPA Direct Debit, the direct debit mandate. Payment data is sent directly to Stripe; we do not store full card or bank account details.

Legal basis: Art. 6(1)(b) GDPR. More: https://stripe.com/privacy

We send system emails (e.g. email address confirmation, password resets, order confirmations) and, if you have opted in, news via the service Resend, provided by Plus Five Five, Inc., USA. This processes your email address and the content of the respective email. Emails you send to info@simpli.menu are stored with STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

Legal basis: Art. 6(1)(b) GDPR (performance of contract), or Art. 6(1)(a) GDPR for news, which you can unsubscribe from at any time in your account settings. Transfers to the USA are based on the EU Standard Contractual Clauses. More: https://resend.com/legal/privacy-policy

To detect and fix technical errors in the dashboard, we use Sentry, provided by Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. When an error occurs, technical information (e.g. error message, browser, operating system, page visited, IP address) is transmitted. Sentry does not set cookies.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, error-free service). Data may be transferred to the USA; Functional Software, Inc. is certified under the EU-US Data Privacy Framework. More: https://sentry.io/privacy/

For AI translations, allergen detection, spelling suggestions and the AI menu import, we use Google Vertex AI from Google Ireland Limited. This processes menu content and the files you upload for an import (PDFs, photos of your menu). Processing takes place in the EU (Frankfurt region). No personal guest data is transmitted.

Legal basis: Art. 6(1)(f) GDPR.

We use Google Analytics (GA4) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland to analyze the use of simpli.menu and the dashboard (dashboard.simpli.menu). We collect:

– Pseudonymized usage and interaction data (e.g. pages visited, time on page, clicks)

– Device and browser information

– Approximate location (city/region level)

– IP address (truncated/anonymized before storage)

Legal basis: your consent under Art. 6(1)(a) GDPR, given or declined via our cookie banner. Without consent, no analytics cookies are set and no data is transmitted to Google Analytics.

With consent, Google Analytics sets the cookies "_ga" (retention: 2 years) and "_ga_<container-id>" (retention: 2 years) to recognize returning visitors. Event data retention in our Google Analytics account is limited to 14 months.

Data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework. We have entered into Google's Data Processing Terms for Analytics with Google.

You can withdraw or change your consent at any time via "Cookie Settings" in the footer. Alternatively, Google offers a browser add-on to opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout. More on Google's data processing: https://policies.google.com/privacy

We use Google Ads conversion tracking and remarketing by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland to measure the performance of our advertising campaigns and to show you relevant ads on other websites. We collect:

– Whether you reached simpli.menu via a Google ad, and which ad/campaign

– Conversion events (e.g. sign-up) linked to that ad click

– Device and browser information

– IP address (truncated/anonymized before storage)

Legal basis: your consent under Art. 6(1)(a) GDPR, given or declined via our cookie banner. Without consent, no advertising cookies are set and no data is transmitted to Google Ads.

With consent, Google Ads sets cookies such as "_gcl_au" (retention: up to 90 days) to link an ad click to a later conversion.

Data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework. We have entered into Google's Data Processing Terms for Ads with Google.

You can withdraw or change your consent at any time via "Cookie Settings" in the footer. More on Google's data processing: https://policies.google.com/privacy

We use the Meta Pixel by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland to measure the performance of our Facebook/Instagram ad campaigns and to show you relevant ads. We collect:

– Pages visited and interactions on simpli.menu

– Conversion events (e.g. sign-up) linked to a Facebook/Instagram ad

– Device and browser information

– IP address

Legal basis: your consent under Art. 6(1)(a) GDPR, given or declined via our cookie banner. Without consent, the Meta Pixel is not loaded and no data is transmitted to Meta.

With consent, Meta sets cookies such as "_fbp" (retention: 90 days) to recognize your browser across visits.

Data may be transferred to the USA. Meta is certified under the EU-US Data Privacy Framework. We have entered into Meta's Data Processing Terms with Meta.

You can withdraw or change your consent at any time via "Cookie Settings" in the footer. More on Meta's data processing: https://www.facebook.com/privacy/policy/

We use the TikTok Pixel by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland to measure the performance of our TikTok ad campaigns and to show you relevant ads. We collect:

– Pages visited and interactions on simpli.menu

– Conversion events (e.g. sign-up) linked to a TikTok ad

– Device and browser information

– IP address

Legal basis: your consent under Art. 6(1)(a) GDPR, given or declined via our cookie banner. Without consent, the TikTok Pixel is not loaded and no data is transmitted to TikTok.

With consent, TikTok sets cookies such as "_ttp" (retention: 13 months) to recognize your browser across visits.

Data may be transferred outside the EU/EEA, including to the USA. We have entered into TikTok's Data Processing Terms with TikTok.

You can withdraw or change your consent at any time via "Cookie Settings" in the footer. More on TikTok's data processing: https://www.tiktok.com/legal/privacy-policy

The simpli.menu website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Application data processed through the platform (see Section 4) is stored with Google Firebase (Google Cloud Platform), with servers located within the EU/EEA. Vercel is certified under the EU-US Data Privacy Framework. Technical access logs (server logs) are deleted after a maximum of 30 days.

To measure page speed, we use Vercel Speed Insights, including on the menu pages. Performance metrics (e.g. load times) are sent to Vercel together with the page visited, device type, browser and operating system; your IP address is technically processed in the process. Speed Insights sets no cookies and builds no cross-site user profiles. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a fast, functional website). More: https://vercel.com/docs/speed-insights/privacy-policy

You have the right to access, correct, delete, restrict, port and object to processing of your data (Arts. 15–21 GDPR).

You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR), e.g. via "Cookie settings" in the footer or, for email news, in your account settings. This does not affect the lawfulness of processing carried out before the withdrawal.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Providing the data required for registration and performance of the contract (email address, name, billing address) is necessary to conclude the contract; without it we cannot provide Simpli to you. All other information is voluntary.

Contact for privacy requests: info@simpli.menu

You may also lodge a complaint with the data protection authority responsible for our business location in Stuttgart, the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI): https://www.baden-wuerttemberg.datenschutz.de

We may update this policy. The current version is always available at simpli.menu/en/privacy.

For privacy enquiries, contact: info@simpli.menu

Guests who open a menu provided by Simpli (for example after scanning a QR code in a restaurant) have their own short privacy notice. It explains which data is processed when a menu is opened, including the anonymous scan statistics.

Privacy notice for guests