User & Merchant Privacy Policy

The Data Controller responsible for your personal data is Hungrme Ltd, a company incorporated in the Republic of Mauritius, with its registered office at Curepipe, Mauritius (the “Company”, “we”, “us”, or “our”). Company registration number: C26235394. You may contact us at [email protected].

For the purposes of the Mauritius Data Protection Act 2017 (“DPA 2017”), we are the Data Controller. Our Data Protection Officer (or equivalent responsible person) can be reached at the contact email above. Registration with the Office of the Data Protection Commissioner of Mauritius, including formal designation of a named Data Protection Officer, is in progress. This notice will be updated with the DPO’s name and our DPC registration number once that process is complete.

When you upload a photo of a menu or a dish, we may use artificial intelligence (specifically Google Vertex AI / Gemini) to extract factual information such as dish names, prices, ingredients, and potential allergens. This processing helps us build and keep the platform’s data fresh. The output is reviewed before being published.

The legal bases for this processing are your consent (when you upload the image) and our legitimate interest in maintaining accurate restaurant data. You may withdraw your consent for future AI processing of your uploads by deleting the relevant content from your account or contacting us.

AI-inferred vs. menu-sourced data. Where the AI infers information that was not present on the original menu (for example, a likely allergen or an auto-generated description), we mark such data with a visual indicator (“AI-suggested”) so that it can be distinguished from information taken directly from the menu or confirmed by the merchant.

Restaurant and menu information on the Service is gathered from multiple sources, which may include:

• Owners and field representatives — restaurants that register or claim their listing, or information entered by our field team;
• Community users — photos, prices, reviews, and venue suggestions submitted by users like you;
• Third-party reference data — factual business information (such as addresses, ratings, and opening hours) obtained from licensed data providers and public business directories.

Where third-party data is used, we display only factual information that is not protected by copyright (such as prices, addresses, and hours). We do not knowingly reproduce copyrighted creative material (such as unique menu designs, photographs, or marketing copy) from third-party sources without permission. If you believe we have done so, please see Section 12 on reporting content.

We may share your personal data with the following categories of recipients:

• Service providers — third parties that process data on our behalf (see Section 7);
• Payment processor (Peach Payments) — to process transactions;
• Restaurants — when you redeem a coupon or check in at a venue, limited information (such as your coupon identifier) is shared with that venue to fulfil the offer;
• Professional advisors and auditors — subject to confidentiality;
• Legal and regulatory authorities — where required by law, court order, or to protect our rights and safety; and
• Business transferees — in connection with a merger, acquisition, or sale of our business.

We do not sell your personal data to third parties.

Some of our service providers are located outside Mauritius, including in the United States and South Africa. When we transfer your personal data outside Mauritius, we do so only where appropriate safeguards are in place, such as Standard Contractual Clauses, a recognised certification framework, or your explicit consent. You may request a copy of the safeguards used for a specific transfer by contacting us.

The Service uses cookies and similar technologies to operate, secure, and improve. These include strictly necessary cookies, functional cookies (such as language and theme preferences), and analytics and error-monitoring cookies. We do not use cookies for cross-site advertising or third-party ad targeting.

You can control cookies through your device or browser settings. Some features may not work if strictly necessary cookies are disabled.

• Account data is retained while your account is active and for a reasonable period after closure for legal, tax, and dispute purposes.
• User-generated content is retained for as long as the content remains published on the platform, unless you or we delete it. Deleted content may remain in backups for up to 90 days.
• Location data collected for a single feature (such as a check-in) is generally retained only as long as needed to validate the action and award any associated reward.
• Payment records are retained for the period required by applicable tax and accounting law (typically 7 years).
• Security logs are retained for up to 24 months.

Under the DPA 2017 you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent where we rely on it. You may exercise these rights from within your account settings or by emailing [email protected] with the subject line “Data Protection Request”. We will respond within one (1) month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commissioner of Mauritius (dataprotection.govmu.org).

We may review, edit, hide, or remove user-generated content that breaches our User Terms of Service, applicable law, or the rights of third parties. This includes content that is unlawful, defamatory, infringes intellectual property, or is otherwise objectionable.

To report content (including copyright or trademark concerns), email [email protected] with details of the content and the basis for your report. We will investigate and take appropriate action, which may include removing the content and, in the case of repeat infringers, terminating the account responsible.

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), hashed passwords, role-based access controls, regular security reviews, and incident-response procedures. No method of transmission or storage is completely secure.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commissioner of Mauritius without undue delay in accordance with the DPA 2017, and we will inform affected users without undue delay where the law requires it, describing the nature of the breach and the steps we are taking in response.

The Service is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent notice in the Service. Continued use after any change constitutes acceptance of the updated Policy.

For any questions or requests regarding this Privacy Policy or your personal data, contact us at [email protected] or by post at: Hungrme Ltd, Curepipe, Mauritius.