Privacy Policy

I. General Information

In the following, we inform you about the processing of personal data when using Bite Club.

The responsible party for data processing is:

Delight Digital Ltd

71-75 Shelton Street

Covent Garden

London WC2H 9JQ

United Kingdom

Email: datenschutz@bite-club.app

Protecting your privacy is very important to us. Therefore, please read this privacy policy carefully.

II. Scope of Data Processing, Processing Purposes, and Legal Basis

The scope of data processing, processing purposes, and legal basis are detailed further below.

Art. 4 No. 1 GDPR: Personal data refers to any information relating to an identified or identifiable natural person (e.g., their name or IP address).

Art. 4 No. 2 GDPR: "Processing" means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

The following legal bases generally apply for data processing:

Art. 6(1)(a) GDPR serves as our legal basis for processing operations for which we obtain consent.
Art. 6(1)(b) GDPR is the legal basis insofar as the processing of personal data is necessary for the performance of a contract, such as when a customer subscribes to our canteen management service or we perform a service for them. This legal basis also applies to processing necessary for pre-contractual measures, such as inquiries about our services.
Art. 6(1)(c) GDPR applies when we need to fulfill a legal obligation, such as in tax law.
Art. 6(1)(f) GDPR serves as a legal basis when we have a legitimate interest in processing personal data, such as for cookies necessary for the technical operation of our website and software.

III. Data Transfer Outside the EU

Where we transfer data to service providers or other third parties outside the EEA, adequacy decisions by the EU Commission under Art. 45(3) GDPR ensure data security, where available, such as for the UK, Canada, and Israel.

Delight Digital Ltd is established in the United Kingdom. The EU Commission renewed its adequacy decision for the UK in December 2025; it applies until December 27, 2031.

2. Data Transfer to the USA

On July 10, 2023, the Data Privacy Framework https://www.dataprivacyframework.gov/s/?hl=de came into effect. Under the EU Commission's adequacy decision for this framework, US companies certified under it offer an adequate level of data protection; the decision does not cover other US companies. The following providers we use are certified by the US Department of Commerce for the Data Privacy Framework: Vercel Inc., Amazon Web Services, Inc., Cloudflare, Inc., PostHog Inc., Plus Five Five, Inc. (Resend), and Google LLC.

If there is no adequacy decision under Art. 45(3) GDPR, a controller or processor may transfer personal data to a third country or an international organization only if the controller or processor has provided appropriate safeguards and provided that enforceable rights and effective legal remedies for data subjects are available.

Singapore, where Supabase Pte. Ltd. is established, has no adequacy decision. Transfers to Supabase are based on the EU standard contractual clauses in its data processing agreement (Art. 46(2)(c) GDPR).

IV. Storage Duration

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent for data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g., retention periods under commercial or tax law); in the latter case, deletion will occur after these reasons no longer apply.

V. Data Subject Rights

As a data subject, you have the following rights:

Pursuant to Art. 15 GDPR, the right to request information about your personal data processed by us to the extent specified therein.

Pursuant to Art. 16 GDPR, the right to request the correction of incorrect or incomplete personal data stored by us without undue delay.

Pursuant to Art. 17 GDPR, the right to request the deletion of your personal data stored by us, unless further processing is necessary:

To exercise the right of freedom of expression and information;
To fulfill a legal obligation;
For reasons of public interest; or
To establish, exercise, or defend legal claims.

Pursuant to Art. 18 GDPR, the right to request the restriction of the processing of your personal data where:

You contest the accuracy of the data;
The processing is unlawful, but you oppose the deletion of the data;
We no longer need the data, but you require it to establish, exercise, or defend legal claims; or
You have objected to processing pursuant to Art. 21 GDPR.

Pursuant to Art. 20 GDPR, the right to receive your personal data in a structured, commonly used, and machine-readable format or to request the transfer to another controller.

Pursuant to Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. You can usually contact the supervisory authority of your habitual residence for this purpose. Contact details of the data protection supervisory authorities in the EU are available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

Pursuant to Art. 21 GDPR, the right to object in specific situations and against direct marketing. When data processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data at any time for reasons arising from your particular situation. The respective legal basis for processing can be found in this privacy policy. If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims (objection under Art. 21(1) GDPR).

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing.

For questions about data collection and data processing, please contact us directly at datenschutz@bite-club.app.

VI. Data Processing on the Website

1. Web Hosting and Provision of the Website and Software Application

This website and our software application are hosted externally. The personal data collected on this website and in the software are stored on the servers of the service providers listed below. This includes:

IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and employee meal orders.

The use of the host is for fulfilling contracts with our customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure and fast provision of our online presence and software by the professional provider (Art. 6 para. 1 lit. f GDPR). The host will only process your data to the extent necessary to fulfill its service obligations.

The following hosts are used:

a. Vercel

Our website uses the data hosting service "Vercel" provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, privacy@vercel.com. More information on the handling of user data by "Vercel" can be found in the privacy policy at Vercel Privacy Policy.

b. Supabase

Our website and software application uses the data hosting service "Supabase" provided by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513. More information on the handling of user data by "Supabase" can be found in the privacy policy at Supabase Privacy Policy.

c. Amazon Web Services (AWS)

Our website and software application uses the data hosting service "AWS" (Amazon Web Services) provided by Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109-5210, USA, aws-security@amazon.com. More information on the handling of user data by "AWS" can be found in the privacy policy at AWS Privacy Policy.

Note: AWS Amplify is used exclusively for our internal staging environment and does not process production user data.

d. Cloudflare

The domain bite-club.app uses the DNS service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When your browser looks up our address, Cloudflare processes your IP address. More information on the handling of user data by "Cloudflare" can be found in the privacy policy at Cloudflare Privacy Policy.

2. Informational Use of the Website

When using the website for informational purposes, i.e., if visitors do not provide us with information, we collect the personal data that the browser transmits to our server to ensure the stability and security of our website. This constitutes our legitimate interest, so the legal basis is Art. 6 para. 1 lit. f GDPR.

Server Log Data

The provider of these pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:

Browser type and version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address
Access status/HTTP status code

This data is not combined with other data types. The collection of this data is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in the technically error-free presentation and optimization of our website - for this, the server log files must be recorded.

3. Cookies on Our Website

What are Cookies?

Cookies are small text files stored on your device when you visit our website. They enable us to store your activities and preferences (such as login data, language, font size, and other display settings) over a certain period, so you do not have to re-enter them each time you visit the website.

Types of Cookies We Use

We use the following types of cookies and similar technologies (such as your browser's local storage) on our website and in our software:

Necessary Cookies: These cookies are essential to enable you to navigate the website and use its basic functions, including session management and authentication. They also store your choice in the cookie banner. Without these cookies, certain services cannot be provided. The legal basis for necessary cookies is our legitimate interest (Art. 6 para. 1 lit. f GDPR).
Functional Cookies: These cookies allow our website to remember choices you make (e.g., your language) and provide enhanced, more personalized features.
Analytical Cookies: PostHog (see section VII.2.b) stores an identifier in a cookie and in your browser's local storage to recognize your browser across page views and visits. On the public pages of our website, this happens only after you have accepted cookies in the cookie banner. On the login pages and in our software, it happens for every user, independent of the cookie banner.

On your first visit, a cookie banner asks whether you accept analytical cookies on the public pages of our website. Your choice ("Accept" or "Decline") is stored in a cookie on your device for one year; closing the banner counts as declining. Storing your choice is technically necessary, so the legal basis is our legitimate interest (Art. 6 para. 1 lit. f GDPR). The banner is not shown in the app installed on your home screen; there, PostHog is loaded on the public pages only if you accepted cookies in your browser before.

You can withdraw your consent at any time with effect for the future by deleting the cookies and site data stored for bite-club.app in your browser settings. The cookie banner then appears again on your next visit, and PostHog is not loaded on the public pages unless you accept again. You can also withdraw your consent by contacting us at datenschutz@bite-club.app.

4. Contact

Inquiries by Email or Phone

If you contact us by email or phone, your request, including the personal data resulting from it (name, request, email address, phone number), will be stored and processed by us for the purpose of handling your request. Apart from the service providers named in this policy, we do not pass on this data without your consent.

The processing of this data is based on Art. 6 para. 1 lit. b GDPR, provided your request is related to the fulfillment of a contract or necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of requests addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), if this has been requested.

We delete the data collected in this context once the storage is no longer necessary or restrict processing if there are statutory retention obligations.

Emails to our addresses at bite-club.app are received by the Email Routing service of Cloudflare (see section VI.1.d) and forwarded to our team's Gmail inboxes, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. More information on the handling of user data by "Gmail" can be found in the privacy policy at Google Privacy Policy.

5. Website Analytics

We use Vercel Web Analytics, a service of Vercel Inc. (see section VI.1.a), to count visits to the pages of our website and software. It sets no cookies. It records the page visited, the referring page, the country, and the browser, operating system, and device type. To tell visits apart, it uses a hash of the request that is discarded after 24 hours. The legal basis is our legitimate interest in knowing which pages are used (Art. 6 para. 1 lit. f GDPR).

You can sign up for our newsletter with your email address on our website. We use the double opt-in procedure: after you sign up, we send you an email with a confirmation link, and your subscription is only confirmed once you click it. After the confirmation, we send you a welcome email. We store your email address, the language and the place on the website where you signed up, the time of signing up and of the confirmation, and the codes in the confirmation and unsubscribe links. The emails are sent through Resend (see section VII.2.c).

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). You can withdraw it at any time with effect for the future, using the unsubscribe link in our emails or by contacting us at datenschutz@bite-club.app. When you unsubscribe, we record the time of unsubscribing and send no further newsletter emails to the address.

7. Food Waste Scorecard

On our scorecard page, you can answer questions about your canteen and receive an evaluation. When you submit the form, we store your email address, your answers, the calculated scores, the savings estimate, a classification of how interested you are in a solution and, where available, the campaign parameters of the link you followed and the referring page in our database (Supabase, see section VI.1.b). The form also asks for your name and an optional phone number; these are not stored.

Our server also sends your email address, the internal ID of your submission, the scores, the savings estimate, the interest classification, and your answers on the number of locations, your primary goal, your main obstacle and your interest in a solution to PostHog (see section VII.2.b), where they are stored in a profile under your email address. This happens independent of your choice in the cookie banner. In addition, our server sends your email address and the complete evaluation (scores, rating, strengths, weaknesses, recommendations and savings estimate) to our workflow automation service (n8n), which processes the result.

The legal basis is the evaluation you request (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in following up on interest in our service (Art. 6 para. 1 lit. f GDPR). You can object to this processing at any time by contacting us at datenschutz@bite-club.app.

1. Employee Data Processing

Our Bite Club software processes personal data of employees who use the platform to order meals. This includes:

Name, email address and employee number
Company, canteen and role
Preferred language
Card IDs used to identify you at meal distribution (QR code or NFC)
Meal orders
Pickups, with the time a meal was handed out, including meals served without an order
Meal ratings
Weekly attendance pattern
Dietary restrictions
Push notification subscriptions (see section VII.2.e)

The legal basis for this processing is Art. 6 para. 1 lit. b GDPR (contract fulfillment with the customer organization) and Art. 6 para. 1 lit. f GDPR (legitimate interest in providing the canteen management service).

As the customer organization, you are responsible for informing your employees about the data processing and obtaining any necessary consents in accordance with applicable data protection laws.

2. Third-Party Providers

a. Session Cookies from Supabase (Technically Necessary)

Our Bite Club software uses session cookies from "Supabase," provided by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513.

The legal basis for this is our legitimate interest under Art. 6 para. 1 lit. f GDPR, as we otherwise cannot ensure a smooth login process into the software.

For more information on how user data is handled, please refer to Supabase's privacy policy: Supabase Privacy Policy.

b. PostHog Analytics

We use PostHog to understand how our website and software are used and to find and fix errors. It is a product of PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. We use PostHog's EU Cloud, so the data is stored in Frankfurt, Germany.

Public pages of the website: On all pages outside the login area (for example the home page, blog, documentation and these legal pages), PostHog is only loaded after you have accepted cookies in the cookie banner (see section VI.3). If you decline, no data from these pages is sent to PostHog, with two exceptions: the scorecard (see section VI.7), and technical events our servers send, namely error reports for errors on our servers (page address, browser and error) and an event when a signed-in session ends without you signing out. Visits to these pages are not recorded as session recordings. The legal basis is your consent (Art. 6 para. 1 lit. a GDPR).

Login pages and software: On the login pages and in our software, including the login page on an organization's own subdomain, PostHog runs for every user, independent of the choice in the cookie banner. After you sign in, the data is linked to your user account. The legal basis is our legitimate interest in providing a working service and continuously improving it (Art. 6 para. 1 lit. f GDPR).

The following data is collected:

Usage data: pages viewed, clicks on page elements and actions in the software (for example signing in, saving meal selections, publishing a menu or turning on push notifications), each with the time, the page address and the referring page
Error reports: the error message and stack trace of errors in your browser and on our servers
Account data (after signing in): user ID, email address, first and last name, language, role, and the IDs of your organization and company
Device and network data: browser and version, operating system, device type, screen size, and IP address, from which an approximate location is derived
Survey answers: your answers to short surveys shown in the software, for example a rating of the app
Session recordings (login pages and software only): recordings of the pages as they are displayed to you, with mouse movements, clicks and scrolling, to understand how errors occur; text you type into input fields is masked

Your Rights: You can withdraw your consent for the public pages as described in section VI.3. You have the right to object to the processing on the login pages and in the software at any time for reasons arising from your particular situation by contacting us at datenschutz@bite-club.app.

For more information on how user data is handled, please refer to PostHog's privacy policy: PostHog Privacy Policy.

c. Sending Emails (Resend)

We send emails, such as confirmations, reminders and the newsletter emails described in section VI.6, through Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes the recipient's email address, their name where we have it, and the content of the email. The legal basis is the performance of the contract with the customer organization (Art. 6 para. 1 lit. b GDPR) and, for the newsletter emails, your consent (Art. 6 para. 1 lit. a GDPR). More information can be found in the privacy policy at Resend Privacy Policy.

d. Translation of Dish Names (OpenRouter)

To show dishes in several languages, we translate dish names and descriptions with language models through OpenRouter, a service of OpenRouter, Inc., 169 Madison Ave #2404, New York, NY 10016, USA. OpenRouter passes each request on to the provider of the language model used. A request contains only the name, the description and the internal identifier of each dish; no data about users or orders is sent. More information can be found in the privacy policy at OpenRouter Privacy Policy.

e. Push Notifications

In our software, you can turn on push notifications on your device, for example when a new menu is published or as a reminder to place your order. When you allow them, we store, linked to your user account, the address of the push service provided by your browser's manufacturer (for example Apple, Google or Mozilla), the keys used to encrypt the messages, the type of device (such as iPhone, Android or Windows), and the time of the last successful delivery. Our server sends the messages, encrypted, through this push service.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). You can turn push notifications off at any time in your profile or in your browser settings. Turning them off in your profile deletes the stored data for that device.

VIII. Changes to This Privacy Policy

We reserve the right to change this privacy policy with future effect. The current version is available here.

Date of Last Update: October 24, 2026