Privacy Policy

This Privacy Policy explains how Mealio (“Mealio,” “we,” “us,” or “our”), a product of Versatyl Group, handles information in connection with the Mealio mobile application (the “App”), a restaurant discovery tool for New York City. By using the App, you agree to the practices described here.

Who we are. Versatyl Group is the controller of the personal data described in this Policy. You can reach us at hello@versatyl.group about anything in it, including any request to exercise the rights described in Section 7.

You must be 18 or older to use the App. See Section 8.

We collect as little as we reasonably can. Core features work without an account — you can search and browse as a guest without giving us your name or email. If you choose to create an account, we collect your email address and, while you are signed in, the custom scores you create (see below). We do not show ads, we do not sell your personal information, and we do not track you across other companies’ apps or websites.

Information you provide. The searches you enter (typed or dictated), and the content you save — favorites, saved searches, history, and the custom rating axes, scores, and notes you create. Saved content is stored on your device and, if iCloud is enabled, synced through your private Apple iCloud account (see Section 3).

Account information (optional). If you create an account, you sign in with Apple or Google. We receive an email address (which may be an Apple private-relay address) and a unique account identifier. We never receive or store your password. Creating an account is optional — core features work as a guest.

Custom scores (signed-in only). If you are signed in, the custom scores you create — the rating axis, the numeric score, and any note you attach — are also sent to and stored on our servers, linked to your account, so we can improve the App and build aggregate insights (see Sections 2 and 3). Guests’ custom content is not sent to our servers; it stays on the device.

Information collected automatically. A random identifier generated on your device (not your name, email, phone number, Apple ID, or an advertising identifier); basic usage and interaction data about how the App is used — for example, that a search was run, that results were shown, and that you tapped, saved, or opened certain items; your device location when you search, used to rank nearby results (see Section 4); and limited technical information such as app version and selected city.

Voice input. If you use dictation, your speech is converted to text by your device’s built-in speech recognition (provided by Apple). We do not record or store voice audio; we receive only the resulting text.

What we do not collect. We do not collect your name, phone number, contacts, photos, or health data, we do not collect advertising identifiers, and we do not use third-party advertising SDKs. We do not ask for your date of birth.

We use this information to operate the App and return relevant, nearby results; to provide account features when you sign in; to store your custom scores and combine them, in aggregated and de-identified form, with other users’ content to build insights that improve the App and that we may provide to hospitality and industry partners; to understand how the App is used and improve its quality, reliability, and features; to maintain security and prevent abuse; and to comply with legal obligations.

Legal bases (EU/UK GDPR). Where the EU General Data Protection Regulation (“GDPR”) or the UK GDPR applies to our processing of your personal data, our legal bases are:

• Performance of a contract (Article 6(1)(b)) — operating the App and providing any account you ask us to create.
• Our legitimate interests (Article 6(1)(f)) — improving, securing, and understanding use of the App, preventing abuse, and developing aggregate and de-identified insights. We balance these interests against your rights, and you may object at any time (Section 7).
• Your consent (Article 6(1)(a)) — device location, which you grant in your device’s Settings and can withdraw at any time without affecting processing carried out before you withdrew it.
• Compliance with a legal obligation (Article 6(1)(c)) — where we must retain or disclose information by law.

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you. The rankings and match indicators the App displays are editorial estimates about restaurants, not decisions about you.

On your device and in your iCloud. Favorites, saved searches, history, notes, and custom scores are stored on your device and, if iCloud is enabled, sync through your own private iCloud account, which is operated by Apple and which we cannot access.

Account and score data on our servers. If you are signed in, your account identifier, email, and the custom scores you create are stored on our servers. We use these to provide account features and, in aggregated and de-identified form, to build the insights described in Section 2.

Service providers. We use a small number of third-party providers to run the App on our behalf — for example, cloud hosting and database services, authentication, mapping, on-device dictation, and automated services used to interpret your searches. They process information only as needed to provide their service to us and may not use it for their own purposes. Where the GDPR or UK GDPR applies, these providers act as our processors under written terms that meet Article 28.

No sale of personal information; no ads; no cross-app tracking. We do not sell or rent your personal information, do not use it for third-party advertising, and do not track you across other companies’ apps or websites. Because of this, the App does not present an App Tracking Transparency prompt. We may share aggregated or de-identified data — which does not identify you — with partners such as hospitality and industry companies; because it does not identify you, this is not a sale of personal information.

Legal and business transfers. We may disclose information where required by law or to protect rights, safety, or property, and information may transfer as part of a merger, acquisition, or sale of assets, subject to this Policy.

Where your information is processed, and international transfers. We are based in the United States, the App covers venues in New York City, and we process and store information in the United States. If you use the App from outside the United States, your information will be transferred to and processed in the United States. Where the GDPR or UK GDPR applies, we rely on an appropriate transfer mechanism for personal data leaving the EEA or the UK — the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), or another safeguard permitted under Chapter V of the GDPR. You can ask us for details using the contact address below.

Location is used to rank restaurants near you when you search. Depending on the permission you grant it may be approximate or precise, and it is used only while you use the App. If you do not grant location access, the App uses a default city location and continues to work. Location associated with a search may be retained with usage records for a limited period. You can change or revoke location access at any time in your device Settings.

We keep information only for as long as needed for the purposes described, after which it is deleted or de-identified. Content you save remains until you delete it or delete the App. Account information and your server-stored scores are retained while your account is active; when you delete your account, they are deleted from our active systems. Aggregated or de-identified data that no longer identifies you may be retained and continue to be used.

Communication between the App and our servers is encrypted in transit (HTTPS/TLS). We use reasonable technical and organizational measures designed to protect information against loss, misuse, and unauthorized access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You can delete saved content — including individual custom scores — within the App or by deleting the App, and you can enable or disable location and microphone access in your device Settings. You can delete your account at any time from the App’s Settings; deleting your account removes your account and its associated data, including the custom scores stored on our servers, from our active systems. Depending on where you live, you may have the right to access, correct, or delete information associated with you or your device, and not to be discriminated against for exercising these rights; contact us to make a request. We do not sell personal information, including as defined under applicable U.S. state privacy laws.

If the GDPR or UK GDPR applies to you, you have the following rights over your personal data, free of charge in most cases:

• Access — a copy of the personal data we hold about you, and information about how we process it (Article 15).
• Rectification — correction of inaccurate or incomplete data (Article 16).
• Erasure — deletion of your data, also called the “right to be forgotten” (Article 17).
• Restriction — to have us pause processing in certain circumstances (Article 18).
• Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible (Article 20).
• Objection — to object at any time to processing based on our legitimate interests, including profiling connected with it (Article 21).
• Withdraw consent — at any time, where we rely on consent (such as device location), without affecting the lawfulness of processing before you withdrew it (Article 7(3)).
• Complain to a supervisory authority — your local data protection authority in the EEA, or the Information Commissioner’s Office (ICO) in the UK (Article 77). We would appreciate the chance to address your concern first.

To exercise any of these, contact us at hello@versatyl.group. We will respond within one month, and may ask for information reasonably needed to verify your identity before acting on a request.

The App is for adults. You must be at least 18 years old to use it. The App is not directed to children or to anyone under 18, and we do not knowingly collect personal information from anyone under 18. We do not ask for your date of birth, and we do not knowingly permit anyone under 18 to create an account.

If we learn that we have collected personal information from someone under 18, we will delete it and close any associated account. If you believe someone under 18 has provided us information, please contact us at hello@versatyl.group and we will delete it.

Because the App is restricted to adults, we do not rely on the parental-consent mechanism in Article 8 of the GDPR, and we do not knowingly process the personal data of children as defined under the Children’s Online Privacy Protection Act (“COPPA”).

We may update this Policy from time to time. Material changes will be reflected by updating the date above. We expect to update it again when we introduce paid features, at which point additional information (such as purchase records) may be collected.

Versatyl Group · Mealio
hello@versatyl.group · versatyl.group