Privacy Policy

Who we are and what this covers

This Privacy Policy explains how Baland Tech, SL ("Foodium", "we") collects and uses personal data. It covers our two Apps — Foodium, for diners, and Foodium Ads Manager, for venues and their teams — and this website. Our identity and registry details are in the Legal notice above.

We are the data controller. For any privacy question or to exercise your rights, contact privacy@foodium.app. Because we offer services to people in the European Union from Andorra, an EU representative for data-protection purposes will be named here; until then, please use privacy@foodium.app.

We handle personal data under Andorran Llei 29/2021, qualificada de protecció de dades personals (supervised by the Andorran Data Protection Agency, APDA) and, where it applies, the EU General Data Protection Regulation (GDPR).

The data we collect

Account and identity. You sign in with Google or Apple — we don't hold passwords. We receive and store your email, name and profile photo from that provider, along with the provider's account identifiers and technical timestamps. If you sign in with Apple's Hide My Email, we work with the private relay address. We also derive a device identifier from your device's technical attributes (model, make, operating system) to help keep accounts secure.

Profile. Your username (public) and, if you choose to add them, your contact name and email, date of birth, gender, home city, address and avatar. Date of birth and gender are optional.

What you create and do. Reviews, ratings, notes and the photos you upload; the places you save, bookmark or mark as visited (including which contacts you visited with); your swipe history; your in-app contacts and the messages, places and reviews you share with them. We also build an interest profile from your activity (the areas, categories and dishes you engage with) to personalise discovery — this is profiling, and you can object to it (see Your rights).

Location. When you allow it, the App uses your device's location while you are using it, to show you places nearby. Our search provider uses your exact location to sort your results by distance, and if you set your home city on the map, the point you choose is saved in your profile; our analytics receive only an approximate area. The App may also estimate your approximate location from your internet (IP) address through an IP-geolocation service, including before you sign in or if you decline the location permission. We keep the location information stored with your account until you delete your account.

Business and billing data (Foodium Ads Manager). The venues you claim; the photos, texts and venue details you and your team publish; your team; your ads and the day-by-day record of their ad-days; your bills and invoices; the billing details you enter for invoicing (legal name, tax ID, address); and, of each card you save, only a reference that identifies it, the identifier our payment provider gives the card (not its number), its brand and, when we have them, its last four digits and expiry date — you enter each card on our payment provider's page, so its full number never reaches us. Aggregated statistics about how diners interact with your venues and ads are prepared for you (see How we share data).

Signing in on this website. The pages where a business signs in to manage the cards it pays for its ads with use the same account as Foodium Ads Manager. On those pages, your browser keeps your signed-in session, your language preference and, until you close the tab, a note of the payments you start; our Cookie Policy lists everything they keep.

If you contact us or show interest — for example a waiting-list sign-up, feedback or a support request, on the website or in the App — we keep what you send us (which may include your email and message); deleting your account does not delete it. Feedback and reports sent in the App are kept for 3 years from the day you sent them, then erased. If you ask us in the App to add a venue that isn't on Foodium yet, we keep that request with your email and delete it when you delete your account; an internal notice of it may remain in our operations tools.

How and why we use your data

To provide the service (the legal basis is performance of our contract with you): run your account, show and personalise discovery, enable reviews, saving, contacts and sharing, run venues' ads and bill for them, and provide customer support.

Paid photos. Foodium is free for diners. Photos that venues pay Foodium for are shown more often in the discovery feed (Swipe); those photos are advertising for the venue shown. Paid photos must meet the same conditions as every other photo: they come from your area and match your filters, if you set any. They are not marked one by one; our Terms (Paid photos) and the App explain how photos are picked.

To meet legal obligations: issue and keep invoices and tax records, and respond to lawful requests.

For our legitimate interests, balanced against your rights: keep the service secure and prevent abuse; understand product usage; and prepare aggregated, non-identifying statistics for venue owners about how people interact with their listing. We rely on legitimate interest for the interest-profile that personalises discovery — you can object to it at any time.

Direct marketing (Foodium Ads Manager). If you hold an ad account, we may occasionally email you about our own similar services. This is the so-called soft opt-in: we tell you about it when we collect your details, every such email carries a one-click unsubscribe link, and you can object at any time (see Your rights). Apart from the email you ask for when you join a waiting list, we never send marketing email to diners.

With your consent: our Apps' push notifications, which we don't send until you allow them, and the email you ask for when you join a waiting list on this website; you can turn notifications off at any time in your device's settings and unsubscribe from that email with a single click. Analytics on this website does not rest on your consent — we show no consent banner and store no consent cookie — but on the legitimate interest described above in understanding product usage: it is first-party measurement, with Google signals and all ad personalisation switched off, and it is never used for advertising. Your control is in the browser: if you block cookies and site data for this site, we stop counting your visits.

AI features (venue owners). When enabled, we use a third-party AI provider (Anthropic) to translate business-authored text and to generate written performance summaries from your venue's aggregated statistics and your own business photos. These features use business content only — never a diner's identity — and any AI-generated insight is advisory.

How we share data

We do not sell your personal data. We share it only with service providers who process it on our behalf, and only as needed to run Foodium. These include: our cloud, database, storage, authentication and messaging provider (Google Firebase, hosted in the EU); our payment provider (MONEI), on whose page businesses save the cards they pay for their ads with; our email provider (Resend), for account and billing emails, invoices and the waiting-list email; the AI provider named above (when those features are enabled); an IP-geolocation service; a search provider; and internal operational alerting. Every third party we share your data with, including the analytics and other tools built into our Apps, must give it the same or equal protection as this policy. A current list of the categories of providers is kept available and updated as it changes.

How venues see diner activity. When you interact with a venue on Foodium — including venues that haven't joined yet — that activity feeds statistics we prepare for businesses. These statistics are aggregated and cannot identify you; a venue never sees your identity or your individual actions.

We may disclose data where the law requires it, or to protect our rights, users or the service.

International transfers

Your data is stored primarily in the European Union. Some of our providers are based in, or transfer data to, the United States. Where they are, we rely on an appropriate safeguard for each provider — an adequacy decision, the EU-US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. Andorra, where we are based, holds an EU adequacy decision, which covers transfers of EU personal data to Andorra.

How long we keep your data

We keep your data while you use Foodium, and afterwards only as described here. Behavioural signals that carry a time limit are kept for a limited period and then removed. Each of the two Foodium Apps deletes only its own profile: deleting your account in the Foodium App deletes your diner profile, and deleting your business profile in Foodium Ads Manager deletes your business profile. Your sign-in (the email address, Apple account or Google account you sign in with) is deleted together with the last profile that uses it. The email address itself is erased 30 days later, or stays on the record of the closed account if the sign-in ever had a business profile (see “What we keep” on the page “Delete your account”). Backup copies, kept only to restore our systems after a failure, are deleted automatically within 14 days.

Your diner profile (Foodium App). When you delete your account in the Foodium App, we delete your profile and what is in it: your username, name and photo, Your Places, your reviews and their photos, your Swipes and the photos you saved, your chats and contacts, and your settings. Some things stay, mainly: the reports you sent about places, photos or problems with the App, which stay as you sent them so that we can still review them; a safety copy of your profile, erased after 30 days; the record of your closed account; a short record of what we sent you and of the venue pages you opened, erased after 30 days; what is part of other people's accounts (their contact for you, their chat with you and where they said they were with you); and some technical records and usage statistics. They are described under “What we keep” on the page “Delete your account”. We keep the reports for 3 years from the day you sent them, on the ground of our legitimate interest in reviewing reports and acting on them. If you live in the European Union, you can object to our keeping them on grounds relating to your particular situation (see Your rights). If a Foodium business profile also uses your sign-in, your account stays open for it, with your sign-in and the details that belong to it (your email address and, where your account holds them, your name, your phone number and the link to your Google or Apple photo). Otherwise your sign-in is deleted too.

How to delete your account

Business records (Foodium Ads Manager). We keep invoices, the day-by-day record of ad-days (kept under a code instead of a person's name) and the billing record for 6 years from the end of the year each one belongs to, as Andorran accounting law requires (Llei 30/2007, art. 7), also after the business profile is deleted. We keep them longer only while a claim or official procedure about them is open, we use them for nothing else, and then we delete them. When a team member deletes their account, the business's billing record keeps, under a code instead of their name, the ad-days of the ads they published, for the same period.

Your saved cards (Foodium Ads Manager). When you remove a card, we start no new charge on it and have our payment provider delete it. We keep no payment token of a removed card: until the provider confirms the deletion, we keep only a one-way code made from it, which cannot be turned back into the token, for 7 nights at most. We keep the identifier our payment provider gives the card for 30 days after you remove it, so that we recognise the card if you save it again and the limits on charging it still apply. The payment provider's reference of the payment that first saved a card (a reference, not card data) stays with your account's payment records for 6 years from the end of the year that payment belongs to, and is deleted with them (see “Business records” above).

Free days for businesses. Once the free days of a business profile have started, we keep a coded marker made from its sign-in email (not the email itself) for 6 years after the profile is deleted, so that the 10 free days are given only once per sign-in email. It records only that the free days were given. We keep it on the ground of our legitimate interest in giving the free days only once. If you live in the European Union, you can object to our keeping it on grounds relating to your particular situation (see Your rights).

Venues (Foodium Ads Manager). When you delete your business profile, every ad leaves the discovery feed at once and your team members lose access. The deletion is carried out once the final charge for the ad-days already used has been paid (Business Terms, clause 18); until then the business profile is not deleted. When it completes, your saved cards are removed, and your venues and their photos stay linked to you for the next 30 days: to get them back, sign in to Foodium Ads Manager again with the same email, Apple or Google account within those 30 days; your ads don't restart. After that, the venues are released, the contact details you published for them are cleared, and their photos are deleted within 90 days.

Team invitations. When you invite someone to your team, we store the email address you enter for that invitation. The invitation is valid for 14 days, and we delete it 30 days after it expires, whether or not it was used; it is also deleted if you delete your business profile. We don't send the invitation by email: you share the invitation link with them yourself.

Your rights

You can ask us to access, correct, or delete your personal data; to restrict or object to certain processing (including the interest-profile and any direct marketing); and to receive a copy of data you provided. To make a request, email privacy@foodium.app.

You can delete your profile in each App at any time (see How long we keep your data). You can also ask us to erase your data by writing to privacy@foodium.app: we erase all of it except the records described in that section, which we must or may keep, and we answer within one month. If you live in the European Union, you can also object to our keeping those records on grounds relating to your particular situation; we would then keep them only if we have compelling legitimate grounds or need them for a legal claim.

If you believe we've mishandled your data, you can complain to the Andorran Data Protection Agency (APDA) or, if you are in the EU/EEA, to your local data-protection authority.

How we protect your data

We host data in the European Union on Google Cloud infrastructure, encrypt it in transit, and rely on Google and Apple for sign-in so we never hold your password. Billing operations are handled server-side, and cards are entered on our payment provider's page: their full number never reaches us. No service can be perfectly secure, but we work to protect your data and to detect and respond to problems.

Children

Foodium is not intended for children. You must be at least 16 years old to use it. We do not knowingly collect personal data from children under this age; if you believe a child has provided us data, contact privacy@foodium.app and we will remove it.

Notifications and messages

With your permission, we send push notifications (for example, activity that involves you or, for venue owners, insights about your venue). You can turn notifications off at any time in your device's settings. By email, we send service messages about your account and, to businesses, about their free days, ads, bills, invoices and payments — these are part of running the service, not marketing. The only marketing emails we send are the email you ask for when you join a waiting list and the occasional email to businesses described above, always with a one-click unsubscribe.

Changes and contact

We may update this policy; we'll change the date above and, for significant changes, tell you in the app or on the site. Questions or requests: privacy@foodium.app.