Your information, handled with care.

This Privacy Policy explains how Food Allergy Chart ("Food Allergy Chart," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit our website, view a public allergy guide, contact us, or create or use a restaurant management account (collectively, the "Service").

Restaurant customers control the menu, allergen, location, branding, and other business content they submit and choose to publish. If you have a question about information published by a restaurant, contact that restaurant directly. This policy does not cover a restaurant's own privacy practices or websites.

Depending on how you use the Service, we may collect the following categories of information:

• Account information: name, email address, authentication records, account identifiers, password credentials in protected form, and, if you use Google sign-in, profile information made available by Google under your settings and authorization.
• Business and workspace information: restaurant or company names, locations, addresses, phone numbers, websites, team invitations, roles, permissions, and account administration records.
• Customer content: menu and catalog items, ingredients and allergen designations, availability, cross-contact notices, store notes, logos and appearance settings, menu-source URLs, imported CSV or PDF content, publication history, and audit records.
• Communications: the name, email, topic, message, and other information you provide through contact, support, integration-request, or similar forms.
• Usage and device information: product events, an automatically generated browser identifier, account, company, or store identifiers when available, event properties, dates and times, request paths, IP address and browser or device details that may appear in ordinary hosting, security, and error logs.

We collect information directly from you and other authorized users of your business account, automatically from your browser or device, from authentication providers you choose to use, and from restaurant menu or allergen sources that an authorized customer asks us to process.

CSV and PDF files uploaded for import are processed to create a preview. The Service does not intentionally retain the original uploaded file after that request; catalog rows an authorized user confirms for import are stored as customer content.

Public allergy guides let visitors select allergens to filter restaurant-published menu information. Selections made with the on-page controls ordinarily remain in the visitor's browser and are not saved to an account. If an allergen selection is included in a shared guide URL, it is sent to our server as part of the request and may appear in routine technical logs together with request information such as an IP address.

We use this information only to display the requested guide, maintain security, diagnose problems, and comply with law. We do not use allergy-filter choices to diagnose a condition, build advertising profiles, determine eligibility, or sell or share consumer health data for targeted advertising. Do not include a person's medical history or other unnecessary sensitive information in contact, support, notes, or import fields.

We use personal information to:

• provide, maintain, secure, and improve the Service;
• create accounts, authenticate users, and administer access and permissions;
• process customer content, imports, requested menu sources, and publication workflows;
• display public restaurant allergy guides and generate customer-requested files or sharing tools;
• send account, invitation, security, support, and service-related communications;
• measure feature use, troubleshoot errors, prevent fraud or misuse, and protect users and the Service;
• enforce our Terms of Service and comply with legal obligations; and
• establish, exercise, or defend legal claims and complete a business transaction involving the Service.

We may disclose personal information to the following recipients for the purposes described above:

• Service providers: providers of hosting, application delivery, database infrastructure, authentication, email delivery, storage, security, and technical support, including Netlify, Google when you choose Google sign-in, and Resend for configured service emails.
• Your organization: account owners and authorized administrators may access information about users, roles, activity, and customer content within their business workspace.
• The public: content a customer deliberately publishes to a public guide is available to anyone with access to that guide.
• Legal and safety recipients: government authorities, professional advisers, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or enforce an agreement.
• Transaction recipients: a successor or involved party in a merger, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to applicable law.

We do not sell personal information. We do not share personal information for cross-context behavioral or targeted advertising, and the Service does not use third-party advertising pixels or session-replay tools.

We use authentication cookies that are necessary to keep users signed in and protect accounts. We also use first-party local storage for an automatically generated analytics identifier and interface preferences, and session storage to avoid recording the same signup-started event more than once in a browser session. You can clear cookies and browser storage through your browser settings, but doing so may sign you out, reset preferences, or limit account features.

Published allergy charts record anonymous usage measurements so the restaurant can tell whether its QR code is being scanned and whether the chart is useful: how the chart was opened (QR code, shared link, or website embed), how long it stayed open, which allergen filters were selected, and normalized search terms. These measurements use a random identifier stored in session storage that is discarded when the browser tab closes. They are not tied to a name, account, IP address, or device fingerprint, are not used to build a profile, and are not linked across visits or across restaurants. Search text is normalized before it is stored, and entries that resemble contact details are discarded rather than recorded.

We retain personal information for as long as reasonably necessary to provide the Service, administer an active customer relationship, maintain security and business records, resolve disputes, and meet legal obligations. Retention depends on the type of information, why we collected it, the sensitivity of the information, and legal or operational requirements. Published customer content remains available until the customer changes or removes it or the account is closed. Backup copies and records required for security, fraud prevention, or legal compliance may remain for a limited period after deletion.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including authentication, role-based permissions, tenant and store access controls, and restricted administrative functions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Notify us promptly if you believe an account or information has been compromised.

Depending on where you live and subject to legal exceptions, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal information; to confirm whether we process it; to withdraw consent; and to appeal a decision on a privacy request. You may also have the right to opt out of certain sales, targeted advertising, profiling, or uses of sensitive information. We do not currently engage in those opt-out activities.

Submit a request through the contact form at foodallergychart.com/contact. Describe the request and provide the email address associated with your account, if any. We may need to verify your identity or authority before acting. Authorized agents may submit requests where permitted by law, but we may require proof of authorization and verification directly from the individual. We will not discriminate against you for exercising a privacy right. If we deny a request, you may appeal by replying to our response or submitting a new message labeled "Privacy Appeal."

You may withdraw from nonessential service communications by following any unsubscribe instructions provided. We may still send transactional, security, or account administration messages.

The Service is not directed to children under 13, and account features are not intended for them. We do not knowingly collect personal information online from children under 13. If you believe a child has provided us personal information, contact us so we can review and delete it as appropriate.

The Service is operated in the United States. If you access it from another country, your information may be processed in the United States or other countries where our providers operate. Those countries may have data protection laws different from those where you live. We will use protections required by applicable law for covered transfers.

We may update this policy to reflect changes to the Service, our practices, or applicable law. We will post the updated policy and revise the effective date. If a change materially affects how we use personal information, we will provide additional notice when required by law.

Send privacy questions, requests, and appeals through the contact form at foodallergychart.com/contact. Please do not include passwords, detailed medical records, or other unnecessary sensitive information. We respond by email.