Privacy Policy

1. About this Policy

This Privacy Policy explains how B2L SOLUÇÕES DE TECNOLOGIA LTDA – DEGUSTAÍ, registered under CNPJ No. 63.546.053/0001-22, processes personal data related to the Degustaí website, the administrative platform, digital menus made available through the solution, and other interactions with its services.

For the purposes of this Policy, we use the term “Degustaí” to refer to B2L SOLUÇÕES DE TECNOLOGIA LTDA and the services it provides.

Channel for exercising rights and addressing privacy-related matters:

contato@degustai.app

2. Who this Policy applies to

This Policy may apply to:

• visitors to the Degustaí institutional website;
• owners, representatives, and employees of client restaurants;
• users of the administrative dashboard;
• people who access digital menus made available by the platform;
• people who contact us for service, support, demonstrations, or commercial matters;
• suppliers, partners, and other people who maintain a relationship with us.

3. Degustaí's role in data processing

The role performed by Degustaí depends on the processing operation carried out.

Degustaí acts as Controller when it determines the purposes and essential means of processing carried out for its own activities, such as account administration, authentication, security, management of the commercial relationship, support, billing, compliance with legal obligations, and defense of rights.

In certain operations carried out through the platform, the client restaurant may determine the purposes of the processing. In these situations, the restaurant may act as Controller and Degustaí as Processor, processing data within the limits necessary to provide the service and in accordance with applicable instructions.

The same organization may perform different roles in different processing operations.

4. Data that may be processed

Depending on the use of the services, Degustaí may process the following categories of data:

Administrative user data

• name and email address;
• user identifiers;
• restaurant or organization to which the user is linked;
• profile or access level;
• authentication and session data;
• records of access and actions performed on the platform.

Restaurant representative and commercial contact data

• name;
• company or establishment;
• job title or role;
• telephone;
• WhatsApp;
• email;
• information provided during negotiation, contracting, service, or support.

Data related to the use of digital menus

Degustaí may record information related to the use of menus, including:

• IP address;
• date and time;
• browser and technical device information;
• referring address;
• language;
• pseudonymous session identifier;
• restaurant accessed;
• dishes viewed;
• favorites;
• interactions with suggestions;
• interactions with menu features;
• clicks on certain external links.

These records may make it possible to correlate different events that occurred during the same session and, therefore, are not treated in this Policy as necessarily anonymous data.

Data stored in the browser

The platform uses cookies, session storage, and similar technologies for features such as:

• authentication;
• session maintenance;
• selection of the active restaurant;
• language preferences;
• favorites;
• local bill calculation;
• interface operation;
• pseudonymous identification of a menu session;
• prevention of duplicate records of certain events.

More information is available in the Cookies and Similar Technologies Policy.

Content provided by restaurants

Restaurants may enter information on the platform such as:

• name;
• address;
• telephone;
• logo;
• photographs;
• menu;
• descriptions;
• prices;
• promotional materials;
• other content necessary to use the platform.

When these materials contain personal data of third parties, the restaurant is responsible for having an appropriate legal basis or authorization for their use.

5. How data is used

Data may be processed for purposes such as:

• creating and administering accounts;
• authenticating users and controlling access;
• providing contracted services;
• making digital menus available and operating them;
• responding to requests and providing support;
• managing commercial relationships;
• maintaining platform security;
• preventing unauthorized access, fraud, and abuse;
• producing metrics related to the use of services;
• understanding the performance and use of features;
• improving the product and user experience;
• complying with legal and regulatory obligations;
• exercising or defending rights.

The applicable legal bases will be defined according to the specific operation and may include performance of a contract and related procedures, compliance with a legal or regulatory obligation, legitimate interest, regular exercise of rights, and other grounds provided for by law.

When processing is based on legitimate interest, the necessity of the operation, its purpose, and the rights and expectations of data subjects will be considered.

6. Menu analytics

Degustaí records certain events related to menu use so that restaurants can understand interaction with their content and features.

These events may include views of menus and dishes, favorites, interactions with suggestions, language changes, use of certain features, and clicks on external links.

Some events are associated with a pseudonymous session identifier, allowing actions performed during the same session to be related.

Degustaí does not currently use external behavioral advertising tools or advertising pixels for this proprietary analytics.

7. Artificial intelligence

Some administrative features use artificial intelligence services to assist with tasks such as:

• creating and improving descriptions;
• translating content;
• processing and improving images;
• analyzing certain menu files.

To perform these features, the content necessary for the request may be sent to the relevant technology provider.

Depending on the feature, this may include text, images, or files submitted by the user.

The restaurant should avoid submitting personal data of third parties that is not necessary for the purpose of the tool.

Results produced by automated systems may contain errors and should be reviewed before publication, especially when they involve information relevant to consumers.

8. Sharing with suppliers

Degustaí uses technology suppliers necessary to operate the services, which may include services for:

• hosting and infrastructure;
• database;
• authentication;
• storage;
• image and video processing and delivery;
• artificial intelligence;
• sending communications;
• customer service;
• other technical services necessary for the platform.

Sharing must be limited to the information necessary for the relevant purpose.

Data may also be shared when necessary to comply with a legal obligation, an order from a competent authority, or the regular exercise of rights.

9. International transfers

Some technology suppliers used by Degustaí may involve data processing in other countries.

When personal data is transferred internationally, mechanisms permitted by applicable law will be observed, including adequacy decisions, appropriate contractual clauses, or other legally provided instruments.

The main database currently used by Degustaí is hosted in a Brazilian region.

10. Data retention

Data is retained for the period necessary for the relevant purposes, considering operational, contractual, and legal needs.

Different categories of data may have different retention periods.

Certain information may be preserved when necessary for:

• compliance with a legal or regulatory obligation;
• security;
• prevention and investigation of incidents;
• regular exercise of rights;
• performance or defense of contracts.

Deletion of data from the operational environment does not necessarily imply the immediate deletion of all existing copies in backup systems, which may follow their own technical retention cycles.

When Degustaí acts as Processor, the retention and deletion of data processed on behalf of the restaurant will also follow the conditions established in the relevant contractual relationship.

11. Security

Degustaí adopts technical and administrative measures intended to protect personal data against unauthorized access, loss, alteration, improper disclosure, and other forms of improper or unlawful processing.

The measures adopted are evaluated considering the nature of the information, the risks involved, and the evolution of the platform.

No service connected to the internet can guarantee absolute security.

12. Data subject rights

Under applicable law, the data subject may, depending on the situation:

• request confirmation that processing exists;
• request access to their data;
• request correction of incomplete, inaccurate, or outdated data;
• request anonymization, blocking, or deletion in the cases provided by law;
• request portability when applicable;
• obtain information about data sharing;
• obtain information about the possibility of refusing consent and its consequences, when applicable;
• withdraw consent when it is the basis used;
• request deletion of data processed based on consent, when appropriate;
• object to certain processing in the cases provided by law;
• request review of decisions made solely on the basis of automated processing that affect their interests, when applicable;
• file a petition with the Brazilian National Data Protection Authority.

Requests may be sent to:

contato@degustai.app

When a request relates to an operation in which a restaurant is the Controller, it may be necessary to involve the relevant establishment in responding to the request.

Requests for confirmation of processing and access will be answered within the time limits provided by applicable law.

13. Children and adolescents

Digital menus are accessible to the general public, including in environments frequented by children and adolescents.

Degustaí seeks to limit data collection to what is necessary for the operation and use of its features and does not currently provide consumer accounts on the public menu.

The platform currently has no behavioral advertising directed at children or adolescents, consumer chat, or permanent consumer profile.

Processing involving children and adolescents will be evaluated according to the requirements and safeguards provided by applicable law.

14. Changes to this Policy

This Policy may be updated to reflect legal, regulatory, or operational changes or changes to Degustaí's features.

The current version and its update date will remain available on this page.

15. Contact

B2L SOLUÇÕES DE TECNOLOGIA LTDA – DEGUSTAÍ

CNPJ: 63.546.053/0001-22

Channel for privacy-related matters and the exercise of rights:

contato@degustai.app