Privacy Policy

1. Who we are

BearMenu ("we", "us", "our") is a food and dining discovery platform operated from Romania. We help users find restaurants, dishes, and drinks near them.

The controller of personal data, within the meaning of art. 4 (7) GDPR, is:

We have not appointed a Data Protection Officer — none of the cases in art. 37 GDPR applies to us. For anything concerning your data, write to the email address above.

2. Data we collect

We collect the following categories of data:

• Account data — your name and email address when you sign in.
• Location data — your approximate GPS position when you grant permission, used to show nearby restaurants and dishes. We do not store your location history.
• Usage data — pages visited, searches performed, features used and errors encountered, collected through Google Analytics (with anonymised IP) and PostHog. Once you accept analytics, PostHog also records the session — pages, clicks, scrolling, mouse movement — with the contents of text inputs masked.
• Preferences — selected city, language and theme. Theme is stored locally on your device; city and language are cookies, because the server reads them before rendering the page.
• Favourites — dishes and places you save, stored in our database and linked to your account.
• Data about venues and their contact people — the trading name, address, phone, email, opening hours and public links of the venues we list, plus public reviews about them. This data does not come from you but from public sources — section 11 describes it in full.

3. How we use your data

• To provide personalised restaurant and menu recommendations.
• To authenticate your account and keep your saved favourites.
• To improve the app based on aggregate usage patterns.
• To communicate important service updates (no marketing emails without consent).
• To build and maintain the catalogue of venues, menus and grades published on the platform.

4. Legal basis (GDPR)

We process your personal data on the following legal bases:

• Performance of a contract — to provide the service you signed up for — art. 6 (1) (b).
• Legitimate interests — to improve the app, prevent fraud and build the venue catalogue — art. 6 (1) (f). You can object at any time, see section 9.
• Consent — for location access and analytics cookies, including session recording — art. 6 (1) (a). You can withdraw it at any time.

5. Who we disclose data to

We do not sell your personal data. We disclose it only to the following recipients, each acting as a processor:

• Our authentication provider (Keycloak, self-hosted), for secure sign-in.
• Google Ireland Ltd. / Google LLC — Google Analytics 4, for usage statistics with anonymised IP, only after consent.
• Our hosting infrastructure provider, to run the application.
• PostHog — product analytics and session recording, only after consent.
• Public authorities, where the law requires it.

6. Transfers outside the European Economic Area

Google and PostHog are companies established outside Romania. PostHog traffic goes through a domain of ours (t.bear.menu) to the provider's European infrastructure, and Google Analytics collects through Google's European collection endpoint. To the extent data leaves the European Economic Area — typically to the United States — the transfer relies on the safeguards in Chapter V GDPR: standard contractual clauses approved by the European Commission and/or certification under the EU–US Data Privacy Framework. You can request a copy of those safeguards by writing to our contact address.

7. Cookies and similar technologies

We use essential and functional cookies for authentication, language and the selected city. Analytics cookies (Google Analytics and PostHog) and session recording are enabled only after you explicitly accept via the consent banner — they never load without your permission. For the full list, with purpose and duration, see the Cookie Policy.

8. How long we keep data

Account data is kept for as long as the account is active. Google Analytics usage data is retained for 14 months, per the platform's default setting; PostHog session recordings are kept for at most 12 months. Contact data for venues and prospects is kept for 12 months after the last interaction, and deleted immediately if the person objects. You can request deletion at any time.

9. Your rights

Under the GDPR, you have the right to:

• Access — request a copy of your personal data (art. 15).
• Rectification — have inaccurate data corrected (art. 16).
• Erasure — request deletion of your account and data (art. 17).
• Restriction of processing — ask us to stop using your data while keeping it, for as long as you contest its accuracy or the basis for processing (art. 18).
• Portability — receive your data in a machine-readable format (art. 20).
• Objection — object at any time to processing based on legitimate interests, including commercial prospecting (art. 21).

To exercise your rights, write to us at [email protected]. We respond within 30 days.

10. Withdrawing consent

Consent for analytics cookies and session recording can be withdrawn at any time by clearing cookies and localStorage for bear.menu in your browser: the banner reappears, and declining stops collection entirely. Withdrawal does not affect the lawfulness of processing carried out beforehand, per art. 7 (3) GDPR. We are building a "Cookie settings" control into the footer of every page so that withdrawing is as easy as granting.

11. Data we do not receive from you (art. 14 GDPR)

To build the catalogue of venues, menus and grades, we also process data obtained from sources other than the data subject. This section is the notice art. 14 GDPR requires for those cases.

a) Contact data for venues and their representatives

• Categories of data — trading name, address, phone, email address, opening hours, social media links and — for venues run by a sole trader or a single professional — that person's name.
• Source — the venues' public web pages, their public social media pages and public registers. We do not buy contact lists.
• Purpose and legal basis — B2B outreach and commercial prospecting, on our legitimate interest in promoting the service to suitable venues — art. 6 (1) (f). We balanced that interest against the recipient's rights: we use strictly the data the venue published in order to be contacted professionally, and we delete on the first objection.
• Retention — 12 months after the last interaction; immediately, on objection.

b) Public reviews about venues

• Categories of data — the review text, the rating given, the date and, where publicly displayed, the author's display name.
• Source — the public review platforms indexed for that venue, primarily Google Maps. Reviews are not written on BearMenu.
• Purpose and legal basis — calculating the BearMenu grade, on our legitimate interest in publishing an informed assessment of venues — art. 6 (1) (f). We do not republish individual reviews and do not display author names; we use them only in aggregate.
• Retention — as long as needed to calculate and verify the grade; the raw material is not published.

Your rights in these cases

You have the right to object at any time to processing based on legitimate interests (art. 21 GDPR) by writing to [email protected]. If you object to prospecting, we delete your contact data and stop collecting it. You also have the rights of access, rectification, erasure, restriction and portability described in section 9.

12. Security

We use industry-standard security practices, including HTTPS encryption, secure authentication and access controls. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

13. Right to lodge a complaint

If you believe we are infringing your rights, you can lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — B-dul G-ral. Gheorghe Magheru nr. 28-30, sector 1, 010336 Bucharest, [email protected], www.dataprotection.ro — or bring the matter before the competent court. Writing to us first would help, but it is not a precondition.

14. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by updating the date at the top of this page.

15. Contact

For privacy questions or requests, contact us at [email protected].