Privacy Policy

This Privacy Policy explains how Reveal Labs ΟΜΟΡΡΥΘΜΗ ΕΤΑΙΡΕΙΑ (trading as Reveal Labs / MealReveal) (“Reveal Labs”, “we”, “us”, or “our”). collects and processes personal data when you use the mealreveal.app website, the MealReveal platform (digital menu, ordering, analytics and related hospitality services), and our related communications.

• Controller: we are the controller for website visitor data, business (B2B) account data, prospects, and communications with us.
• Processor: for guest / diner data arising from use of a venue’s digital menu, orders, or related in-venue features, the hospitality business (the restaurant) is the controller. Reveal Labs processes that data on the restaurant’s behalf, under its instructions and our service agreement / terms.

Depending on the context, we rely on:

• performance of a contract (providing MealReveal, accounts, payments),
• legitimate interests (security, product improvement, fraud prevention, proportionate B2B marketing),
• consent (e.g. non-essential cookies / certain analytics or marketing, where required),
• legal obligation (tax, accounting, lawful requests from authorities).

We share data with providers that help us operate the Services, only as needed:

• Back4App / Parse: backend hosting, accounts, and application data
• Revolut: payment processing for subscriptions and offers
• Mailgun: transactional and outreach email delivery
• Resend: email delivery where used
• Microsoft Clarity: website analytics (behavior, heatmaps), where enabled
• Tawk.to: live chat / support on the website, where enabled
• HubSpot: CRM / marketing communications with business prospects and customers, where enabled
• AADE / GEMI: verification or retrieval of public company / tax details where required for offers, invoicing, or compliance

We may also disclose data where required by law or to protect our rights and those of others.

Some providers may process data outside the European Economic Area. Where that occurs, we use GDPR-compliant safeguards (such as Standard Contractual Clauses or equivalent measures), where applicable.

• B2B account / contract data: for the duration of the relationship and as required by tax / accounting law (typically up to 10 years for certain accounting records in Greece),
• communications / leads: until the matter is closed or a deletion / objection request is handled, and in any event for a reasonable period,
• restaurant guest data: according to the restaurant’s instructions and its own policy; as processor, we do not use it for our own marketing,
• technical / security logs: for a limited period needed for security and diagnostics.

Subject to GDPR conditions, you may request:

• access, rectification, erasure,
• restriction or objection to processing,
• data portability,
• withdrawal of consent where we rely on consent,
• a complaint to the Hellenic Data Protection Authority (www.dpa.gr).

For guest data collected in-venue, contact the restaurant first (controller). You may also email [email protected] and we will help route your request.

We apply appropriate technical and organisational measures. No method of transmission or storage is completely secure.

The Services are not directed at children under 16. We do not knowingly collect children’s data.

We may update this policy. The “Last updated” date at the top of the page will change. Continued use after material changes constitutes acceptance where permitted by law; where required, we will seek fresh consent.

For privacy matters: [email protected]