Privacy Policy

ImmigrantFoodie is operated by Uncanny Labs, a company established in Lisbon, Portugal (the "data controller" for the purposes of the EU General Data Protection Regulation, the "GDPR"). For anything related to your personal data, contact us at info@uncannylabs.ai.

This policy covers the ImmigrantFoodie website and member map (the "Service").

• Account data. Your email address. That's the whole credential — we use passwordless magic-link sign-in, so there is no password, and we don't ask for your name or phone number.
• Billing data. When you subscribe, Stripe collects your email, card details, and billing information directly on its own checkout pages. We never receive your card number; we store only your Stripe customer and subscription identifiers and your subscription status (for example "active" or "canceled").
• Things you save. Restaurants you save or mark ("saved", "want to try", "been") and any notes you attach to them.
• Technical data. Like every website, our hosting provider processes your IP address and browser information in server logs when you load pages. Our analytics (Vercel Web Analytics) is cookieless and aggregated — it doesn't identify or track you across sites.
• Location (optional). If you tap the locate button on the map and grant your browser permission, your device position is used only in your browser to show where you are on the map. It is never sent to our servers and never stored. You can revoke the permission in your browser or device settings at any time, and the map works fine without it.

• Providing the Service — creating your account, signing you in with magic links, showing you the map, remembering your saved places. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Billing and subscription management — processing payments, renewals, and cancellations through Stripe. Legal basis: performance of our contract (Art. 6(1)(b)).
• Service emails — magic sign-in links, receipts, and important notices about your subscription. Legal basis: performance of our contract (Art. 6(1)(b)). We don't send marketing emails; if we ever start, it will be opt-in only.
• Keeping records we're required to keep — invoices and billing records under Portuguese tax and accounting law. Legal basis: legal obligation (Art. 6(1)(c)).
• Security and abuse prevention — server logs and fraud screening help us keep the Service secure and prevent abuse. Legal basis: our legitimate interest in running a safe, working service (Art. 6(1)(f)).
• Showing your location on the map — only with your consent, given through your browser's permission prompt (Art. 6(1)(a)); withdraw it any time by revoking the browser permission.

We don't use your data for automated decision-making or profiling.

We share personal data only with the service providers we need to run the product, and only what each one needs:

• Supabase — our database and authentication provider; stores your account, saved places, and subscription records. Supabase privacy policy.
• Stripe — payment processing and billing; Stripe collects your payment details directly and also acts as an independent controller for its own fraud prevention. Stripe privacy policy.
• Vercel — hosting and cookieless web analytics. Vercel privacy policy.
• Resend — delivers our sign-in and service emails to your address. Resend privacy policy.
• Mapbox — renders the map in your browser; your browser requests map tiles directly from Mapbox, which involves your IP address. Mapbox privacy policy.
• Google — restaurant details and photos are sourced from Google Places on our servers; when you tap "Directions", your browser opens Google Maps. Google privacy policy.

We never sell your personal data, and we don't share it with advertisers.

Some of our providers are US companies. Where personal data is transferred outside the European Economic Area, the transfer is protected by the EU–US Data Privacy Framework (for certified providers such as Stripe, Google, and Vercel) or by the European Commission's Standard Contractual Clauses included in our agreements with each provider.

• Account data and saved places — for as long as you have an account, then deleted within a reasonable period after you ask us to close it.
• Billing records — up to 10 years, as required by Portuguese tax and accounting law.
• Server logs — short rolling windows managed by our hosting provider.
• Device location — never stored.

Under the GDPR you can, at any time and free of charge:

• ask for a copy of the personal data we hold about you (access);
• ask us to correct it (rectification);
• ask us to delete it (erasure);
• ask us to restrict or object to certain processing;
• receive the data you gave us in a portable, machine-readable format (portability);
• withdraw any consent you gave, without affecting processing that happened before you withdrew it.

To exercise any of these, email info@uncannylabs.ai from your account email address. We'll respond within one month.

If you think we've handled your data unlawfully, you have the right to lodge a complaint with the Portuguese data protection authority: CNPD — Comissão Nacional de Proteção de Dados, Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, Portugal, www.cnpd.pt, geral@cnpd.pt — or with the data protection authority of the EU country where you live. We'd appreciate the chance to sort it out directly first.

We use only strictly necessary cookies — the session cookies our authentication provider (Supabase) sets to keep you signed in. They exist purely so the Service works; that's why there is no cookie banner. We set no advertising, tracking, or analytics cookies. Our analytics (Vercel Web Analytics) works without cookies and without identifying you.

If you pay or manage billing, those steps happen on Stripe's own pages (checkout.stripe.com, billing.stripe.com), where Stripe's cookies and cookie policy apply.

The Service is not directed at children. In line with Portuguese law, you must be at least 13 to have an account, and at least 18 (or the age of majority where you live) to purchase a subscription.

We're working on an AI concierge you can chat with to pick a restaurant. When it launches, your chat messages will be processed by an AI provider to generate answers, and we'll update this policy with the details before the feature goes live. Your data will not be used to train AI models.

If we change this policy in a meaningful way, we'll update the date at the top and, for material changes, tell you by email or in the app before they take effect.

Uncanny Labs · Lisbon, Portugal · info@uncannylabs.ai