Privacy

1. Controller

2. Website visits and server logs

When you visit this website, technically necessary connection data is processed. This may include your IP address, the date and time of access, the requested URL, the amount of data transferred, the referrer URL, browser type, operating system and status code.

Processing is necessary to deliver the website, ensure its stability and security, and prevent misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Log data is deleted when it is no longer needed for these purposes. Longer retention occurs only where a specific security incident must be investigated or legal obligations apply.

3. Early access registration

When you register your interest as a restaurant or creator, we process the details you enter in the form. Depending on your selection, required details are your name, restaurant name and a way to contact you, or your social media handle. Contact details may include an email address, phone number, WhatsApp number or Instagram/TikTok handle.

You may optionally add your Instagram handle, portfolio link, location, content budget, goals, content style, expected rate and an alternative contact method. We also store the time of your consent and the creation and update timestamps.

We use this data to manage your registration, contact you about early access and prepare potential collaborations between hospitality businesses and creators. The legal basis is your consent under Article 6(1)(a) GDPR. Where your enquiry concerns entering into a specific collaboration, Article 6(1)(b) GDPR also applies.

You can withdraw your consent at any time with effect for the future by emailing shayan@mission.do . Withdrawal does not affect the lawfulness of processing carried out before it. We cannot save your registration without the fields marked as required; optional details can be omitted.

We store your registration until you withdraw consent or it is established that the early access or matching purpose is no longer being pursued. Where statutory retention or documentation obligations apply, the affected data is deleted only after those periods expire. Registrations are accessible only through the protected Munchy administration area.

4. Hosting and database

This website is provided through ChatGPT Sites by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Infrastructure from Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, is used for delivery, security features and storage of form submissions in a Cloudflare D1 database. These providers process data as service providers for technical delivery.

Processing outside the European Union or the European Economic Area cannot be ruled out. Where no adequacy decision exists for a recipient country, transfers are based on appropriate safeguards, in particular the European Commission’s standard contractual clauses. Cloudflare additionally bases transfers to the USA on its certification under the EU–US Data Privacy Framework, with standard contractual clauses as a fallback.

Further information is available in the privacy notices of OpenAI and Cloudflare.

5. Cookies, analytics and external content

Munchy currently does not use analytics, marketing or profiling services and does not embed external social media feeds, videos or advertising pixels. We do not set non-essential cookies or comparable storage technologies ourselves.

For secure operation, Cloudflare may set the technically necessary cookie __cf_bm . It helps detect automated and malicious traffic and protects the website from bots. The cookie contains encrypted information used to calculate a bot score, does not identify you to Munchy and expires after 30 minutes of inactivity. The legal bases are Section 25(2)(2) TDDDG and Article 6(1)(f) GDPR. Our legitimate interest is the secure and uninterrupted provision of the website. As only technically necessary cookies are used, a consent banner for analytics or marketing is currently not required.

External websites are accessed only when you click their links. From that point, the respective provider is responsible for data processing on that website.

6. Contact

If you contact us by email or through a communication channel you have provided, we process your contact details and message to respond to your enquiry. The legal basis is Article 6(1)(b) GDPR where a potential collaboration is involved, and otherwise Article 6(1)(f) GDPR. Our legitimate interest is to handle incoming enquiries. Data is deleted once the enquiry is fully resolved, unless statutory retention obligations apply.

7. Recipients

We share personal data only where necessary to operate the website, handle your enquiry or prepare a collaboration you have requested, where you have consented, or where there is a legal obligation. Technical recipients include, in particular, the providers listed under ‘Hosting and database’. Your profile data will not be shared with a specific restaurant or creator without prior agreement with you.

8. Your rights

Subject to the applicable legal requirements, you have the following rights in particular:

• Access to your processed data (Article 15 GDPR),
• Rectification of inaccurate data (Article 16 GDPR),
• Erasure of your data (Article 17 GDPR),
• Restriction of processing (Article 18 GDPR),
• Data portability (Article 20 GDPR),
• Objection to processing based on Article 6(1)(f) GDPR (Article 21 GDPR),
• Withdrawal of consent with effect for the future (Article 7(3) GDPR).

To exercise your rights, simply send a message to shayan@mission.do. No solely automated decision-making, including profiling, takes place.

9. Right to complain

You can lodge a complaint with a data protection supervisory authority. For Hamburg, this is in particular the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg. Information and the complaint form are available at datenschutz-hamburg.de.

10. Version and updates

Last updated: 18 July 2026.

We update this privacy policy when features, service providers or legal requirements change.