Yumlate
Privacy Policy
docs/legal/). Confirm with counsel before store submit.1. What Yumlate is
Yumlate helps you scan restaurant menus, translate them, highlight allergens, and (over time) browse shared menus on a map. Some features work offline; others use our cloud services and partners.
2. Data we process
On device: profile fields you enter, allergy preferences, friends/groups, saved menus, local caches and quotas.
In the cloud: account identifiers (e.g. Firebase Auth UID), AI usage/quota, structured shared menu data so others can benefit from translations and future map features. Menu photos are processed for translation; we keep structured results rather than a long-term photo library.
Sensitive-adjacent: allergy preferences (health-related) only if you enable them — explicit consent where required.
Location: if you allow it when saving a restaurant, for place matching / future map pins.
3. Purposes & legal bases (GDPR)
| Purpose | Basis |
|---|---|
| Provide the Service (scan, translate, quotas) | Contract |
| Shared menu database / map | Contract and/or legitimate interests |
| Security & abuse prevention | Legitimate interests |
| Allergy filtering | Explicit consent (Art. 9) where applicable |
| Analytics / personalized ads / marketing email / optional push | Consent |
| Export / delete / legal compliance | Legal obligation / legitimate interests |
4. Shared menus
Structured translations may be stored for other users. New scans for the same restaurant are compared to the current menu; we update when content changes and avoid unnecessary duplicates. We do not auto-delete shared menus solely by age.
5. Processors & transfers
We use Google Firebase (Auth including anonymous guest sessions and Google / Apple / Facebook / email sign-in, Firestore, Functions, Remote Config; and later Analytics, FCM, Hosting, etc.) and Google Gemini for menu translation. Later: Maps/Places, AdMob, app stores/IAP, email, consent CMP as features launch.
Processing may involve transfers outside the EEA (notably the United States). Where required we rely on safeguards such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs).
6. Retention
- Local app data: until clear/uninstall or in-app delete
- Shared menus: kept for the product; updated on content change
- Usage/quota: anonymised on account deletion
- Analytics raw events: 14 months, then delete or aggregates only
7. Your rights
Access, rectify, erase, restrict, object, portability, withdraw consent — contact support@yumlate.com. Complaint: Swedish Authority for Privacy Protection (IMY) or your local authority. In-app: export and delete account under Privacy settings.
8. Children
Intended audience: 16+ in the EU and 13+ in the US (or higher if required). Not directed at children.
9. USA summary
Depending on state law (e.g. CCPA/CPRA) you may have rights to know, delete, correct, and opt out of “sale” or “sharing” for cross-context behavioural advertising. We do not sell personal information for money. Ads/analytics that constitute sharing run only with required choices. Contact support@yumlate.com.