Our policies, plain and clear.

On the website of Safe Allergies B.V., we use cookies and similar technologies, such as scripts, tags, pixels, and local storage. In this cookie statement, we explain which technologies we use, why we do so, and how you can manage your preferences.

Where this cookie statement refers to "cookies", this also means similar technologies, unless the context indicates otherwise.

1. Who is responsible?

The controller responsible for the use of cookies and similar technologies on this website is:

2. What are cookies and similar technologies?

Cookies are small text files that are stored on or read from your device when you visit a website. Similar technologies, such as scripts, tags, pixels, and local storage, may also store or read information on your device or collect information about your use of the website.

Some of these technologies are strictly necessary for the proper functioning and security of the website. We use other technologies to gain insight into the use of the website, to measure advertising campaigns, or to improve our marketing. Functional cookies do not require consent; tracking cookies generally do require consent.

3. Which categories of cookies and similar technologies do we use?

We use the following categories of cookies and similar technologies:

a. Strictly necessary / functional cookies

These cookies and technologies are necessary for the website to function properly and securely. This includes, for example:

• remembering your cookie preferences;
• technically loading pages correctly;
• security and fraud prevention;
• properly handling form functionality.

We do not ask for consent for strictly necessary cookies and technologies.

b. Analytical cookies

These cookies and technologies help us understand how visitors use our website, so that we can improve the website and user experience.

We ask for prior consent for analytical cookies, unless these analytical cookies are configured in such a way that they have no or only limited consequences for your privacy under the applicable laws and regulations.

c. Marketing and tracking cookies

We use these cookies and similar technologies to:

• measure the effect of advertisements;
• register conversions and sign-ups;
• track website visitors for marketing purposes;
• enable remarketing and ad optimization.

We always ask for your prior consent for marketing and tracking cookies and similar technologies.

4. Which services do we use on this website?

At this time, we use the following services on this website:

Cookiebot

We use Cookiebot for:

• displaying the cookie banner;
• recording and managing your cookie preferences;
• blocking non-essential cookies and scripts until consent has been given;
• generating an up-to-date cookie overview.

Mijndomein

We use Mijndomein for hosting and the technical availability of the website. Insofar as strictly necessary cookies or similar technologies are used for this purpose, they are solely intended for the secure and proper operation of the website.

Google Tag Manager

We use Google Tag Manager to manage scripts and tags on our website. We configure Google Tag Manager in such a way that non-essential tags are only loaded or activated after valid consent has been obtained, insofar as such consent is legally required.

Google Analytics 4

We use Google Analytics 4 to gain aggregated insight into the use of our website and the performance of our pages.

Insofar as Google Analytics 4 on our website is not configured in such a way that it may be used without consent, this service will only be activated after you have given your consent.

Google Ads / Google tag

We use Google Ads and associated Google tags for conversion measurement, remarketing, and ad optimization. These technologies are only activated after you have given your consent.

Meta Pixel

We use Meta Pixel for ad measurement, remarketing, and conversion tracking via Meta platforms. The Meta Pixel is only activated after you have given your consent.

TikTok Pixel

At this time, the TikTok Pixel is not active on our website.

As soon as we actually start using the TikTok Pixel for ad measurement, remarketing, or conversion tracking, we will amend this cookie statement and the cookie overview accordingly. The TikTok Pixel will only be activated after you have given your consent.

5. For which purposes do we use cookies and similar technologies?

We use cookies and similar technologies for the following purposes:

• to ensure the website functions properly and securely;
• to remember your cookie preferences;
• to analyse how visitors use our website;
• to measure whether advertisements lead to website visits or sign-ups;
• to measure and optimize campaigns via Google and Meta;
• to improve the performance of our landing pages and forms.

6. On which legal basis do we use these cookies?

We use strictly necessary cookies because they are needed for the website to function properly and securely.

For analytical cookies, marketing cookies, and tracking technologies, we rely on your consent, insofar as such consent is legally required.

Where we use analytical cookies without consent, we do so only if and insofar as these cookies are configured in such a way that they have no or only limited consequences for your privacy.

7. Consent and withdrawal of consent

Non-essential cookies and similar technologies are only placed, read, or activated after you have given your consent.

You can change or withdraw your consent at any time via the cookie settings on our website. The possibility to withdraw consent must be just as easy for you as giving consent.

The withdrawal of your consent does not have retroactive effect and does not affect the lawfulness of prior processing based on consent.

Refusing or withdrawing consent does not affect the use of the basic functionalities of our website, but it may mean that certain parts or measurements do not work or work less effectively.

8. Cookie overview

We maintain an up-to-date overview of the cookies and similar technologies used on our website. This overview is generated via Cookiebot based on scans of our website.

For each cookie or technology, this cookie overview includes at least, where applicable:

• the name;
• the provider;
• the purpose;
• the category;
• the retention period;
• the type, such as first-party or third-party.

The most up-to-date cookie overview forms an integral part of this cookie statement.

9. Third parties

Through our website, third parties such as Google and Meta may place cookies or similar technologies or receive data when you have given your consent and insofar as this is permitted within our configuration.

Their own privacy and cookie statements may apply to the processing of personal data by these parties. This does not alter the fact that Safe Allergies B.V. itself remains responsible for informing users in a transparent and lawful manner about the use of these technologies on the website. The GDPR requires information, among other things, about recipients, retention periods, and any transfer to third countries.

10. Transfers outside the EEA

When using services of parties such as Google and Meta, personal data may be transferred to countries outside the European Economic Area, including the United States.

Where personal data is transferred to a party in the United States that is certified under the EU-US Data Privacy Framework, we base that transfer on the applicable adequacy decision of the European Commission.

Where a recipient is not covered by an adequacy decision, we provide other appropriate safeguards, such as standard contractual clauses approved by the European Commission, supplemented with any additional measures where necessary.

More information about the relevant transfer mechanisms can be obtained upon request via support@safeallergies.com.

11. How long do we retain data collected via cookies?

The retention period differs per cookie or technology. The specific retention period is stated, where applicable, in the current cookie overview available via Cookiebot on our website.

We do not retain personal data obtained through cookies or similar technologies for longer than necessary for the purpose for which it was collected, unless a longer retention period is legally required or permitted. The GDPR requires that data subjects be informed about the retention period or, if that is not possible, the criteria used to determine that period.

12. Deleting or disabling cookies

You can also delete or block cookies yourself via your browser settings. Please note that the website may then not function optimally.

Adjusting browser settings is not always the same as withdrawing consent via our cookie banner. We therefore recommend that you manage your preferences via the cookie settings on our website.

13. Changes to this cookie statement

We may amend this cookie statement from time to time, for example when:

• our website changes;
• we start using different cookies, scripts, or pixels;
• laws or regulations change;
• supervisory authorities or case law give reason for amendment.

The most current version of this cookie statement is always available on this page.

14. Questions

Do you have any questions about this cookie statement or about the use of cookies on our website? Please contact us via support@safeallergies.com.

Purpose of this document. This Privacy Policy applies to both the Safe Allergies website (including the waitlist form) and the Safe Allergies iOS application. The URL to this page is the Privacy Policy link submitted to the Apple App Store.

Source of truth. The text below is the canonical version. The in-app Privacy Policy (accessible via Profile → Privacy Policy) is a localised mirror of the app-specific sections of this document.

Safe Allergies B.V. respects your privacy and processes personal data in accordance with applicable data protection laws, including the General Data Protection Regulation ("GDPR" / Dutch "AVG").

This Privacy Policy sets out which personal data we process through (a) our website and waitlist form and (b) our Safe Allergies mobile application, the purposes of such processing, the legal bases relied on, the categories of recipients, the applicable retention periods, and the rights available to you under applicable law.

1. Who is responsible?

The controller responsible for the processing of personal data described in this Policy is:

We have not appointed a Data Protection Officer; for all privacy matters, including the exercise of your rights, please use the email address above.

2. Scope of this Policy

This Policy covers two processing contexts:

(A) Website and waitlist — the Safe Allergies marketing website and the early-access waitlist form available on that website.

(B) Safe Allergies iOS application — the consumer mobile app distributed via the Apple App Store, including authentication, account management, allergen profiles, restaurant and dish contributions, reviews, photos, validation votes, edit proposals, reports, blocks, favourites and approximate location.

Where a section applies to only one of these contexts, that is indicated. Otherwise the section applies to both.

3. Personal data we process

3.1 Website and waitlist (Context A)

• Contact data, including your email address.
• Waitlist registration data, including the fact that you registered for early access.
• Preference data, including marketing preferences, cookie settings and consent choices.
• Technical and usage data, including IP address, browser type, device information, pages visited, clicks and interactions.
• Analytics, advertising and remarketing data, insofar as you have provided consent where such consent is required.

We do not request or intentionally collect food-allergy information, medical information or other special categories of personal data through the website waitlist form.

3.2 Safe Allergies iOS application (Context B)

• Account data: name, email address and an optional profile photo.
• Allergen profile and severity preferences — treated as a special category of personal data under GDPR Article 9 (see section 5).
• Community contributions: restaurants, dishes, reviews and proposed edits to dishes that you create, including photos.
• Validation votes you cast on dishes (accurate / outdated) and the immutable history of allergen changes for audit purposes.
• Content reports and user blocks you submit, plus the moderation log of admin actions taken on reports.
• Apple Sign In authentication tokens (stored server-side only, used to revoke access when you delete your account).
• Approximate location, only while you actively use the app and only with your permission.
• Anonymous usage analytics (which screens you visit and which actions you take). We do not log allergen or health data, review text, your name or your email address to our analytics processor.

4. Sources of personal data

We collect personal data:

• directly from you, including when you submit your email address through the website waitlist form or create an account in the app;
• automatically through your use of the website and the app;
• through cookies and similar technologies on the website, where permitted and, where required, subject to your prior consent.

5. Purposes of processing

5.1 Website and waitlist

• Waitlist administration — to register and administer your waitlist entry.
• Early-access and launch communications — to contact you in connection with your registration, including when Safe Allergies becomes available or relevant service-related updates are issued.
• Marketing communications — where you have expressly opted in by selecting the checkbox stating "I want to receive updates about Safe Allergies", to send you updates, newsletters and other marketing messages concerning Safe Allergies.
• Interviews and user research — where you have opted in to receive updates, to contact you for interviews, feedback and user research relating to the development of the service.
• Website analytics and performance improvement — to analyse the use and performance of the website and to improve our landing pages and forms.
• Advertising measurement, conversion tracking and remarketing — where the required cookie consent has been obtained, to measure campaign effectiveness, track conversions, build remarketing audiences and optimise advertising activities.
• Security and technical administration — to maintain the security, integrity and availability of the website, prevent misuse and detect and resolve technical issues.

5.2 Safe Allergies iOS application

• Account creation and authentication — to create your account, sign you in (including via Sign in with Apple) and secure access.
• Allergen matching — to match restaurants and dishes against your allergen profile so the app can display relevant safety status.
• Community contributions and moderation — to enable you to create, edit and review restaurants and dishes, vote on validations, report content and block users, and to enable our moderators to act on those reports.
• Allergen audit trail — to maintain an immutable history of allergen-information changes for safety, accountability and compliance purposes.
• Aggregate product analytics — to measure aggregate usage of the app in order to improve product features. Allergen, health, review, name and email data are excluded from analytics by design.
• Service-related communications — to send transactional notices relating to account, security or material policy changes.
• Compliance with legal obligations, including responding to subject-access requests and to lawful requests from competent authorities.

We do not use your data for advertising, do not sell it, and do not track you across other apps or websites.

6. Legal bases (GDPR Art. 6 and Art. 9)

6.1 Website and waitlist

• Consent (Art. 6(1)(a)) — for marketing communications, for non-essential cookies and similar technologies (including analytics, advertising and remarketing technologies), and for updates about Safe Allergies where you have actively opted in.
• Legitimate interests (Art. 6(1)(f)) — for maintaining and securing the website, improving its technical performance and usability, administering waitlist registrations, maintaining records of consent choices and preferences, preventing fraud and abuse, and handling privacy-related requests and complaints.
• Legal obligation (Art. 6(1)(c)) — where necessary to comply with a legal obligation to which we are subject.

6.2 Safe Allergies iOS application

• Performance of a contract (Art. 6(1)(b)) — for account data, authentication, your community contributions, dish validations and matching functionality, all of which are necessary to provide the service you signed up for.
• Consent (Art. 6(1)(a)) — for processing of community contributions where they include personal narrative content and for ancillary processing requiring consent.
• Explicit consent for special-category data (Art. 9(2)(a)) — for the processing of your allergen profile and severity preferences, which qualify as health-related data. You provide this consent during onboarding when you set up your allergen profile.
• Legitimate interests (Art. 6(1)(f)) — for the moderation log, content reports, abuse-prevention measures and aggregate analytics. We assess whether these interests are overridden by your interests or fundamental rights and freedoms.
• Legal obligation (Art. 6(1)(c)) — where necessary to comply with applicable law.

6.3 No automated decision-making

We do not use automated decision-making or profiling within the meaning of GDPR Article 22 to make decisions about you that produce legal or similarly significant effects. The allergen matching displayed in the app is a deterministic lookup against the allergens you have entered; it is not a profile or risk score and does not produce legal effects.

7. Services and providers

7.1 Website and waitlist providers

• Webflow — website builder and form environment.
• Mijndomein — hosting and technical availability.
• Email environment — manual review and processing of waitlist submissions.
• Google Sheets — manual administration of the waitlist.
• Mailchimp — email communications tool (data is not auto-synced; uploads occur manually).
• Cookiebot — consent management and cookie overview.
• Google Tag Manager — tag management for the website.
• Google Analytics 4 — website analytics (subject to cookie consent where required).
• Google Ads / Google tag — advertising measurement, conversion tracking and remarketing (subject to cookie consent where required).
• Meta Pixel — advertising measurement and remarketing (subject to cookie consent where required).
• TikTok Pixel — advertising measurement and remarketing (subject to cookie consent where required).

7.2 Safe Allergies iOS application sub-processors

• Supabase Inc. — managed PostgreSQL database, authentication and storage. Production region is the European Union. We have a Data Processing Agreement in place with Supabase.
• Apple Inc. — Sign in with Apple identity verification and Apple Push Notification Service (used for transactional notifications such as moderation responses; not used for marketing).
• PostHog Inc. — first-party product analytics, hosted in the European Union. PostHog acts as a processor under a Data Processing Agreement. Allergen, health, review, name and email data are excluded from analytics by design.
• Google LLC (Google Maps Platform) — restaurant metadata lookup via the Places API. We send a search string (e.g. a restaurant name) and receive metadata in response. No personal-identifier data is sent to Google in this lookup.

We do not sell personal data to any third party. Where required, we enter into appropriate contractual arrangements with service providers processing personal data on our behalf.

8. Disclosure of personal data

We may disclose personal data to:

• the providers listed in section 7, in their capacity as processors acting on our behalf;
• competent authorities, regulators, courts, professional advisers, or other third parties where disclosure is required or permitted by law.

Internal access to personal data within Safe Allergies is currently limited to the founder. Third-party providers may process personal data only in the course of providing their services to us.

9. International transfers

Personal data may be transferred to countries outside the European Economic Area, including the United States, in connection with the use of services provided by parties such as Google, Meta, TikTok, Mailchimp, Apple and other technology providers.

• Where personal data is transferred to a recipient in the United States that is certified under the EU-US Data Privacy Framework, we rely on the relevant adequacy decision of the European Commission.
• Where a recipient is not covered by an adequacy decision, we implement other appropriate safeguards where required, including Standard Contractual Clauses approved by the European Commission, supplemented where necessary by additional technical and organisational measures.
• Apple Sign In verification may involve transient transmission to Apple Inc. (USA). Google Places lookups may transit Google LLC (USA).
• Supabase production data is stored within the European Union.

Further information regarding the applicable transfer mechanisms may be obtained by contacting support@safeallergies.com.

10. Retention

We do not retain personal data for longer than necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

10.1 Website and waitlist retention

• Waitlist data: no longer than 12 months after collection, unless a longer period is required in connection with a legal obligation or the establishment, exercise or defence of legal claims.
• Launch-related and waitlist communications: no longer than 12 months after the last relevant interaction.
• Marketing data: retained until consent is withdrawn or you unsubscribe.
• Suppression data: retained in limited form following an unsubscribe request in order to ensure that the opt-out request is respected.
• Technical, analytics, advertising and cookie-related data: retained in accordance with the settings and durations of the relevant tools and services.
• Consent records and preference data: retained as long as necessary to demonstrate compliance and to manage preferences.

10.2 Safe Allergies app retention

• Account and personal data: retained until you delete your account, after which it is removed within 30 days.
• Community contributions (restaurants, dishes, reviews): retained in the community database with your name replaced by an anonymous label upon account deletion. This protects the integrity of community-built data for other users who rely on it.
• Moderation log entries: retained for 24 months for audit and legal-compliance reasons.
• Analytics events: aggregated and deleted within 12 months.

Where no fixed retention period can be specified in advance, the applicable period is determined by reference to the nature of the data, the purpose of processing, the sensitivity of the data, applicable legal requirements and the necessity of retention for compliance or evidentiary purposes.

11. Children

Safe Allergies is intended for users aged 13 and older. We do not knowingly process personal data of children under 13.

In the Netherlands and other EU jurisdictions where the digital-consent age is 16, users between 13 and 16 must have verifiable parental consent before creating an account, in line with GDPR Article 8. The website (which is directed at adults and parents) is not intended to actively collect personal data from children under 16.

If we discover that personal data has been collected from a child without the required parental consent, we will delete that data without delay. Parents who believe their child has used the service without their consent can contact support@safeallergies.com.

12. Your rights

Subject to the conditions and limitations of applicable law, you have the following rights in relation to your personal data:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to data portability;
• right to object to certain processing;
• right to withdraw consent at any time where processing is based on consent;
• right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisor.

12.1 How to exercise your rights

• In the app: most rights can be exercised directly: update your profile via Profile → Edit; delete your account via Profile → Delete account; export your data via Profile → Request data export.
• By email: requests may also be submitted to support@safeallergies.com. We respond within 30 days, as required by GDPR.

In order to protect the privacy of others and to prevent misuse, we may request additional information necessary to verify your identity before responding to a rights request.

13. Account deletion (Safe Allergies app)

When you delete your account in the app:

• your Apple Sign In grant is revoked server-side;
• your avatar, profile, dish-validation votes, edit proposals, favourites, blocks and reports are deleted;
• restaurants, dishes and reviews you contributed are retained in the community database with the author shown as "anonymous";
• the moderation log retains your past admin actions (if any) for compliance purposes.

Deletion completes within 30 days.

14. Marketing communications

If you receive marketing communications from us, you may unsubscribe at any time using the unsubscribe mechanism included in the relevant communication or by contacting us at support@safeallergies.com.

Where you withdraw consent to receive marketing communications, we will cease such processing on a going-forward basis.

15. Cookies (website only)

The website uses cookies and similar technologies. Further information regarding the cookies used on the website, the purposes for which they are used and the manner in which preferences may be managed is set out in our Cookie Statement.

Where consent is required for particular cookies or similar technologies, such technologies will only be placed or activated after the relevant consent has been obtained.

The Safe Allergies iOS application does not use web cookies.

16. Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

For the app, these measures include:

• HTTPS / TLS for all traffic in transit;
• encryption at rest for the production database;
• row-level security policies ensuring private data is only accessible to its owner and authorised admins;
• Apple Sign In refresh tokens stored server-side only and never exposed to the app client.

Notwithstanding the measures implemented, no website, platform or transmission system can be guaranteed to be completely secure. Accordingly, we do not warrant or guarantee absolute security.

17. Amendments

We may amend this Privacy Policy from time to time, including where:

• the website or the app changes;
• services, technologies, tools or providers change;
• applicable laws or regulations change;
• guidance from supervisory authorities or relevant case law requires amendment.

The most current version of this Privacy Policy will always be made available on this page. For material changes affecting users of the app, we will additionally notify you in-app before the change takes effect.

18. Contact

Questions, requests or complaints relating to this Privacy Policy or the processing of personal data may be submitted to support@safeallergies.com.