Privacy Policy

1. Introduction

Welcome to EatMeAI. We are committed to protecting your privacy and ensuring transparency about how we collect, use, and safeguard your personal information.

This Privacy Policy explains our practices regarding data collection and use when you use our service. By using EatMeAI, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information from Google Sign-In

When you sign in with Google, we receive the following information:

• Name: Your display name from your Google account
• Email Address: Your Google account email address
• Profile Image: Your Google account profile picture

We request only the basic OAuth scopes: openid, email, and profile. We do not request or access any additional Google data.

2.2 Information You Provide

• Allergy Profile: Information about your food allergies and dietary restrictions
• Location Data: Your location when searching for restaurants (used only for finding nearby restaurants)
• Usage Data: Information about how you interact with our service

2.3 Automatically Collected Information

We use Vercel Analytics to collect the following information automatically:

• Device information (browser type, operating system)
• IP address (for security and analytics purposes)
• Usage patterns and interactions with our service (page views, navigation)

Vercel Analytics is privacy-focused and does not use cookies or track users across websites. For more information, see Vercel's Analytics Privacy Policy.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Authentication: To verify your identity and manage your account
• Personalization: To provide personalized restaurant recommendations based on your allergy profile
• Service Improvement: To analyze usage patterns and improve our service
• Communication: To respond to your inquiries and provide customer support
• Security: To protect against fraud, abuse, and security threats

4. Google User Data and Limited Use Compliance

Our use of information received from Google APIs (Google acts as an authentication provider and we receive limited profile data from Google) adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Storage and Security

Your data is stored securely using Supabase, a trusted cloud database platform that acts as our data processor. We implement industry-standard security measures including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest
• Row-level security policies to protect user data
• Regular security audits and updates
• Access controls and authentication

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to using best practices.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal or regulatory purposes.

7. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers / Processors: We may share information with trusted service providers who process data on our behalf to operate the service. These include, but are not limited to: Google (authentication), Supabase (data storage and authentication), OpenAI (AI-powered analysis), Vercel (hosting and analytics), Cloudflare (DNS and content delivery), and OpenStreetMap/Nominatim (reverse geocoding for location searches). These providers act as processors under our instructions and are subject to confidentiality and data protection obligations.
• Legal Requirements: We may disclose information if required by law or in response to valid legal requests
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction

8. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can access your personal information through your account settings
• Correction: You can update or correct your information at any time
• Deletion: You can delete your account and all associated data by contacting us at nullcondition@gmail.com
• Data Export: You can request a copy of your data by emailing nullcondition@gmail.com
• Opt-Out: You can revoke Google OAuth access through your Google account settings

9. Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: