1. Who We Are

Foodashi ("Foodashi", "we", "our", "us") operates an API and web platform for AI-generated food data, including recipes, nutritional information, allergen indicators, and food imagery.

For the purposes of applicable data protection laws:

• Foodashi acts as a Data Controller for account, billing, and usage data we collect directly from you.
• Foodashi acts as a Data Processor for API payloads (search terms, parameters, prompts) submitted by you to generate content via the API.

Contact for privacy matters: [email protected]

Registered address: Foodashi (Egyeni Vallalkozo), Budapest, Hungary.

Data Protection Officer: A DPO is not currently required under GDPR Article 37 due to the scale of processing. For all data protection inquiries, please contact: [email protected]

2. Data We Collect & Why

We minimise data collection and only process information required to provide, secure, and operate our Services. We do not collect data for advertising or behavioural profiling.

2A. Waitlist & Pre-launch Signups

Before Foodashi launches publicly, you may join our waitlist. This section explains exactly how we handle the information you give us when you sign up.

• What we collect: your name, your email address, and any text you choose to enter in the optional “what are you building?” field.
• Why we use it: for one purpose only — to email you when the Foodashi API launches and to tell you about early-access pricing. We do not use it for any other marketing.
• Lawful basis: your consent (GDPR Article 6(1)(a)), given by ticking the consent box on the signup form. You can withdraw your consent at any time — every email includes a one-click unsubscribe link, or you can email us. Withdrawing consent does not affect processing carried out before you withdrew.
• How long we keep it: until the launch campaign is complete or until you unsubscribe — whichever comes first — and in any case no longer than 24 months from signup. After that we delete your details (we may keep a minimal suppression record of your email so we don’t contact you again).
• We never sell or share it: your waitlist data is never sold, rented, traded, or shared for anyone else’s marketing.
• Where it’s stored: in our database hosted on Supabase in an EU region. Where any provider processes data outside the EEA, we rely on appropriate safeguards (such as EU Standard Contractual Clauses), as described in Sections 3 and 9.

You have the full set of rights described in Section 7 (access, rectification, erasure, restriction, portability, objection, and withdrawal of consent), and the right to lodge a complaint with the Hungarian supervisory authority (NAIH) or your local EU authority. To exercise any of these, or to be removed from the waitlist, email [email protected].

3. AI Sub-Processors & Data Transfers

To generate content, Foodashi transmits only the minimum necessary request data to trusted infrastructure and AI providers. We do not transmit billing, identity, or payment data to AI model providers.

Some sub-processors may process data outside of the European Economic Area (EEA). Where this occurs, transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission, or the sub-processor is certified under an applicable adequacy framework.

Foodashi does not use customer API payloads to train proprietary machine learning models.

4. Cookies & Tracking

Foodashi uses strictly necessary cookies for authentication, session management, and security. With your consent, we also use analytics and advertising cookies (described below). You can accept or reject non-essential cookies via our cookie banner, and change your choice at any time.

For website analytics and advertising measurement we use Google Analytics 4 and Google Ads (provided by Google Ireland Limited). These set cookies and process pseudonymous identifiers to measure traffic and conversions and to deliver and measure our advertising, including remarketing. They load only after you opt in: we use Google Consent Mode v2 so no analytics or advertising data is collected until you consent. Our legal basis is your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time via the cookie banner.

Strictly necessary cookies are exempt from consent under the ePrivacy Directive (2002/58/EC) and the UK PECR. Analytics and advertising cookies are set only with your consent, collected through our cookie-consent banner; until you opt in, they are blocked. You can withdraw or change your consent at any time via the banner.

5. Automated Processing

Foodashi uses automated systems exclusively for:

• Content generation: AI models process API requests to generate recipe and food data.
• Infrastructure protection: Automated rate limiting, abuse detection, and DDoS mitigation.
• Billing automation: Automated subscription management, renewals, and refund processing via Stripe.

We do not engage in automated decision-making that produces legal effects or similarly significant effects on individuals, as defined under GDPR Article 22. Aside from the consent-based analytics and advertising described in Section 4 — which you can decline — we do not perform credit scoring or other significant profiling.

6. Data Retention

After the retention period expires, data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for aggregate statistical purposes.

7. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights under applicable data protection law:

GDPR (EU/EEA): You have all rights listed above. You also have the right to lodge a complaint with your national Data Protection Authority (DPA).

Hungary (Lead Supervisory Authority): For users in Hungary and where Foodashi is the lead controller, the competent supervisory authority is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), https://naih.hu, address: 1055 Budapest, Falk Miksa utca 9-11.

UK GDPR: You have all rights listed above. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

CCPA/CPRA (California): California residents have the right to know what personal information is collected, request deletion, and opt out of the "sale" or "sharing" of personal information. Foodashi does not sell or share personal information as defined by the CCPA/CPRA. You may exercise your rights by contacting us. We will not discriminate against you for exercising your rights.

To exercise any of these rights, contact: [email protected]. We will respond within 30 days (or within the timeframe required by applicable law).

8. Data Sharing & Sale

Foodashi does not sell, rent, or trade personal data.

We only share data with:

• Service providers (sub-processors): As listed in Section 3, strictly necessary to operate the Services, under contractual confidentiality and data protection obligations.
• Legal authorities: If required by law, court order, or regulatory requirement, or to protect the rights, safety, or property of Foodashi or others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, subject to the same privacy commitments.

9. International Data Transfers

Your data may be processed in countries outside your country of residence, including countries that may not provide the same level of data protection. Where we transfer data outside of the EEA or UK, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions by the European Commission or UK Secretary of State.
• Binding Corporate Rules where applicable.

You may request a copy of the safeguards we use for international transfers by contacting [email protected].

10. Children's Privacy

The Services are not directed to, and we do not knowingly collect personal data from, children under the age of 16 (or such lower age as may apply in your jurisdiction). If you are a parent or guardian and believe your child has provided personal data to us, please contact [email protected] and we will promptly delete such data.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption of data in transit (TLS 1.2+) and at rest.
• API key hashing and secure storage.
• Access controls and principle of least privilege for staff and systems.
• Cloudflare WAF, DDoS protection, and bot management.
• Regular security monitoring and incident response procedures.

No system is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

Foodashi will notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach, in accordance with GDPR Article 33, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects. Affected individuals will be notified without undue delay where the breach is likely to result in a high risk (Article 34).

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the address associated with your account. The "Effective Date" at the top of this policy indicates the date of the most recent revision.

We will notify you of material changes at least 30 days in advance via email or in-app notification. Where consent is the legal basis for processing, we will seek your renewed affirmative consent for material changes. For processing based on contract or legitimate interest, your continued use after the effective date constitutes acceptance.

13. Contact

For any privacy-related questions, data subject requests, or complaints:

• Privacy enquiries: [email protected]
• General support: [email protected]
• Legal: [email protected]