Legal

Who this policy covers

This policy explains how FraudBite handles personal data about people who visit this website or use the service. When a restaurant uploads a complaint photo, the restaurant decides why that photo is checked: it is the controller of that data and FraudBite processes it on the restaurant’s behalf, as set out in the Data Processing Agreement. For anything about your data, write to [email protected].

What we collect

Account details (name, email, company, billing address); the complaint photos you upload and the metadata embedded in them; the case details you add (food cost, what the customer claimed, notes); billing records (card payments are handled by Stripe: we never see full card numbers); the record of when you accepted our terms; messages you send us through the contact or early-access forms; and, only if you accept analytics cookies, anonymous usage statistics. We do not sell your data.

Why we use it

To run the account of the business you work for and provide the service it signed up for (our contract with that business, and our legitimate interest in serving its users); to bill and keep the records tax law requires (legal obligation); to keep accounts secure, prevent abuse and answer messages you send us (legitimate interest); and to measure which pages are useful, only with your consent, which you can withdraw at any time. You need to give us an email address and your business details to create an account; without them we can’t provide the service. Everything else is optional.

Your right to object

Where we rely on legitimate interest, you can object at any time, for reasons relating to your situation, by writing to [email protected]. We then stop, unless we have compelling legitimate grounds or need the data to establish or defend legal claims.

Who processes it for us

We use a short list of providers, each only for its part of the service:

• Google Cloud / Firebase (Google): database, photo storage and servers in the EU (Frankfurt, europe-west3). Sign-in (Firebase Authentication) and website hosting may process data in the USA, under the EU-US Data Privacy Framework.
• TruthScan (USA): image analysis. Each photo you check is uploaded to TruthScan’s storage in New York, where the score and heatmap are produced. TruthScan is not certified under the EU-US Data Privacy Framework; the transfer rests on the Standard Contractual Clauses in TruthScan’s data processing agreement. TruthScan also uses the photos it receives to train and improve its detection models. For that use TruthScan acts on its own behalf, under its own terms, not on our instructions.
• Google Cloud Translation (Google): translates the names of detected features. No photos are sent.
• Stripe: subscriptions, payments and invoices, under the EU-US Data Privacy Framework for data processed in the USA.
• Google Workspace (Google): email (account and billing notices, and the messages you send us).
• Google Analytics 4 (Google, through Firebase): visit statistics, only if you accept analytics cookies, under the EU-US Data Privacy Framework.
• Frankfurter (api.frankfurter.dev): daily exchange rates so the dashboard can show amounts in your currency. Your browser asks for them directly, so the service sees your IP address; no account data is sent.

Transfers outside the EU

Some providers above process data outside the European Economic Area. Google and Stripe are certified under the EU-US Data Privacy Framework, and their contracts also include the European Commission’s Standard Contractual Clauses. TruthScan’s transfer rests on the Standard Contractual Clauses. Write to [email protected] for a copy of the safeguard that applies.

How long we keep it

Account details for as long as your account exists. Photos and results until you delete your account, or sooner if you ask us to delete specific analyses; the copy uploaded to TruthScan is kept under TruthScan’s own terms, including for training its models, and deleting an analysis or your account in FraudBite doesn’t remove it. Billing records for as long as accounting and tax law requires. Messages you send us for up to two years. Analytics data for the period set in Google Analytics, at most 14 months.

How we protect it

Data is encrypted in transit (HTTPS) and at rest in Google Cloud. Photos are shown only through short-lived signed links, and each account can only read its own analyses.

Your rights

Under the GDPR you can ask for a copy of the personal data we hold, have it corrected or deleted, receive it in a portable format, restrict or object to how it is processed, and withdraw consent at any time (for analytics, use “Cookie settings” at the bottom of any page). Email [email protected] and we answer within one month; if a request is complex or we receive many, we may take up to two more months and tell you why within the first month. You can also complain to your data-protection authority: in Romania, ANSPDCP.