AllerIQ ("we", "us") provides software that helps restaurants publish allergen-aware digital menus. This policy explains what we collect, why, and the choices you have. It covers three groups: restaurant accounts (owners and staff who sign up), menu visitors (guests who view a published menu), and anyone who uses the request board at /requests to name a restaurant they would like allergen answers from.

What we collect — restaurant accounts

Account details. Name, email address, and a hashed password. We never store plaintext passwords.
Restaurant content. Your restaurant profile, menu sections, dishes, prices, ingredients, allergen mappings, uploaded images, and appearance settings — everything needed to render your public menu.
Billing. Payments are processed by Stripe. We store your Stripe customer reference and subscription status, never your card number.
Audit records. For food-safety accountability we keep an append-only log of changes to allergen-related data (what changed, when, by which account, and the request IP).

What we collect — menu visitors

No account required. Guests browse menus without signing in. Allergen selections made on a published menu are kept on the guest's own device and are not stored on our servers. The one place we do store an allergen selection is the request board, described below, where giving it is the point of the form.
Menu chat & translation. If a guest uses the optional "Can I eat this?" chat or menu translation, the conversation text and the menu content are processed by our AI provider (Google Gemini) to generate the answer. Chat messages are not used to build guest profiles.
Technical logs. Our hosting provider (Cloudflare) processes IP addresses and request metadata to serve pages, prevent abuse, and rate-limit traffic.

The request board (/requests)

/requests is a form where anyone can name a restaurant they would like to see allergen answers from. It needs no account. It is the only part of AllerIQ where we store which allergens a person avoids, so it is described here in full.

What one submission stores, in a single database row:

The restaurant name and town as typed, and the time.
The allergens ticked on the form. This is health-adjacent information and is often entered by a parent on behalf of a child, so we ask for nothing else about the person: no name, no age, no description of a condition, and no free text.
An email address, only if one is entered. The field is optional. When it is given it sits on the same row as the allergens, which means that row is a list of allergens with an address beside it. Its one stated use is to tell that person if the restaurant they named builds an allergen menu with us. It is never added to a mailing list, never sold, and never shared.
A salted SHA-256 hash of the connection's IP address, used only to stop one person being counted twice. The raw address is never stored. The hash is erased 24 hours after the request, because that is the whole window it is useful for.

What it is used for. The requests are counted privately, by restaurant name and town, so that we know which kitchens to approach. Counts are readable only through a token-protected internal route. Nothing is published: there is no public list, no ranking, and no page anywhere showing that a restaurant was requested. The restaurant named is not told who asked and receives no address. No analytics runs on /requests — neither Google Analytics nor our Cloudflare page-view beacon loads there.

Retention and deletion. A request is deleted twelve months after it is made. The IP hash on it is erased after 24 hours, well before that. Because there is no account behind a request, deleting one earlier is a manual request rather than a dashboard button: email [email protected] with the restaurant name and town you typed and we will delete the matching row. You do not need to prove anything or tell us anything further, and we will confirm when it is done.

How we use information

To operate the service: render menus, generate QR codes, and sync subscriptions.
To send transactional email: welcome messages, password resets, and billing notices (via Postmark).
To process menu imports and AI features you explicitly trigger.
To protect the service: rate limiting, abuse prevention, and security logging.

We do not sell personal data, run third-party advertising, or use your menu content to train AI models.

Service providers

We share data only with the processors that run the service: Cloudflare (hosting, storage), Neon (database), Stripe (payments), Postmark (email), and Google (AI features, only when an AI feature is used). Each receives only what it needs to perform its function.

Retention & deletion

Your content stays as long as your account is active. You can delete your account at any time from Dashboard → Settings → Danger zone; this permanently removes your account, restaurant, menu, and uploaded content, and cancels any active subscription. Audit logs and published-menu snapshots may be retained where we have a legal obligation or a food-safety accountability basis to keep them. Request board submissions are on their own clock and are covered above: twelve months, or sooner on request by email.

Security

All traffic is encrypted in transit (TLS). Passwords are stored using salted PBKDF2 hashing. Access to production systems is restricted, and allergen-data changes are tracked in an append-only audit log.

Your rights

Depending on where you live (e.g., GDPR or CCPA jurisdictions), you may have rights to access, correct, export, or delete your personal data. Most of these are self-serve in the dashboard; for anything else, email [email protected] and we'll respond within 30 days.

Children

AllerIQ is a business tool and is not directed at children under 13. We do not knowingly collect personal information from children.

Changes

If we make material changes to this policy we'll update the date above and notify account holders by email. Questions? Contact [email protected].