1. Data controller
Caitering.ai ("we", "us") is operated by Käftsmäll Online AB, reg. no. 559529-1799, Pilgatan 4, 212 12 Malmö, Sweden, which is the data controller for the processing of your personal data under the EU General Data Protection Regulation (GDPR).
Contact: hej@caitering.ai
2. What data we collect
We collect the following personal data:
- Customers: Name, email address, phone number, event information (date, number of guests, location, budget, wishes)
- Caterers: Company name, contact person's name, email, phone, website, area of operation, description, menu categories
- Technical data: IP address, browser type, device information, geographic location (if you allow it), interactions with the site
- Payment details: Handled by Stripe. We never store card numbers
- Waitlist: Email address, market (e.g. the US), city if you give one, whether you are a customer or a caterer, language version, and when you gave and confirmed your consent
- Contact form: Name, email address, topic and your message
- Cookies: See our cookie policy
3. Why we process your data
We process your personal data to:
- Match customers with relevant caterers
- Send requests, offers and confirmations by email
- Handle payments via Stripe
- Send information about the service and let you know when Aiya opens near you, if you have joined the waitlist
- Answer questions you send through the contact form
- Protect our forms against spam and abuse (reCAPTCHA and limits on the number of attempts)
- Improve the platform's functionality and security
- Comply with legal requirements (e.g. the Swedish Bookkeeping Act)
4. Legal basis
We process your data on the following legal bases:
- Contract: To deliver the service you have requested
- Legitimate interest: To answer questions sent through the contact form, protect our forms against spam, and improve and secure the platform
- Consent: For the waitlist, marketing emails and cookies (can be withdrawn at any time)
- Legal obligation: For bookkeeping and tax requirements
5. How long we keep data
- Account information: As long as your account is active, plus 12 months
- Requests and offers: 24 months for history and dispute resolution
- Payment history: 7 years under the Swedish Bookkeeping Act
- Waitlist: Until Aiya opens near you and we have let you know, or until you withdraw your consent. Unconfirmed sign-ups are deleted after 30 days. Every email has an unsubscribe link, and you can also email hej@caitering.ai.
- Contact form: As long as needed to answer and follow up on your request, at most 12 months
- Abuse protection: Your IP address is used to limit the number of attempts and kept for at most one hour
- Cookies: According to our cookie policy
6. Who we share data with
We share data with the following trusted partners:
- Supabase (database): EU-based storage
- Vercel (hosting): USA, EU-US Data Privacy Framework
- Stripe (payments): Ireland, GDPR compliant
- Resend (email): USA, EU-US Data Privacy Framework
- Google Maps (maps): USA, EU-US Data Privacy Framework
- Microsoft Clarity (web analytics): USA, EU-US Data Privacy Framework (see section 7)
- Apify (web search): EU-based
- Google reCAPTCHA (spam protection on our forms): USA, EU-US Data Privacy Framework
- Upstash (limits on the number of attempts, IP address for at most one hour)
- Anthropic (translation of messages when a caterer has Premium, see below): USA, EU Standard Contractual Clauses (SCC)
- Caterers: Only the caterers you choose receive your contact details, after you have chosen their offer
We never sell your personal data to third parties.
When a caterer has Premium, Aiya translates the messages between the caterer and the customer, and the free text in the request, with the help of Anthropic. The text is then sent to Anthropic, which processes it as a data processor. The original and the translation are stored together with the request.
The contact form, the waitlist and caterer sign-up are protected by Google reCAPTCHA. reCAPTCHA assesses whether a form is sent by a human and processes, among other things, your IP address and information about your browser and how you use the page. Google's privacy policy and terms of service apply.
7. Web analytics and behavioral measurement (Microsoft Clarity)
We use Microsoft Clarity to understand how visitors use our website. Clarity collectsbehavioral data through first-party and third-party cookies and similar tracking technologies, and creates, among other things, heatmaps and session recordings (session replay) that show how pages are used, for example clicks, mouse movements and scrolling. We use the information to improve and optimize the website and for security and fraud prevention.
Clarity masks sensitive content by default. We only enable Clarity if you consent to analytics cookies in our cookie banner. You can decline or change your choice at any time via our cookie policy. We do not use Clarity for advertising and do not share what you type into forms for marketing purposes.
Microsoft processes this data as a data processor. For more information about how Microsoft collects and uses data, see the Microsoft privacy statement.
8. Transfers outside the EU/EEA
Some of our providers are based outside the EU/EEA. We ensure protection through the EU standard contractual clauses (SCC) or participation in the EU-US Data Privacy Framework.
9. Your rights under the GDPR
You have the right to:
- Be informed about how your data is processed
- Access your personal data (a copy of your data)
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict processing of your data
- Object to processing based on legitimate interest
- Receive your data in a portable format (data portability)
- Withdraw consent at any time
- Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se
To exercise your rights, contact us at hej@caitering.ai. We reply within 30 days.
10. Security
We use TLS encryption for all data transfer and secure storage with Supabase. Onlyauthorized staff have access to personal data. We carry out regular security reviews.
11. Changes
This policy may be updated. If there are material changes, we will let you know by email or with a notice on the site.
12. Contact
Questions about this policy or your personal data? Contact us at hej@caitering.ai