# Privacy Policy for FoodPerfect.ai **Last Updated: October 16, 2026** This Privacy Policy explains how **Georgy Bdoyan, operating as FoodPerfect** [TBD: legal form and registration number], [TBD: registered address] ("FoodPerfect," "we," "us," "our"), collects, uses, shares, and protects personal data when you use FoodPerfect.ai: our websites, the web app at [app.foodperfect.ai](https://app.foodperfect.ai), the FoodPerfect MCP server and API, and related services (the "Service"). FoodPerfect is an AI-native social media service for food businesses. It analyses your brand, plans your content, generates photos, posts, menus, promotions, videos, reels, and reel music with AI, schedules and publishes them to your connected Instagram, Facebook, TikTok, and LinkedIn accounts, and helps you answer comments and direct messages. --- ## 1. Who Is Responsible for Your Data ### 1.1 FoodPerfect as Controller We are the controller of the personal data described in this policy that we process for our own purposes: your account, billing, usage, and support data, and the public data we collect for brand analysis. ### 1.2 FoodPerfect as Processor When we process personal data **on behalf of our business customers**, we act as their processor. This covers, for example, the comments and direct messages received by a restaurant's connected social accounts, and images of people that a customer uploads. In that case the customer is the controller, its own privacy notice applies, and our processing is governed by our [Data Processing Addendum](/legal/dpa.md). If you are a customer of a business that uses FoodPerfect, please contact that business to exercise your rights. We will help it respond. ### 1.3 Contact - Privacy questions and requests: **privacy@foodperfect.ai** - EU representative (GDPR Art. 27): [TBD: name and address of EU representative, or remove if not appointed] - UK representative (UK GDPR Art. 27): [TBD: name and address of UK representative, or remove if not appointed] --- ## 2. Personal Data We Collect ### 2.1 Account Data - Name, email address, and password (passwords are handled by Firebase Authentication and never visible to us) - If you sign in with Google: your name, email address, and profile picture, as authorised by you - Account settings, timezone, and preferences ### 2.2 Business and Brand Data - Your business name, website, social media handles, location, menu, offers, and other information about your business - The notes, references, and inspiration accounts you give us, and the brand profile ("Brand DNA"), strategy, and content calendar we create from them ### 2.3 Content You Upload and Create - Photos, logos, menus, fonts, videos, reference images, templates, and other files you upload - Prompts and instructions, including those sent by AI agents you connect - Generated outputs: images, videos, reels, captions, posts, menus, and promotional graphics Uploaded or generated content may include images of people, such as staff or guests. You are responsible for having the right to use them (see Section 3.5 of the [Terms of Service](/legal/terms-of-service.md)). ### 2.4 Connected Social Account Data When you connect Instagram, Facebook, TikTok, or LinkedIn, or connect WhatsApp, Telegram, or Google Business Profile to the inbox, you authorise the connection on the platform's own screen (for Telegram, by adding the connection bot to your group). Connections are managed through our social publishing provider, **Zernio**, which holds the access tokens. We receive and store: - Account and page identifiers, usernames or page names, profile pictures, platform type, and connection status - Details of the posts we create, schedule, or publish for you, including platform post IDs, links, status, and error messages - Post performance data made available by the platform, such as reach, impressions, views, likes, comments, and shares We also keep a short history of each social account you have connected (platform, account ID, username, and when it was first and last connected), including after you disconnect it, so that we can recognise a reconnection, prevent trial and account abuse, and resolve disputes. This history does not include access tokens. Where a platform integration connects directly rather than through Zernio, we store the access token in a restricted server-side store that is not accessible from your browser. ### 2.5 Comments and Direct Messages (Inbox and AI Replies) When you switch on the inbox, we process comments and direct messages received by your connected accounts, including the sender's public username, platform ID, profile picture, the message content, attachments, and timestamps, as well as replies sent by you or by AI, private replies, and moderation actions (hiding, unhiding, or deleting comments). To draft and route replies, AI classifies each message (for example by topic, sentiment, and whether it needs a person). Messages may contain any information your customers choose to share. We process this data on your behalf as your processor (see Section 1.2). The inbox can also include: - **WhatsApp and Telegram chats**, if you connect a WhatsApp Business number or a Telegram group: the sender's name or username, phone number (WhatsApp), the messages and attachments, timestamps, and your replies. WhatsApp replies are only possible within the 24-hour window WhatsApp allows after a customer's last message. - **Customer reviews** of your Google Business Profile and Facebook Page, if you connect them: the reviewer's display name and profile picture, star rating, review text, date, location name, and your public replies. We also use your reviews to write a short summary in your brand profile of what guests praise or complain about. That summary does not name or quote reviewers. ### 2.6 Publicly Available Data for Brand Analysis When you ask us to analyse a brand, we collect publicly available information from: - The website you give us (page text and images) - Public Instagram profiles, posts, and reels of your account and of reference accounts you choose (profile details, captions, images, videos, and engagement counts) - Public trending content on Instagram and TikTok found by keyword search, and public videos from TikTok profiles you choose, used for trend research and to suggest hooks for reels This can include personal data about the owners of those accounts and people who appear in public posts. We use it only to build your brand analysis, research trends, and suggest or prepare content for you. If you choose to use third-party images or videos found this way as references or content, you are responsible for having the rights to do so (see Section 3.5 of the [Terms of Service](/legal/terms-of-service.md)). If you are one of those people, see Section 8 for your right to object. ### 2.7 Billing Data **Paddle** is our reseller and Merchant of Record, and it collects your payment details directly. We do not receive or store your full card number. From Paddle we receive your customer and subscription IDs, plan, subscription status, billing period, transaction IDs, amounts, currency, country, and refund or chargeback status. ### 2.8 Balance and Usage Data - Your USD balance, and a ledger of each charge, refund, and top-up (feature, unit price, quantity, plan, and time) - Generation requests, job status, and errors - Feature usage and settings, such as autopilot, publishing mode, and schedule ### 2.9 API and MCP Data - API key labels, scopes, expiry dates, creation and last-used times. We store only a cryptographic hash of each key, never the key itself. - Requests made through the MCP server or API, approval records for sensitive actions, and idempotency records used to prevent duplicate actions ### 2.10 Technical Data - IP address, browser type, device and operating system, and server logs - Error and performance reports. When error monitoring is enabled, these reports are linked to your user ID and email address so that we can fix problems affecting your account. - Usage analytics from our websites and the web app, collected with Google Analytics: pages and screens viewed, how you arrived (the referring website and any campaign tags in the link), device and browser type, approximate location (country and city, estimated from your IP address), and events such as signing up or signing in. It is linked to a random identifier stored in a cookie, not to your name or email address. See Section 13. - The page through which you first arrived at our website, the referring website and any campaign tags (the "first-visit" information described in Section 13). If you create an account, we save this information to your account. ### 2.11 Communications Emails and messages you send us, and our replies. We also send you service emails, such as a welcome email when you sign up and a notice when your free trial balance is running low, through our email provider (see [Subprocessors](/legal/subprocessors.md)). To send them we use your email address and first name. --- ## 3. How We Use Personal Data and Our Legal Bases If you are in the EU, the UK, or another country with similar laws, we rely on the following legal bases: | Purpose | Data | Legal basis | |---|---|---| | Create and run your account, sign you in | Account data | Contract | | Analyse your brand, build your strategy, generate content | Business and brand data, your content, public brand data | Contract; legitimate interests (for public data about third parties) | | Schedule and publish content, retrieve performance data | Connected account data, your content | Contract | | Inbox, AI replies, and comment moderation | Comments and messages | Processing on your instructions as your processor | | Manage your balance, subscriptions, top-ups, and refunds | Billing data, balance and usage data | Contract; legal obligation (accounting) | | Provide the MCP server and API | API and MCP data | Contract | | Keep the Service secure, prevent fraud and abuse, enforce fair use | Technical data, usage data, API data | Legitimate interests | | Fix errors and improve the Service using aggregated statistics | Technical data, usage data | Legitimate interests | | Measure how visitors find and use our websites and app, and which pages lead to sign-ups | Usage analytics and first-visit information (Section 2.10) | Legitimate interests. We do not run analytics or set the first-visit cookie for visitors we identify as being in the EU, the UK, or Switzerland (see Section 13) | | Send service, billing, and security messages, including welcome and low-trial-balance emails | Account data | Contract; legitimate interests | | Send product news and offers | Email address | Consent, or legitimate interests where the law allows for existing customers. You can unsubscribe at any time | | Comply with the law and respond to lawful requests | Any relevant data | Legal obligation | | Establish, exercise, or defend legal claims | Any relevant data | Legitimate interests | Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for more information, and you can object (see Section 8). --- ## 4. AI Processing ### 4.1 What We Send to AI Providers To generate content, we send the relevant inputs to AI model providers: your prompts, brand information, reference images, uploaded photos, and, for AI replies, the message being answered. All text, image, video, and music generation runs through our inference provider, **Runware**, which routes requests to models from DeepSeek (text, analysis, and strategy), MiniMax, Google (Gemini, for transcribing speech in videos), OpenAI, xAI, ByteDance, and Alibaba (Qwen), and to models Runware hosts itself. The current list is on our [Subprocessors](/legal/subprocessors.md) page. ### 4.2 No Training on Your Data We do not use your content, outputs, or messages to train AI models, and we use AI providers under API terms that do not allow them to train on the data we send. Providers may keep inputs and outputs for a limited time for abuse monitoring, as described in their terms. ### 4.3 No Automated Decisions with Legal Effects We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated checks for fraud, abuse, or fair use may flag an account, but a person reviews any decision to suspend or terminate it. ### 4.4 Accuracy AI outputs can be wrong. Please review content before publishing it, and tell us if an output contains inaccurate personal data about you. --- ## 5. How We Share Personal Data We share personal data only as described below. **We do not sell personal data, and we do not share it for cross-context behavioural advertising.** ### 5.1 Service Providers (Subprocessors) We use service providers for hosting, databases, storage, authentication, AI generation, social publishing, brand analysis, error monitoring, and rendering. They process personal data only on our instructions. The full list, with what each provider does and where, is on our [Subprocessors](/legal/subprocessors.md) page. ### 5.2 Social Platforms, at Your Direction When you publish, we send your content to the platforms you choose, and it becomes subject to their privacy policies and is visible to their users according to your account settings. Meta, TikTok, and LinkedIn act as independent controllers of the data they receive. To let platforms fetch your media when publishing, we store it at a hard-to-guess public web address. Anyone who has that address can view the file, just as anyone can view the post once it is published. ### 5.3 Paddle Paddle processes your payment and billing data as an independent controller and Merchant of Record under its [Privacy Policy](https://www.paddle.com/legal/privacy). ### 5.4 AI Agents You Connect If you connect an AI agent or agent platform through our MCP server or API, we send it the data it requests within the scopes you grant. Its provider's terms and privacy policy govern that data. ### 5.5 Legal and Safety We may disclose data if required by law or a valid legal process, or to protect the rights, safety, or property of our users, the public, or FoodPerfect, including to report illegal content. ### 5.6 Business Transfers If FoodPerfect is reorganised into a company, merged, acquired, or sells its assets, personal data may transfer to the successor, which will be bound by this policy or will notify you of changes. --- ## 6. Platform-Specific Commitments ### 6.1 Meta (Instagram and Facebook) We use data from Meta's platforms only to provide the features you use: connecting accounts, publishing, performance reporting, and managing comments and messages in the inbox. We do not sell Meta platform data, use it for advertising or profiling, or use it to train AI models. We delete it when it is no longer needed for those features, when you disconnect, or when you ask us to (see Section 12). ### 6.2 TikTok and LinkedIn We use TikTok and LinkedIn data only to publish content you approve, show you your publishing status and performance, and manage comments and messages in the inbox where you enable it. We do not sell it, use it for advertising, sales prospecting, recruiting, or lead generation, or combine it with data from other sources to build profiles of people, and we store it no longer than each platform's terms allow. ### 6.3 Google We use Google Sign-In only to authenticate you, receiving your name, email address, and profile picture. We do not request access to your Gmail, Drive, YouTube, or other Google account data. FoodPerfect's use and transfer of information received from Google APIs adheres to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. --- ## 7. Data Retention We keep personal data only as long as we need it for the purposes described in this policy. | Data | Retention | |---|---| | Account data, brand data, uploads, and outputs | Until you delete them or your account. Deleted within 30 days of account deletion | | Connected account data | Until you disconnect the account or delete your FoodPerfect account. On disconnection, tokens are revoked or deleted and we stop collecting data. Records of posts already published remain in your content calendar until you delete them. The connection history described in Section 2.4 is kept until you delete your FoodPerfect account | | Comments, messages, chats, and reviews (inbox) | While the account is connected and the inbox is enabled, or for any shorter period a platform requires (for example, LinkedIn limits how long comment and member data may be stored). Deleted within 30 days after you disconnect the account, switch off the inbox, or delete your FoodPerfect account | | Public brand-analysis data | As part of your brand profile, until you re-run the analysis, delete the profile, or delete your account | | Balance ledger and billing records | For as long as required for accounting, tax, and dispute purposes, usually up to [TBD: 7] years | | API key records and MCP approval records | Until the key is deleted or your account is deleted. Idempotency records are kept for about 24 hours | | Server logs and error reports | Up to 90 days, unless needed longer to investigate a security incident | | Usage analytics (Google Analytics) | Up to 14 months, after which Google Analytics deletes the event data. Aggregated reports without identifiers may be kept longer | | First-visit information | The first-visit cookie expires after 180 days. If you sign up, the copy saved to your account is kept with your account data | | Support communications | Up to 3 years after the conversation ends | Deleted data may remain in backups for a short period until it is overwritten. Content already published to a social platform stays there until you delete it on that platform. --- ## 8. Your Rights Depending on where you live, you may have the right to: - **Access** your personal data and receive a copy - **Correct** inaccurate data - **Delete** your data - **Restrict** processing - **Receive your data in a portable format** - **Object** to processing based on legitimate interests, including brand analysis of public data about you - **Withdraw consent** where processing is based on consent, without affecting earlier processing - **Lodge a complaint** with a data protection authority, such as the authority in your country of residence To exercise your rights, email **privacy@foodperfect.ai** from your account email address. We may need to verify your identity. We will respond within one month, which may be extended where the law allows. You can also delete many kinds of content yourself in the app, and disconnect social accounts at any time. If your data was processed on behalf of one of our business customers (for example, a message you sent to a restaurant), please contact that business first. --- ## 9. Additional Information for US Residents This section applies to residents of California and other US states with comprehensive privacy laws, to the extent those laws apply to us. - **Categories collected (last 12 months)**: identifiers (name, email, IP address, account IDs); commercial information (plan, purchases, balance); internet activity (usage and logs); audio-visual information (images and videos you upload or generate); professional information (business details); and inferences (brand profile). Sources, purposes, and recipients are described in Sections 2 to 5, and retention in Section 7. - **Sensitive personal information**: we do not use or disclose it for purposes that would give you a right to limit its use. - **No sale or sharing**: we do not sell personal information or share it for cross-context behavioural advertising, and have not done so in the last 12 months. We use Google Analytics only to measure our own websites and app, with its advertising features switched off. We do not knowingly sell or share data of consumers under 16. - **Your rights**: to know, access, correct, and delete your personal information, and not to be discriminated against for exercising these rights. You can use an authorised agent, and we may verify your request and the agent's authority. - **How to exercise them**: email **privacy@foodperfect.ai**. --- ## 10. International Transfers We are based in [TBD: Georgia], and our main infrastructure runs on Google Cloud in the United States. Our providers may process data in the United States, the United Kingdom, the EU, and other countries (see [Subprocessors](/legal/subprocessors.md)). When we transfer personal data from the EU, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the recipient is certified. You can ask for more information at privacy@foodperfect.ai. --- ## 11. Security We use technical and organisational measures appropriate to the risk, including: - Encryption in transit (TLS) and at rest (Google Cloud) - Access rules that restrict each user's data to that user - Secrets and provider keys kept in a secrets manager, never in the browser - Hashed API keys with scopes, expiry, revocation, and per-key rate limits, plus a two-step approval for sensitive agent actions such as publishing and deleting - Signature verification of incoming webhooks from payment and publishing providers - Restricted administrative access, based on least privilege No system is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the authorities where the law requires it. --- ## 12. Deleting Your Data, Including Meta-Connected Data ### 12.1 Delete Your Account Email **privacy@foodperfect.ai** or **support@foodperfect.ai** from your account email address and ask us to delete your account. We will delete your account and associated data within 30 days, except records we must keep by law (see Section 7). Download any outputs you want to keep first. ### 12.2 Delete Facebook or Instagram Data You can remove FoodPerfect's access at any time in your Facebook or Instagram settings, or disconnect the account in FoodPerfect. To ask us to delete the data we obtained through Meta's platforms, follow the instructions on our [Data Deletion page](https://app.foodperfect.ai/data-deletion) or email **privacy@foodperfect.ai** with the subject line **"Meta Data Deletion Request"**, including: - Your FoodPerfect.ai account email address - The Facebook or Instagram account or handle you connected - Any Facebook Page or Instagram professional account you connected After verifying your request, we will delete or disconnect the Meta-connected data associated with your account, such as account identifiers, access tokens, connected page references, and publishing and performance metadata, within 30 days. We may keep limited records where the law requires it or for security, fraud prevention, or dispute resolution. ### 12.3 TikTok and LinkedIn You can revoke FoodPerfect's access in your TikTok or LinkedIn settings, disconnect the account in FoodPerfect, or email privacy@foodperfect.ai, and we will delete the related data in the same way. --- ## 13. Cookies and Similar Technologies We keep tracking to a minimum and run no advertising cookies or pixels. - **Strictly necessary storage**: Firebase Authentication stores your sign-in session in your browser's local storage (IndexedDB) so that you stay signed in. The Service does not work without it. - **Strictly necessary preferences**: our websites remember in your browser's local storage that you dismissed the cookie notice, and the developer docs remember your chosen theme and code tab. - **Analytics (Google Analytics)**: our website foodperfect.ai and the web app use Google Analytics to count visits and to see which pages lead people to sign up. It sets first-party cookies (`_ga` and `_ga_`, which last up to 2 years) holding a random identifier, and receives your IP address, which Google uses to estimate your approximate location and does not store. Advertising features are switched off: no advertising cookies, no ad personalisation, no remarketing, and no Google signals. - **First-visit cookie (`fp_ft`)**: on your first visit to foodperfect.ai we store, for 180 days, the page you landed on, the referring website and any campaign tags in the link (such as `utm_source`). If you sign up, we save this to your account so we can see which pages bring new customers. It does not contain your name, email address, or any other identifier. - **Visitors in the EU, the UK, and Switzerland**: when your browser is set to a European time zone, our websites and the web app do not load Google Analytics or set the first-visit cookie. As a second safeguard, Google Analytics is configured not to store analytics cookies for visitors it locates in the European Economic Area, the UK, or Switzerland. We will only run analytics for these visitors after asking for, and receiving, consent. - **Opting out**: you can block or delete cookies for foodperfect.ai in your browser settings, or install Google's [opt-out browser add-on](https://tools.google.com/dlpage/gaoptout). - **Hosting and network providers**: our website foodperfect.ai is hosted by Hostinger, and traffic to the web app passes through Cloudflare. They receive your IP address and request details to deliver pages and protect against attacks. - **Third-party resources**: the app loads fonts from Google Fonts and some images from a content delivery network, which receive your IP address to deliver them. Checkout runs Paddle's checkout in a window on our site; Paddle may set its own cookies under its [Cookie Policy](https://www.paddle.com/legal/cookie-policy). - **Error monitoring**: when enabled, our error monitoring provider receives technical information about errors in your browser. It does not set advertising cookies. If we add other non-essential cookies in the future, we will update this policy and ask for your consent where the law requires it. --- ## 14. Children The Service is for businesses and people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact privacy@foodperfect.ai and we will delete it. --- ## 15. Changes to This Policy We may update this policy from time to time. We will post the new version with a new "Last Updated" date and, for material changes, notify you by email or in the app before the changes take effect. --- ## 16. Contact **FoodPerfect.ai** Georgy Bdoyan, operating as FoodPerfect [TBD: registered address] Privacy: **privacy@foodperfect.ai** Website: [https://foodperfect.ai](https://foodperfect.ai) --- *This Privacy Policy is effective as of the Last Updated date above.*