Skip to content

Privacy Policy

Last updated: September 2026

1. Controller

Merandoo

Email: privacy@merandoo.com

Merandoo is currently operated by an individual. Formal company registration details will be added here once a legal entity is established.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide our apps and services, to fulfill contracts, to comply with legal obligations, or where you have given consent.

We process your data on one or more of the following legal bases:

  • Art. 6(1)(a) GDPR – consent
  • Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
  • Art. 6(1)(c) GDPR – compliance with a legal obligation
  • Art. 6(1)(f) GDPR – legitimate interests, provided your interests do not override ours

3. Categories of Data We Process

Depending on how you use our services, we may process:

  • Account and identity data (name, email address, phone number)
  • Authentication data (password hashes, session identifiers, refresh tokens)
  • Order and transaction data
  • Communication data (messages, support requests)
  • Device and technical data (IP address, app version, device type, operating system)
  • Usage and preference data (language, theme, notification settings)
  • Payment-related data (processed via payment providers where applicable)
  • Location or address data where needed for ordering, delivery, reservations, or workplace setup

4. Purposes of Processing

  • To create and manage user accounts
  • To authenticate users and keep accounts secure
  • To process orders, reservations, subscriptions, and related transactions
  • To provide customer support and service communications
  • To send transactional notifications and, where permitted, marketing communications
  • To maintain app functionality, security, stability, and abuse prevention
  • To comply with legal obligations, accounting rules, and tax regulations

5. Account Registration and Authentication

When you create an account or log in, we process the data required to identify you and secure your account.

6. Orders, Reservations, and Transactions

When you place or manage orders, create reservations, or use related transactional features, we process the information required to complete these services.

7. Communications and Notifications

We may send service-related notifications, security alerts, and order updates. If you opt in, we may also send marketing communications.

8. Technical Logs and Security

We process technical logs and security-related data to detect abuse, troubleshoot issues, and maintain system integrity.

9. Offline Storage and Local Device Data

Parts of our apps may store data locally on your device so that the apps can function correctly, remember preferences, or support offline features.

10. Business App Specific Processing

If you use the business app, we may additionally process workplace information, team member data, menu and catalog data, subscription and billing information, and locally stored offline workplace data.

11. QR Code Menu Access via Browser

When you scan a QR code to access a business's menu or storefront in your browser, we process technical data (IP address, browser type, device information) and any information you submit, such as order details or contact information.

12. Recipients and Processors

We may share personal data with service providers where necessary:

  • Hosting and cloud infrastructure (Europe)
  • Firebase Cloud Messaging (FCM) — push notifications (operated by Google)
  • Firebase Analytics — usage analytics (operated by Google)
  • Firebase Crashlytics — crash and error reporting (operated by Google)
  • Email delivery providers

Authorized personnel may access personal data as necessary for support, maintenance, security, and operational purposes. Access is limited to personnel with a legitimate need and is subject to internal controls.

13. International Transfers

If personal data is transferred outside the EEA, we ensure adequate protection through adequacy decisions or Standard Contractual Clauses.

Firebase services (FCM, Analytics, Crashlytics) are operated by Google and may involve data transfers to the United States. Google is certified under the EU-U.S. Data Privacy Framework, which provides an adequate level of protection as recognized by the European Commission.

14. Retention Periods

We retain personal data only as long as necessary or as required by law. When no longer needed, it is deleted or anonymized.

15. Account Deletion

You can request deletion of your account and associated personal data at any time. The process works as follows:

  1. In-app request: Go to your account settings and select "Delete Account". A verification code is sent to your email address.
  2. Verification: Enter the code to confirm you are the account owner.
  3. Deletion: Upon confirmation, your account, personal data, and associated records are permanently deleted.

If you are unable to use the in-app flow, you may also request deletion by emailing privacy@merandoo.com. We will process your request within 30 days.

Data retained after deletion:

  • Anonymized or aggregated data that no longer identifies you may be retained for analytics and service improvement.
  • Data required to comply with legal obligations (e.g., tax and accounting records) will be retained for the legally mandated period and then deleted.

16. Your Rights Under the GDPR

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)
  • Right to withdraw consent (Art. 7(3))
  • Right to lodge a complaint with a supervisory authority (Art. 77)

To exercise any of these rights, please contact us at privacy@merandoo.com with proof of identity. We will respond within 30 days.

17. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority.

18. Automated Decision-Making

We do not carry out automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

19. Security

We implement appropriate technical and organisational measures to protect your personal data. No method of transmission or storage is completely secure, but we regularly review and update our practices.

20. Children's Privacy

Our services are not directed at children under 16. We do not knowingly collect personal data from children under 16.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available on our website and in the apps.

22. Contact

Questions? Contact us at privacy@merandoo.com.