Privacy policy

1. Controller

Faiz Abdul, 33098 Paderborn, Deutschland. Email: abdul.faiz1602@gmail.com.

Platefair is run privately and is currently free of charge. No data protection officer is appointed, as none is required.

2. In short

We only process data that Platefair needs. No advertising, no tracking, no analytics tools, no selling of data. We only use technically necessary cookies.

3. Hosting and server logs

The website is provided by Vercel Inc. (USA); the server functions run in the EU (Dublin, Ireland). When you open a page, Vercel processes technically necessary data such as IP address, time, requested address and browser identifier to deliver the page and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR (secure operation).

4. Account and sign-in

For an account we store your email address, optionally your name, your language setting and when you agreed to this policy. You sign in without a password through a link sent by email. The database, sign-in and file storage are run by Supabase Inc. on servers in the EU (Ireland). Legal basis: Art. 6(1)(b) GDPR (providing the service). Platefair cannot be used without an email address.

5. Phone number

Account owners who send requests confirm their mobile number with an SMS code. We use Twilio Inc. (USA) to send it. The number protects against abuse and is not shown to caterers – unless you ask a caterer for a clarification call and they accept; then only that caterer sees your number, and you see theirs. Legal basis: Art. 6(1)(b) and (f) GDPR.

6. Event requests and team

You enter details about the event, e.g. type, date, number of guests, diets, dish wishes, budget and venue. To calculate distances, the venue address is sent to the Nominatim service of the OpenStreetMap Foundation (United Kingdom); the EU has issued an adequacy decision for the United Kingdom.

Invited caterers see the event details and the name of your account, not your email address. Members of your team see the quotes, votes and comments on your requests. Legal basis: Art. 6(1)(b) GDPR.

7. Proofs and verification

To check a request, you can upload a proof for the venue. Only the Platefair administration sees it; it is deleted automatically 30 days after the event date. To verify an organization, a website, an evidence link or a register number can be given. Legal basis: Art. 6(1)(f) GDPR (protecting caterers from fake requests).

8. Caterers

Caterers create a profile, e.g. business name, contact details, delivery area, languages and photos. The profile with photos and reviews is public. Quotes are only seen by the team of the request. Caterers can also reply without an account through a personal link. Legal basis: Art. 6(1)(b) GDPR.

9. Reviews

After an event, only the team that booked the caterer can leave a review. The public profile shows the scores, the comment, the type of event and the number of guests; for organizations also their name, for private accounts only “Private event”.

10. Emails

We use Resend (USA) for sign-in links and notifications; emails are sent through its EU region (Ireland). We keep a log of sent messages (recipient, subject, time, error message) to resolve delivery problems. Legal basis: Art. 6(1)(b) and (f) GDPR.

11. Transfers to the USA

Vercel, Supabase, Resend and Twilio are based in the USA. Where data may reach the USA, this is based on the EU-US Data Privacy Framework or the EU standard contractual clauses. Data processing agreements (Art. 28 GDPR) are in place or being concluded with these providers.

12. Cookies and local storage

We only use technically necessary cookies: a sign-in cookie for your session and a cookie for the language you chose. The light/dark setting is stored only in your browser. No consent is needed for this (§ 25(2) TDDDG). We do not use analytics or advertising cookies.

13. WhatsApp

If you invite a caterer with the WhatsApp button, WhatsApp opens on your device with a prepared text. Platefair itself does not send any data to WhatsApp; you decide in WhatsApp what you send.

14. How long we keep data

We keep your data as long as your account exists. You can delete your account yourself at any time in Settings; your data is then deleted unless legal retention duties apply. Venue proofs are deleted automatically 30 days after the event.

15. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time for the future. Write to abdul.faiz1602@gmail.com.

You can also complain to a data protection supervisory authority, in particular in the German state where you live.

16. No automated decisions

Platefair calculates a trust level for accounts (e.g. confirmed phone number, earlier bookings). It only decides which requests caterers see. No decision with legal effect within the meaning of Art. 22 GDPR is made.