Privacy Policy

1. Who is responsible

The controller for your data is Gastroexpress GmbH, Rosenheimer Str. 30-32, 81669 München, Germany — operator of Pizza911.ai. Contact: [email protected]. Full company details are in the Impressum.

2. What we collect

• Delivery address you enter (validated via Google Maps) and, if you allow it, your approximate location to suggest the address.
• Order details — pizza size and count, dietary split, salads, drinks, delivery time, and messages you send to the in-page assistant.
• Business email and company domain used to confirm the order and issue the invoice.
• Technical data — a hashed IP address and basic device/browser information, to prevent abuse.

3. Signing in with Google or Microsoft

If you choose “Continue with Google” or “Continue with Microsoft”, that provider shares with us your email address, your name, and a unique account identifier so we can verify your work email and create your business account. We never receive your password, and we request only basic profile and email scopes — no access to your mailbox, files, contacts or calendar.

We use this data solely to authenticate you and run your order; we do not use Google or Microsoft account data for advertising. Their handling of your data is governed by the Google Privacy Policy and the Microsoft Privacy Statement. Personal email domains (Gmail, Outlook, etc.) are not accepted — Pizza911 is for business accounts.

4. Why we use it (legal basis)

To plan, take payment for and invoice your order, and to arrange delivery — performance of a contract (Art. 6(1)(b) GDPR). To keep the service secure and prevent abuse, and to verify business use — our legitimate interests (Art. 6(1)(f) GDPR).

5. Who we share it with

• The restaurant fulfilling your order — the delivery address, order contents and a contact, so it can prepare and deliver it with its own fleet.
• Service providers acting on our instructions — hosting and database (Supabase), transactional email (Resend), address validation (Google Maps), and the payment provider that processes your payment. We do not sell your data.

6. Retention

We keep order and account data for as long as needed to provide the service and to meet legal/tax retention duties (in Germany, up to 10 years for invoices). Abuse-prevention logs are kept only briefly.

7. Your rights

You may request access, rectification, erasure, restriction, or portability of your data, and object to processing based on legitimate interests. Email [email protected]. You also have the right to complain to a data-protection authority.