Privacy Policy
Last updated: 15 March 2026
Mangio is committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and your rights under the EU General Data Protection Regulation (GDPR).
1. Who We Are & Data Controller
The data controller responsible for your personal data is Mangio, operating from Denmark. For all privacy-related enquiries, contact our data privacy team at privacy@mangio.app.
2. Data We Collect
We collect the following categories of personal data:
| Identity & contact | Name, email address, account credentials |
| Dining preferences | Saved cuisines, dietary requirements, favourite restaurants, taste profile |
| AI interaction data | Search queries, chat messages, recommendation results, feedback signals |
| Usage & device data | Pages visited, features used, browser type, operating system, session timestamps |
| Location data | Approximate city location (only with your explicit consent, not continuously tracked) |
| Payment data | Billing information processed by Stripe — we do not store card numbers |
We do not collect special category data (health, religion, ethnicity, etc.). Dietary preference data you voluntarily enter (e.g. "vegan", "gluten-free") is used solely to personalise restaurant results and is never shared with third parties for marketing.
3. How We Use Your Data
- Providing the Service: Account management, search, personalised AI recommendations, and subscription management.
- Improving the Service: Aggregated, anonymised analysis of search patterns to improve recommendation quality.
- Security: Detecting and preventing fraud, abuse, and unauthorised access.
- Communications: Transactional emails (account verification, password reset, subscription receipts). Marketing emails only with your explicit opt-in consent.
- Legal obligations: Complying with applicable Danish and EU law.
4. Legal Basis for Processing (GDPR Art. 6)
| Contract performance | Processing necessary to provide your account and the Service you signed up for |
| Legitimate interests | AI personalisation based on in-session behaviour, security monitoring, service analytics — balanced against your rights |
| Consent | Location access, optional marketing emails, any processing not covered above — you may withdraw at any time |
| Legal obligation | Retaining transaction records for tax and accounting purposes |
5. Data Sharing with Third Parties
We share personal data with the following categories of trusted processors under GDPR-compliant data processing agreements. We do not sell your personal data.
| Supabase (Ireland/EU) | Database hosting and authentication infrastructure |
| Vercel (US — SCCs in place) | Application hosting and edge delivery |
| Meilisearch (EU) | Search index — queries and embeddings processed |
| Google (US — SCCs in place) | Gemini AI models used for search reranking and recommendations |
| OpenAI (US — SCCs in place) | Embedding generation for semantic search personalisation |
| Stripe (Ireland/EU) | Subscription payment processing |
| Sentry (US — SCCs in place) | Error monitoring (anonymised stack traces) |
SCCs = Standard Contractual Clauses, the EU-approved mechanism for lawful data transfers to third countries.
7. AI & Automated Decision-Making
Mangio is an AI-first product. Here is exactly how AI processes your data:
Search & Recommendations
When you submit a query, your text is passed to Google Gemini (our AI orchestrator) which selects and executes a search strategy. Results are retrieved from our Meilisearch index and reranked by a second Gemini model using your query context and, if you have set them, your saved dietary preferences. This process constitutes automated personalisation under GDPR Article 22.
This personalisation does not produce legal or similarly significant effects — it influences which restaurants are shown to you, not decisions that affect your rights or access to services. You may opt out of preference-based personalisation at any time by clearing your taste profile in your account settings.
Embedding & Taste Profile
If you have enabled personalisation, we generate a mathematical embedding (a vector of numbers) from your expressed dining preferences using OpenAI's embedding model. This vector is stored in your account and blended with your search queries to improve result relevance. It contains no readable text — it is a numerical representation only.
Model Training
We do not use EU residents' personal data to train generative AI models. Search queries may be logged in anonymised, aggregated form for the purpose of improving our own search pipeline (e.g. tuning ranking weights). Identifiable queries are not shared with any AI provider for model training.
Human Review
AI recommendations are suggestions, not decisions. No automated process makes decisions that produce legal effects on you. Restaurant discovery results are always presented as information for you to act on freely.
8. Data Retention
- Active accounts: Data is retained for as long as your account remains active.
- After account closure: We retain data for up to 2 years after your last activity to allow account re-activation and to comply with legal obligations, then permanently anonymise or delete it.
- Payment records: Retained for 5 years as required by Danish bookkeeping law.
- Search logs: Aggregated and anonymised within 90 days; identifiable logs deleted within 12 months.
9. Your GDPR Rights
As a data subject under the GDPR, you have the following rights:
| Right to access | Request a copy of all personal data we hold about you |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion of your data ('right to be forgotten') |
| Right to restriction | Ask us to pause processing while a dispute is resolved |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests, including AI profiling |
| Right to withdraw consent | Withdraw any consent at any time without affecting prior processing |
To exercise any of these rights, email us at privacy@mangio.app. We will respond within 30 days. You also have the right to lodge a complaint with the Danish data protection authority, Datatilsynet (datatilsynet.dk), if you believe we have not handled your data lawfully.
10. Contact & Privacy Enquiries
For any privacy-related questions, data subject requests, or concerns, please contact:
We aim to acknowledge all privacy requests within 5 business days and resolve them within 30 calendar days.