Privacy Policy

Last updated: May 15, 2026

1. Introduction

This Privacy Policy explains which personal data we process in connection with Eatano, for which purposes we process it, on which legal bases the processing is carried out and which rights you have. This Privacy Policy applies to our website, mobile applications, platform functions, operator areas, support and communication channels and other digital services provided by Eatano.

Personal data means any information relating to an identified or identifiable natural person. This may include, for example, your name, email address, phone number, location data, usage data, payment data, order and reservation data, content such as reviews or images, and technical data such as IP addresses or device information.

2. Controller

Niklas Butz
trading as Eatano
Emsdettener Straße 10
c/o Postflex #PFX-080-594
48268 Greven
Germany

Email: [email protected]
Phone: +49 1567 8208726
Legal Notice / Imprint: https://eatano.net/impressum

No data protection officer has been appointed, as there is currently no legal obligation to appoint a data protection officer.

3. Overview of processed data

Depending on how you use Eatano, we may process in particular the following categories of personal data:

• Account and master data: name, username, customer number, user ID, operator account, company or restaurant assignment.
• Contact data: email address, phone number, address, support contact details.
• Login and authentication data: email address, password hash, login timestamps, session data, single sign-on identifiers, two-factor or security data.
• Location data: location coordinates or manually entered locations for search, radius search, order processing and order history.
• Content data: reviews, comments, images, profile information, support messages, ticket content, survey responses, reports or other user input.
• Contract and business data: operator accounts, restaurant data, reservations, orders, invoices, bookings, contract periods, booked services, license or tariff data.
• Payment data: payment status, transaction data, invoice data, Stripe customer and payment references. Full credit card data is generally not processed by us, but by the payment service provider.
• Usage data: page views, app usage, clicks, interactions, search queries, viewed restaurants, used features, newsletter open and click rates.
• Technical data: IP address, device information, operating system, browser, app version, language settings, log files, push tokens, cookie and consent information.
• Whistleblowing and report data: contents of reports, contact details of the reporting person, affected persons, facts of the case and processing status, where a whistleblowing or reporting function is used.
• Employee and applicant data: data relating to employees, applicants, freelancers or persons involved in internal or organizational processes.

4. Purposes of processing

We process personal data in particular for the following purposes:

• providing, operating and securing our website, app and platform,
• registration, login and management of user accounts,
• providing public user profiles and community functions,
• displaying, creating and managing restaurant reviews, images, comments and other content,
• location-based search, restaurant recommendations, map functions and radius search,
• processing orders, reservations, invoices and operator services,
• transmitting required order and location information to participating restaurants,
• payment processing via Stripe and Stripe Connect,
• supporting restaurant operators, business customers and partners,
• support, ticketing, contact requests and customer communication,
• sending newsletters, service emails, product information and electronic notifications,
• sending push notifications, including promotional push messages where consent has been given,
• conducting competitions, campaigns, referral and affiliate programs,
• conducting surveys, feedback requests and user research,
• web analytics, reach measurement, monitoring, optimization and error analysis,
• abuse, fraud and security prevention,
• fulfilling legal obligations, in particular commercial, tax, payment and data protection obligations,
• processing whistleblowing or reporting submissions, where such a function is used,
• establishing, exercising or defending legal claims.

5. Legal bases

The processing of personal data is carried out in particular on the following legal bases:

• Art. 6(1)(a) GDPR – consent: where you have given us your consent, for example for newsletters, certain cookies, marketing tracking, location access or push notifications.
• Art. 6(1)(b) GDPR – contract and pre-contractual measures: where processing is necessary to provide our services, create an account, process orders or reservations, or manage operator accounts.
• Art. 6(1)(c) GDPR – legal obligation: where we are legally required to process data, for example due to tax or commercial retention obligations.
• Art. 6(1)(f) GDPR – legitimate interests: where processing is necessary to ensure operation, IT security, abuse prevention, internal organization, service optimization or enforcement of legal claims, and your interests do not override ours.
• Art. 9(2) GDPR: where special categories of personal data are processed in exceptional cases, for example if such data is voluntarily provided in support, review, reporting or communication content.

For access to information on your device or the storage of information on your device, for example through cookies, local storage technologies or similar technologies, we also comply with the requirements of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where consent is required, we obtain it through a consent management solution.

6. Security measures

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration or disclosure. These measures include, in particular, access restrictions, role-based permissions, encryption during transmission, secure authentication procedures, logging of security-relevant processes, regular maintenance and security measures at server and application level.

Data transmitted between users and our online services is generally encrypted via HTTPS/TLS. Passwords are not stored in plain text, but processed in hashed form.

7. Data sharing and processors

We only share personal data if this is necessary for the respective purposes, if there is a legal obligation, if consent has been given or if we have a legitimate interest. Recipients may include hosting providers, CDN and security service providers, payment service providers, communication service providers, analytics providers, app and push service providers, restaurants, operators, support service providers, tax advisors, legal advisors, authorities or other service providers.

Where service providers process personal data on our behalf, we enter into data processing agreements or comparable data protection agreements with these service providers.

8. International data transfers

Some of the service providers we use may process personal data outside the European Union or the European Economic Area, in particular in the United States. In such cases, we ensure that appropriate safeguards are in place, such as adequacy decisions, the EU-U.S. Data Privacy Framework, standard contractual clauses or other legally provided protection mechanisms.

9. Storage period and deletion

We store personal data only for as long as it is necessary for the respective purposes, as long as statutory retention obligations apply, as long as evidence must be retained or as long as legitimate interests justify further storage.

• Server log files are generally stored for up to 30 days and then deleted or anonymized, unless longer storage is required to investigate security incidents.
• Account data is generally stored for the duration of the user account.
• Order, invoice and contract data may be stored for longer periods due to commercial and tax retention obligations.
• Support and ticket data is stored for as long as necessary to process the request, document the matter and defend legal claims.
• Newsletter consents and unsubscribe information may be stored to prove consent and to respect objections.
• Public posts, reviews and comments may remain available after account deletion if this is necessary for the traceability of reviews, discussions or platform content. Direct personal references will be deleted or pseudonymized where possible.

10. Account and data deletion

Users may request deletion of their Eatano user account and the associated personal data. Deletion can be requested in particular through the account deletion function provided in the app or by contacting [email protected].

If direct account deletion is provided in the app, it can be accessed in the user area, for example under Profile → Settings → Account → Delete account. In addition, we provide a web-based option through which users can request deletion of their account and associated data: https://eatano.net/konto-loeschen-anfrage. This page is publicly accessible without requiring users to log in first.

When an account is deleted, we delete or anonymize personal data unless statutory retention obligations, legitimate evidence interests, open contractual relationships, payment processing, security incidents or other legal reasons prevent immediate deletion. Data that must be retained for legal reasons will be restricted for other purposes and processed only for the respective statutory or legal purposes.

After account deletion, public content such as reviews, comments or posts may remain visible if this is necessary for the traceability of the platform, the integrity of reviews or the rights of other users and restaurants. In such cases, direct personal references will be removed, anonymized or pseudonymized where possible.

Typical deletion and retention periods include in particular:

• Account data: deletion or anonymization after account deletion, unless retention obligations apply.
• Order, payment, invoice and contract data: retention in accordance with statutory commercial and tax obligations, generally up to 10 years.
• Support and ticket data: storage for as long as necessary for processing, documentation and legal defense.
• Server log files: generally up to 30 days, unless longer storage is necessary to investigate security incidents.
• Newsletter and marketing consents: storage to prove consent and to respect unsubscribes or objections.
• Push tokens: deletion or deactivation when push notifications are disabled, the app is uninstalled or the token is no longer valid.

Requests for account or data deletion can be submitted via https://eatano.net/konto-loeschen-anfrage or by email to [email protected]. To prevent unauthorized deletions, we may carry out an appropriate identity verification.

11. Rights of data subjects

Subject to the applicable legal requirements, you have in particular the following rights:

• the right to obtain information about the personal data processed,
• the right to rectification of inaccurate or incomplete data,
• the right to erasure,
• the right to restriction of processing,
• the right to data portability,
• the right to withdraw consent with effect for the future,
• the right to object to processing based on legitimate interests,
• the right to object to direct marketing,
• the right to lodge a complaint with a data protection supervisory authority.

To exercise your rights, you can contact us at [email protected].

12. Provision of website, app and technical infrastructure

To provide Eatano, we process technical data such as IP address, device information, browser data, app version, operating system, access times, accessed content, log data and error data. This processing is necessary to deliver our services, ensure technical stability, prevent abuse and investigate security incidents.

We use in particular the following providers:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – hosting, server and infrastructure services. Privacy information: https://www.hetzner.com/de/rechtliches/datenschutz
• STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany – hosting, domain, email or infrastructure services. Privacy information: https://www.strato.de/datenschutz/
• Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA – CDN, security functions, DDoS protection, caching, DNS, performance optimization and Cloudflare R2 for storing and delivering media. Privacy information: https://www.cloudflare.com/privacypolicy/

When using Cloudflare, technical data such as IP addresses, security events, request metadata and content delivered or stored via Cloudflare may be processed. We use Cloudflare R2 in particular to store and deliver images, media and other files via a CDN.

13. Cookies, local storage technologies and consent management

Eatano uses cookies, local storage technologies and similar procedures to provide technical functions, enable logins, store security settings, document consent decisions, perform usage analytics and, where permitted, enable marketing or optimization functions.

Technically necessary cookies and storage access are used to provide functions expressly requested by the user. Non-essential cookies or similar technologies, in particular for analytics, tracking or marketing, are only used after consent has been given.

You can manage or withdraw your consent at any time through our consent banner or the settings provided there.

14. Registration, login and user account

Users can create an Eatano account and log in. In this context, we process in particular name or username, email address, password hash, login data, session data, IP address, login times, account settings, roles, permissions and profile information.

The processing is carried out to provide and manage the user account, for authentication, security, abuse prevention and the provision of our platform services. The legal bases are Art. 6(1)(b) and Art. 6(1)(f) GDPR.

15. Single sign-on with Apple and Google

Eatano allows users to log in via Apple and Google. When using such a login method, you authenticate yourself with the respective provider. Depending on the provider and the permissions granted, we receive in particular a unique user identifier, your email address, possibly your name and other data you have released. Your password with the respective provider is not disclosed to us and is not stored by us.

• Apple Sign in / Apple ID: provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland, as well as affiliated Apple companies. Privacy information: https://www.apple.com/legal/privacy/
• Google Sign-In: provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy information: https://policies.google.com/privacy

The legal bases are Art. 6(1)(b) GDPR for providing the login function and Art. 6(1)(f) GDPR for our legitimate interest in secure and user-friendly login methods.

16. Public profiles, reviews, comments and uploads

Eatano may provide public user profiles, reviews, comments, images, restaurant posts and other community content. If you publish such content, it may be visible to other users, restaurants, operators or publicly on the internet depending on the function.

We process in particular profile information, usernames, review texts, star or score ratings, images, timestamps, assigned restaurants, categories, interactions, moderation data and technical security data. The processing serves to provide community and review functions, quality assurance, moderation, abuse prevention and the traceability of reviews.

The legal bases are Art. 6(1)(b) GDPR for providing platform functions and Art. 6(1)(f) GDPR for moderation, security, abuse prevention and protection against unlawful content.

17. Location data, search, maps and orders

Eatano processes location data if you grant us access, manually enter a location or use location-based functions. Location data is used in particular to show restaurants nearby, sort search results by distance, provide map functions, enable orders and deliveries and make the order history traceable within the Eatano system.

For orders, location and address data may be passed on to the respective restaurant where this is necessary to process, provide, deliver or prepare the order for pickup.

The processing of precise location data is generally based on your consent where this is required. For order and contract processing, processing may also be based on Art. 6(1)(b) GDPR.

OpenStreetMap or Leaflet may be used for map functions. When maps are displayed, technical data such as IP address, map section and usage data may be processed. Further information about OpenStreetMap: https://osmfoundation.org/wiki/Privacy_Policy

18. Restaurant operators, business customers and B2B functions

For restaurant operators, business customers and partners, Eatano processes data for setting up and managing operator accounts, restaurant profiles, menus, opening hours, orders, reservations, invoices, subscriptions, licenses, payments, support cases, roles and permissions.

This may include name, business contact details, company data, restaurant data, bank and payment references, contract data, invoice data, login data, employee or permission data and communication content.

The legal bases are Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for fulfilling legal obligations and Art. 6(1)(f) GDPR for organization, security, administration and further development of our business processes.

19. Orders, reservations, invoices and contract processing

If you place an order via Eatano, request a reservation or use a paid service, we process the data required for this purpose. Depending on the transaction, this may include name, contact details, delivery or pickup information, location or address data, selected products or services, restaurant assignment, payment status, invoice data, order history, reservation data and communication relating to the transaction.

Required data is passed on to the participating restaurant or the respective operator where this is necessary to carry out the order, reservation or service.

The legal basis is Art. 6(1)(b) GDPR. Where statutory retention obligations apply, processing is carried out on the basis of Art. 6(1)(c) GDPR.

20. Payment processing with Stripe and Stripe Connect

We use Stripe for payment processing. Depending on the payment method, payment data, invoice data, transaction data, name, email address, billing address, payment status, fraud prevention data and further information required for payment processing may be processed.

For payments in favor of restaurants or operators, Stripe Connect may be used. In this case, Stripe processes data required for payment processing, payouts, identity or compliance checks, fraud prevention and legal obligations. Data of restaurant operators and their authorized representatives may also be processed.

Payment data is generally processed directly by Stripe. We usually do not receive full credit card information, but payment status, transaction references and information necessary for processing.

Provider: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, as well as affiliated Stripe companies. Privacy information: https://stripe.com/de/privacy. Further information about Stripe Connect: https://stripe.com/connect

The legal bases are Art. 6(1)(b) GDPR for payment and contract processing, Art. 6(1)(c) GDPR for legal obligations and Art. 6(1)(f) GDPR for fraud prevention and security.

21. Support, contact requests and ticket system

If you contact us or use our support ticket system, we process the data you provide, in particular name, contact details, user account, subject, request, message content, attachments, technical information, ticket status, processing history and communication history.

The processing serves to handle your request, document the matter, improve our support, analyze errors and, where applicable, defend legal claims. The legal bases are Art. 6(1)(b) GDPR where the request is related to a contract, and Art. 6(1)(f) GDPR for general communication, organization and documentation purposes.

22. Newsletters and electronic notifications

We send newsletters and electronic notifications if you have consented to this or if there is a legal permission. Content may include information about Eatano, features, offers, promotions, restaurants, product news, operator information or other relevant communications.

For sending such messages, we process in particular email address, name, consent status, time of registration, IP address, unsubscribe information and technical delivery data. If newsletter tracking is enabled, we may also record openings, clicks, devices used, timestamps and interactions in order to optimize the content and delivery.

Sending and tracking are generally based on your consent. You may unsubscribe from the newsletter at any time using the unsubscribe link in the respective email or by contacting [email protected].

We may store unsubscribed email addresses in a suppression list to ensure that no further promotional communication is sent.

23. Push notifications

Eatano may send push notifications, for example regarding order status, reservations, support replies, security messages, new features, restaurant offers, promotions or other notices. Promotional push notifications are only sent where consent has been given.

For push notifications, we process in particular push tokens, device information, operating system, app version, notification settings, topic or interest categories and delivery status.

Depending on the device and platform, push notifications are processed via Apple Push Notification Service or Firebase Cloud Messaging:

• Apple Push Notification Service: Apple Distribution International Ltd. and affiliated Apple companies. Privacy information: https://www.apple.com/legal/privacy/
• Firebase Cloud Messaging: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy information: https://policies.google.com/privacy

You can disable push notifications at any time in your device settings or within the app.

24. Expo / EAS and app services

Expo or Expo Application Services may be used for development, deployment, updates, build processes and technical app services. In this context, technical data, app build data, device information, project information, update information, IP addresses and usage data related to app deployment may be processed.

Provider: Expo Application Services / Expo. Privacy information: https://expo.dev/privacy

The legal basis is Art. 6(1)(f) GDPR due to our legitimate interest in secure, efficient and maintainable app deployment.

25. Web analytics, app analytics, monitoring and optimization

We use analytics and monitoring procedures to understand the use of Eatano, detect errors, improve features, measure reach and make our services more user-friendly. In this context, usage data, device information, technical data, interactions, page views, events, referrers, approximate location data and cookie or device identifiers may be processed.

Analytics and tracking technologies that are not technically necessary are only used after appropriate consent has been given.

Google Analytics

We use Google Analytics to analyze the use of our online services. Usage data, technical information, events, interactions and pseudonymous identifiers may be processed. Google Analytics may use cookies or similar technologies.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy information: https://policies.google.com/privacy. Information about Google Analytics: https://marketingplatform.google.com/about/analytics/

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

Matomo

We use Matomo for privacy-oriented analysis of the use of our services. Depending on the configuration, Matomo may be operated with or without cookies. In particular, page views, usage interactions, technical information, shortened IP addresses and timestamps may be processed. Where Matomo is used without cookies and with sufficient anonymization, processing may be based on legitimate interests. Where cookies or similar technologies are used, processing is based on your consent.

Further information about Matomo: https://matomo.org/privacy-policy/

26. Marketing, advertising, referral and affiliate programs

We may process personal data for marketing, campaigns, recommendations, vouchers, referral programs and affiliate programs. This may include user identifiers, referral links, promotion codes, clicks, registrations, orders, referred restaurants, redeemed vouchers, commission or benefit statistics and technical security data.

Depending on the function, processing is carried out to run the respective program, prevent abuse, calculate benefits or commissions and measure success. The legal bases are Art. 6(1)(b) GDPR where participation in a program is contractual, Art. 6(1)(a) GDPR for consent-based tracking and Art. 6(1)(f) GDPR for security, documentation and abuse prevention purposes.

27. Competitions, promotions and contests

If we conduct competitions, promotions or contests, we process the data required for participation and execution. This may include name, contact details, user account, participation entry, winner status, shipping data, communication data and evidence data.

The data is processed to conduct the competition or promotion, notify participants, process prizes, prevent abuse and document the process. The legal bases are Art. 6(1)(b) GDPR, Art. 6(1)(a) GDPR where consent is required, and Art. 6(1)(f) GDPR.

28. Surveys and feedback

We may conduct surveys, feedback forms and user research to improve Eatano, evaluate features and better understand user needs. In this context, we process in particular responses, ratings, free-text information, technical data, time of participation and, where feedback is requested, contact details.

Where possible, we evaluate surveys anonymously or in aggregated form. The legal bases are Art. 6(1)(a) GDPR for consent-based surveys, Art. 6(1)(b) GDPR for contract-related feedback and Art. 6(1)(f) GDPR for our legitimate interest in improving our services.

29. Embedded content, YouTube and maps

Eatano may embed third-party content, in particular videos, maps, scripts, fonts, icons or similar functions. When such content is loaded, technical data such as IP address, browser information, device information and usage data may be transmitted to the respective provider.

YouTube

We may embed YouTube videos. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When YouTube videos are loaded or played, data may be transmitted to Google and cookies or similar technologies may be used. Where possible, we use privacy-friendly embedding options.

Privacy information: https://policies.google.com/privacy

OpenStreetMap / Leaflet

OpenStreetMap data and Leaflet may be used for map functions. When using map functions, technical data and location data may be processed. Location data is only processed where you grant access, manually enter it or where it is required for a function you use.

30. Images, media and Cloudflare R2/CDN

If you upload images or other media, for example for reviews, profiles, restaurants, menus, tickets or operator functions, we store and process these files to provide the respective function. Public images may be publicly visible and delivered via our CDN.

We may use Cloudflare R2 and Cloudflare CDN for storage and delivery. File contents, filenames, metadata, access information, IP addresses and technical access data may be processed. Non-public files, such as certain support, document or invoice files, are only made accessible within the respective permission context.

31. Whistleblowing system and reports

Where Eatano provides a whistleblowing system or reporting option, we process the data submitted as part of a report. This may include information about the reporting person, contact details, information about affected persons, witnesses, descriptions of facts, attachments, communication histories, processing status and internal review notes.

Depending on the design, reports may be submitted anonymously or with contact details. The data is processed to receive, review, handle and document reports and, where applicable, to take further measures.

The legal bases are Art. 6(1)(c) GDPR where there is a legal obligation, Art. 6(1)(f) GDPR due to legitimate interests in compliance, investigation and legal enforcement, and Art. 6(1)(a) GDPR where consent is relevant.

32. Employee, applicant and internal organization data

We may process personal data of employees, applicants, freelancers, service providers or other persons involved internally. This may include master data, contact data, contract data, payroll or billing data, communication data, roles, access permissions, work or performance data and organizational information.

Processing is carried out to establish, perform or terminate employment, application, service or cooperation relationships, for internal organization, to secure our systems and to fulfill legal obligations. The legal bases are Art. 6(1)(b), Art. 6(1)(c) and Art. 6(1)(f) GDPR as well as, where applicable, Section 26 of the German Federal Data Protection Act (BDSG).

33. Social media

If we operate social media profiles or users communicate with us via social networks, we process the data transmitted there, in particular profile information, messages, comments, interactions and technical information. The operators of the respective platforms are generally also responsible for processing on those platforms.

Requests for information, deletion or other data subject rights in connection with data processed directly by social networks should preferably be addressed directly to the respective platform operator, as only the operator has comprehensive access to the data processed there.

34. Recipients: restaurants, operators and partners

When you use Eatano, personal data may be shared with restaurants, operators or partners where this is necessary for the respective function. This applies in particular to orders, reservations, contact requests, reviews, support cases, vouchers, loyalty programs, operator communication or complaints.

The respective recipients process data depending on their role either independently or within the Eatano functions provided. Where restaurants or operators are independent controllers under data protection law, their privacy information applies in addition.

35. Automated decision-making and profiling

Eatano may use usage data, location data, reviews, preferences and interactions to display content, search results, recommendations, vouchers or restaurant suggestions in a more user-friendly and relevant way. As a rule, no legally significant automated decision-making within the meaning of Art. 22 GDPR takes place unless expressly stated otherwise.

36. Minors

Eatano is not specifically directed at children. Where users are minors, certain functions may only be used with the consent of a parent or legal guardian or within the applicable legal requirements.

37. Changes to this Privacy Policy

We may update this Privacy Policy if our data processing activities, services used, legal requirements or technical functions change. The current version is available on our website.

38. Definitions

Where this Privacy Policy uses terms such as “personal data”, “processing”, “controller”, “processor”, “consent”, “legitimate interest” or “data subject”, the definitions of the General Data Protection Regulation apply.