Privacy Policy

Basic data protection information

Who is responsible for processing your data?

This policy covers Gulanity’s public website, management platform, mobile web and native app. Identity and access data are managed through account services; Gulanity retains food and social information linked to that identity.

For what purposes do we process your personal data?

SmashSoft S.L. collects your personal data for the following purposes:

• Service management: Enable access and authorised management of chains, restaurants, menus, dishes and beverages; handle ownership claims; browse the catalog, publish ratings, follow others and organise shared plans.
• Handling requests: Respond to enquiries, review abuse or ownership reports and maintain service security and operation.
• Pilot management: To manage pilot access requests and initial menu setup.
• Communications: To send service information, updates and, with your consent, commercial communications.

What data do we process?

Restaurant and professional data

• Account, identity and contact data of authorised individuals; information supplied to manage or claim an establishment
• Chain and restaurant data: name, address, location and catalog including menus, dishes, beverages, prices, images, ingredients, allergens, cuisines, amenities and tags
• Technical access data and management permissions, plus information needed to resolve an ownership claim

End user data

• Account and profile data, identifiers, slug and follower relationships with their counts
• Ratings and contributed content; shared plans, participants and associated decisions or votes
• Language and allergen preferences chosen by the individual, which may reveal health information; they filter and personalise the food experience and can be changed
• Location provided or authorised for nearby searches; technical device, session, usage and diagnostic data depending on the channel and optional settings

Contact/pilot form data

• Email and message submitted in contact, pilot or early access requests

Location and device permissions

Nearby features may use the location you provide or authorise on your device to search for restaurants and show nearby results. A restaurant’s address is part of its listing; it is not the individual user’s location.

Location access depends on system permission and the feature used. You can deny or revoke it in device settings and use manual searches where available. This document does not authorise background tracking or publication of your location in your profile.

What is the legal basis for processing your data?

• Providing the requested service and precontractual steps for accounts, catalog, ratings, following, plans and enquiries
• Meeting legal obligations and handling security or claims under the applicable basis
• Consent for optional uses such as analytics and location access; allergen preferences are voluntary and may reveal health information

Who will receive your data?

Catalog content and ratings are shown according to each feature’s visibility; plan participants can access shared plan information. Hosting, authentication, storage, support and, when enabled, analytics or diagnostics providers may process data to deliver the service. The app integrates PostHog for analytics and Firebase Crashlytics for diagnostics; consent controls are described in cookies. We do not sell personal data.

How long will we keep your data?

We retain data while needed for the account and requested features, and afterwards where an obligation or liability justifies retention. Account closure removes linked information; a shared plan may remain for surviving participants without retaining the deleted account’s participation.

What are your rights?

You may exercise the following rights:

• Access: Obtain confirmation and access to your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data when no longer necessary.
• Restriction: Request restriction of processing under certain circumstances.
• Portability: Receive your data in structured format to transfer to another controller.
• Objection: Object to data processing for particular reasons.
• Withdrawal of consent: Withdraw your consent at any time, without affecting the lawfulness of prior processing.

To exercise these rights, you can contact: info@neocody.com

If you believe the processing does not comply with current regulations, you can file a complaint with the Spanish Data Protection Agency (www.aepd.es).

Security measures

We implement technical and organizational measures (encryption, access controls, etc.) to protect your data against loss, alteration or unauthorized access, in accordance with Article 32 of the GDPR.

Policy updates

SmashSoft S.L. reserves the right to modify this policy to adapt to legal or service changes. Updates will be published on the Platform and, in case of significant changes, registered users will be notified by email.

Contact

If you have any questions about this Privacy Policy, you can contact us at: info@neocody.com