Privacy Policy

This policy is published by Himanshu Jeetendra Bundel, an individual trading as Cheddar Labs("Cheddar Labs", "we", "us"). Cheddar Labs is a trading name, not a company — the data controller is an individual, and you can reach that person directly at cheddarlabsteam@gmail.com. This policy covers the Cheddar website, the operator dashboard, and the guest menu that diners reach by scanning a QR code.

Under data protection law, the roles differ. For restaurant operators' own account data, we are the controller — we decide what to collect and why. For diner data captured in a restaurant's menu, the restaurant is the controller and we act as its processor, running the service on its behalf. If you are a diner with a question about a specific restaurant, you can contact either the restaurant or us.

When you create and run a Cheddar account, we hold:

• Account details — first and last name, email address, password (stored only as a secure hash by our authentication provider, never in readable form), profile photo if you sign in with Google, timezone, your role, and whether your account is active.
• Business details — restaurant or organisation name, locations, branding and settings, plus the names and email addresses of team members you invite.
• Your menu content — dishes, descriptions, prices, photos, ingredient and allergen records, and QR code configuration. This is business data rather than personal data, but it is yours and we treat it as confidential.
• Billing information — your subscription plan, status, renewal dates and invoice history. Card payments are handled by Stripe; we receive confirmation of payment and limited details such as the card brand and last four digits. We never receive or store your full card number.
• Security and support records — sign-in attempts, failed-login counters used for account lockout, invitations and access codes, and any messages or feedback you send us.

We use this to run your account, to provide the service, to take payment, to keep the platform secure, and to contact you about your account or important changes. Our legal bases are performance of our contract with you, our legitimate interest in keeping the service safe and working, and consent where we ask for it.

Diners do not create an account, and we do not ask them for their name, phone number, address or payment details. Browsing a menu is anonymous. What we do record is:

• An anonymous session. When a diner opens a menu, a random session identifier is created and kept in their browser. It lets the menu remember the conversation and shortlist while they are at the table. It is not linked to a name and is not used to track people across other websites.
• Table and menu context — which restaurant and which QR code or table label was scanned, and when.
• Interaction events — which dishes were shown, viewed, filtered, or added to a shortlist, and similar usage signals. These become the analytics a restaurant sees in its dashboard.
• Chat messages with the AI assistant — see the next section, which deserves its own explanation.
• Technical data — standard information a web server and our error monitoring receive, such as browser type, approximate location derived from network address, and error diagnostics.

A restaurant can see this data for its own menu only. One restaurant can never see another's guests, menus or analytics.

Cheddar's assistant does not run on our own servers. When a diner sends a message, we send that message, the recent conversation, and the relevant parts of the restaurant's menu to a third-party AI provider, which returns the answer.

• OpenAI is the default provider. It generates chat answers and also creates the mathematical "embeddings" used to search menu items.
• Google (Gemini) may be used as a fallback when an account exceeds its monthly AI allowance, or when a restaurant selects a Gemini model.

These providers process the message in order to produce a reply, under their own business terms. We use their standard business APIs, which do not use submitted content to train their public models by default. We do not sell guest messages, and we do not share them with advertisers.

Diners are told in the guest interface that they are chatting with an AI assistant and that it can be wrong. See our Beta Participation Agreement, section 5, for what the assistant does and does not claim about allergens.

Cheddar uses a small number of cookies and similar browser storage:

• Essential. Sign-in and session cookies set by our authentication provider, plus cookies that track when your session started so we can expire it (one hour, or seven days if you tick "keep me signed in"). The guest menu also uses browser storage to remember an anonymous session and shortlist. Without these the product does not work.
• Product analytics — PostHog. Records page views and product usage events so we can see which features are used. It is configured not to build a personal profile for anonymous visitors.
• Website analytics — Google Analytics. Runs on the public marketing site to measure visits and traffic sources. Google sets its own cookies and may process this data outside your country.
• Error monitoring — Sentry. Captures crashes and errors so we can fix them. Sentry's session replay feature is enabled on a sample of sessions, which records a reconstruction of what happened on screen during that session. It is used for debugging only.

Each of these is enabled only when the relevant configuration is present, so a given deployment may run fewer of them. We do not use cookies for advertising and we do not sell the data they generate. You can block cookies in your browser, but essential ones are needed to sign in.

We do not sell personal information. We share it only with the service providers we need to run Cheddar, each under a contract that limits them to acting on our instructions:

• Supabase — database, authentication and file storage.
• Vercel — hosting and delivery of the website and application.
• OpenAI and, as a fallback, Google — AI answers and menu search.
• Stripe — subscription payments.
• Resend — sending transactional emails such as team invitations.
• PostHog, Google Analytics and Sentry — analytics and error monitoring, as described above.

We may also disclose information if the law requires it, to protect someone's safety, to enforce our terms, or as part of a business sale or reorganisation — in which case we will tell affected account holders.

Cheddar's database, hosting and AI providers are based in the United States, and data is processed there. If you are in the UK, the European Economic Area or another region with transfer restrictions, this means your information is transferred outside your region. Where required, those transfers rely on the standard contractual clauses or an equivalent approved safeguard offered by each provider.

The governing law for our operator agreement is set out in the Beta Participation Agreement, and is currently California.

• Operator account and profile — for as long as the account is open, and for a reasonable wind-down period after it closes so the account can be restored or exported.
• Menu content — until you delete it, or until your account closes and the wind-down period ends.
• Billing and invoice records — kept for as long as tax and accounting law requires, typically several years, even after an account closes.
• Guest sessions and analytics events — kept while the restaurant's account is open. Deleting a menu or an account removes the linked guest sessions.
• Guest chat messages and AI logs — currently kept indefinitely, with no automatic deletion window in place. They are removed when the linked session, menu or account is deleted, or on request. See section 4, which explains why we are not comfortable with this and intend to shorten it.
• Error and monitoring data — kept according to each provider's default retention, typically weeks to months.

Depending on where you live — including under the UK and EU GDPR, and the California Consumer Privacy Act as amended by the CPRA — you have rights over your personal information:

• Access. Ask what we hold about you and get a copy.
• Correction. Ask us to fix anything inaccurate.
• Deletion. Ask us to delete your information, including guest chat messages from a visit, subject to what we must keep by law.
• Portability. Ask for your data in a machine-readable format.
• Objection and restriction. Object to processing based on our legitimate interests, or ask us to pause processing while a dispute is resolved.
• Withdraw consent at any time where processing relies on consent.
• No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is nothing to opt out of.
• No discrimination. Exercising these rights will never mean worse service or a different price.

To exercise any of these, email cheddarlabsteam@gmail.com. We aim to respond within 30 days, and will tell you if we need longer. We may need to verify who you are first. An authorised agent may act for you with written permission.

If you are a diner, tell us the restaurant, the table, and roughly the date and time of your visit — that is how we locate an anonymous session. Deleting it is usually straightforward, but if you cannot give us enough detail to find it, we may not be able to identify your data, and the law does not require us to collect more information just to make you identifiable.

If you think we have handled your information badly, please tell us first so we can fix it. You also have the right to complain to your local data protection authority.

Data is encrypted in transit. Passwords are stored only as secure hashes. Access between restaurants is separated at the database level so one account cannot read another's data, and administrative access to the platform is restricted to a small number of people. Sign-in attempts are rate-limited and repeated failures lock the account temporarily.

No system is perfectly secure, and we cannot guarantee that a breach will never happen. If one occurs that affects you, we will notify you and the relevant authorities where the law requires it.

Cheddar is a business tool sold to restaurants and is not directed at children. Operator accounts are for adults. The guest menu is a public restaurant menu, and we do not knowingly collect personal information from children through it. If you believe a child has given us personal information, contact us and we will delete it.

We will update this policy as Cheddar changes — for example, when the automatic deletion window for guest chat messages described in section 4 is in place. The "last updated" date at the top always reflects the current version, and we will tell account holders by email about significant changes.

For any privacy question or request, email cheddarlabsteam@gmail.com. That inbox is read by Himanshu Jeetendra Bundel, who is the data controller. We do not publish a postal address; ask by email if you need one for a formal notice.