Allergen Guard Privacy Policy

Last updated: June 17, 2025

1. Introduction

Welcome to Allergen Guard. We value and respect your privacy and are committed to protecting the personal data you share with us. This Privacy Policy describes how we collect, use, process and protect your information when you use our mobile application (Android and iOS) and our web administration panel (menusadmin.apptolast.com).

Please read this Privacy Policy carefully to understand our practices regarding your personal data and how we will treat it. By downloading, installing or using our application or web platform, you accept the practices described in this policy.

2. Who We Are

Allergen Guard is a digital menu platform developed by App To Last that helps restaurants manage their dishes with allergen information and allows diners to filter menus based on their personal allergy profile. The platform consists of:

A web administration panel where restaurant staff manage their catalogue (ingredients, recipes, menus and allergens).
A mobile application (Android and iOS) where diners browse restaurant menus filtered by their allergy profile.

Both platforms share a single Kotlin Multiplatform codebase backed by Firebase.

3. Information We Collect

3.1 Information You Provide to Us

Account information: when you register in our application or web platform, we collect information such as your email address and password.
Allergy profile (consumer app): we collect the allergen preferences you configure in your personal allergy profile (based on the 14 EU allergens) to filter menus accordingly.
Restaurant data (admin panel): restaurant staff provide information about their establishment, including ingredients, allergen declarations (Contains / May contain / Free of), recipes, dish descriptions, photos and menus.
Communications: when you communicate with us directly, we may keep records of that communication.

3.2 Automatically Collected Information

Device information: we collect information about your device, including model, operating system, unique identifiers and network data.
Usage data: information about how you use our application or web platform, including the features you use, the time you spend and interactions performed.
Log and error data: through Firebase Crashlytics (mobile app), we collect error and performance logs to improve application stability.
Analytics data: through Firebase Analytics, we collect anonymous usage statistics to understand how the platform is used and to improve the user experience.

4. How We Use Information

We use the information we collect to:

Provide, maintain and improve our application and web platform and their functionalities.
Personalize your experience by filtering menus based on your allergy profile.
Process and manage restaurant catalogues, ingredients, recipes and menus.
Compute and display allergen information for dishes automatically based on their ingredients.
Send you notifications related to the application, if you have given your consent.
Analyze and understand how users use our platform to improve it.
Detect, investigate and prevent fraudulent or unauthorized activities.
Resolve technical problems and errors.
Comply with applicable legal obligations.

5. Third-Party Services and Data Processing

5.1 Firebase

We use various Firebase services (Google LLC) for the operation of our platform:

Firebase Authentication: to manage user registration and login.
Firebase Firestore: to store and sync user data, restaurant catalogues, recipes, menus and allergy profiles.
Firebase Storage: to store dish and recipe images uploaded by restaurant staff.
Firebase Crashlytics (mobile app): to collect information about application errors and crashes.
Firebase Analytics: to collect anonymous usage statistics.

Information collected by Firebase is processed in accordance with Google's Privacy Policy and our agreements with Google.

6. Sharing Information

We do not sell or rent your personal data to third parties. We may share your information in the following circumstances:

With service providers who help us operate, maintain and improve our platform (such as Firebase).
When necessary to comply with applicable law, legal processes or government requests.
To protect the rights, property or safety of our platform, our users or others.
In connection with a corporate transaction, such as a merger, acquisition or sale of assets.
With your consent or as directed by you.

7. Data Security

We implement technical, administrative and physical security measures designed to protect your personal data against unauthorized access, loss, misuse or alteration. These measures include:

Encryption of sensitive data.
Firebase security rules to restrict data access to authorized users.
Restricted access to personal data.
Regular monitoring and testing of our systems.
Implementation of industry-standard security protocols.
Client-side image compression before upload.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security.

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

When you delete your account, we delete your personal information from our systems and from Firebase, although we may retain certain information in anonymous or aggregated form for analytical purposes.

9. Your Privacy Rights

Depending on your location, you may have certain rights related to your personal data, which may include:

Access: right to request a copy of your personal data.
Rectification: right to correct inaccurate or incomplete data.
Deletion: right to request deletion of your personal data.
Restriction: right to request limitation of processing of your data.
Data portability: right to receive your data in a structured and transferable format.
Objection: right to object to the processing of your data in certain circumstances.

To exercise these rights, contact us through the means provided in the "Contact Us" section of this policy.

10. Children's Privacy

Our application is not directed to persons under 13 years of age, and we do not knowingly collect personal information from children under 13 years of age. If we discover that we have collected personal information from a child under 13 years of age, we will take steps to delete that information as soon as possible.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or for other operational, legal or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy in our application and updating the "Last updated" date at the beginning of this policy.

We recommend that you periodically review this policy to stay informed about how we protect your information.

12. Account and Data Deletion

When you request deletion of your account, we commit to:

Delete your user profile and all associated personal information from our systems.
Delete all your data stored in Firebase (Authentication, Firestore and Storage).
Delete your allergy profile and preferences.
For restaurant administrators: delete all associated restaurant data, including ingredients, recipes, menus and uploaded images.

The deletion process is permanent and cannot be reversed. It may take up to 30 days for all data to be completely deleted from our systems and backups.

13. International Data Transfers

To provide our platform, we may transfer, store and process your information in countries other than yours. We ensure that these transfers are made in accordance with applicable data protection laws and take steps to ensure that your personal data receives an adequate level of protection.

14. Contact Us

If you have questions, comments or concerns about this Privacy Policy or our privacy practices, or if you wish to exercise any of your rights, contact us through:

Email: [admin@apptolast.com]

15. Consent

By using our application or web platform, you accept the terms of this Privacy Policy. If you do not agree with this policy, please do not use our application or web platform.