Privacy Policy

Last updated: September 30, 2026

This translation is provided for information only. Only the German version is legally binding: German version

This privacy policy informs you about which personal data we process when you visit this website, for what purposes and on what legal basis, and which rights you have. It applies to the Gastrify website, including the consultation form and the AI consultant. Separate privacy notices apply to the use of the Gastrify platform itself (portal and online shops of hospitality businesses).

1. Controller

Curry Masala Holding GmbH
Gerstenstr. 2
44139 Dortmund, Germany
Represented by: Rajeevan Mahalingam
Phone: 0800 0010428 (toll-free within Germany)
Email: gastrify@gastrify.de

If you have questions about data protection or wish to exercise your rights, please contact us using the details above.

2. Hosting and server log files

This website is operated by an external hosting provider that processes data on our behalf (Art. 28 GDPR).

Each time the website is accessed, the web server automatically stores information transmitted by your browser (server log files):

  • IP address
  • date and time of access
  • requested page or file and amount of data transferred
  • HTTP status code
  • referrer URL (the previously visited page)
  • browser and operating system used (user agent)

This processing is necessary to deliver the website, ensure its stability and security, and analyze errors. The legal basis is our legitimate interest in secure and reliable operation (Art. 6 (1) (f) GDPR). Log files are deleted automatically after 14 days unless they are needed for longer to investigate a specific security incident.

3. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the padlock symbol and "https://" in your browser's address bar. Data you transmit to us cannot be read by third parties.

4. Cookies and consent

We only use technically necessary cookies:

  • gastrify_consent stores your choice in the cookie banner (whether you have consented to the use of Google and AI services) and when you made it, so that we do not ask you again on every page and can respect your decision. Storage period: 6 months, after which we ask again.
  • gastrify_onboarding links a registration you have started (section 8) to your browser so you can continue after reloading the page. It only contains a random identifier. Storage period: 30 days.
  • gastrify_lang stores the website language you selected or that was detected (e.g. "en") so that pages are shown in the same language on your next visit. Storage period: 12 months.

Storing these cookies is strictly necessary for the service you request and is therefore permitted without consent (Section 25 (2) no. 2 TDDDG, German Telecommunications Digital Services Data Protection Act). The associated processing is based on our legitimate interest in a user-friendly presentation (Art. 6 (1) (f) GDPR) and, for registration, on Art. 6 (1) (b) GDPR. We do not use analytics, tracking or advertising cookies. You can delete or block cookies in your browser at any time; the website will then be displayed in the automatically detected language.

Free hospitality apps

The free hospitality apps (e.g. cash count, counting sheet, tip calculator, invoice generator) calculate exclusively in your browser; your input is not sent to us, and PDFs are created directly on your device. So that nothing is lost when you reload the page, the apps store your input encrypted (AES-256-GCM) in your browser’s local storage (localStorage, key in IndexedDB): amounts, counts and invoice contents for 24 hours, your own details (e.g. your name or the sender details and logo in the invoice generator) until you delete them. This data does not leave your device. You can delete it at any time via “Delete saved data” in the respective app or by clearing the site data in your browser. Storage is necessary for the function you use (§ 25(2) no. 2 TDDDG).

Consent to Google and AI services

The AI consultant (section 7) and registration with automatic shop creation (section 8) send your input to Google (Places, Cloud Vision) and to the AI service fal.ai (with models such as Gemini and FLUX). Data may also be transferred to the USA. These transfers only take place after you have chosen “Accept all” in the cookie banner, enabled the category “Google & AI services”, or agreed to the corresponding notice directly in the AI consultant or registration (Art. 6(1)(a) GDPR). Without consent, these two features cannot be used; the rest of the website remains fully available. Our server checks your consent before every such transfer. You can withdraw your consent at any time with effect for the future by opening “Cookie settings” at the bottom of every page and disabling the category.

5. Contacting us by email or phone

If you contact us by email or phone, we process the information you provide (e.g. name, contact details and the content of your request) in order to handle your request. The legal basis is Art. 6 (1) (b) GDPR if your request relates to a contract or its initiation, and otherwise our legitimate interest in answering inquiries (Art. 6 (1) (f) GDPR). We delete the data once your request has been fully handled, unless statutory retention obligations apply.

6. Consultation form

You can request a personal consultation via the "Get free consultation" form. We process:

  • name, restaurant name, email address and phone number (required)
  • website address and additional information about your request (optional)
  • the selected language as well as the date and time of the request

We use this data to handle your request and contact you for the consultation you asked for. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures taken at your request) and your consent given via the checkbox in the form (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future.

Your request is sent to our team by email. For sending emails, we use the SendGrid service of Twilio Inc. (USA) as a processor (Art. 28 GDPR). Twilio Inc. is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

To protect against abuse (spam), we limit the number of requests per connection. For this purpose, we store an irreversible hash of your IP address for no more than 24 hours. The legal basis is our legitimate interest in protecting the form against automated requests (Art. 6 (1) (f) GDPR).

We delete your information once it is no longer needed to handle your request. If a contract is concluded, we retain the data for as long as required by commercial and tax retention obligations (up to ten years).

7. AI consultant (digitalization check)

The AI consultant on our homepage gives you a free, automated assessment of how digital your business is. It can only be used after you have consented to the use of Google and AI services (section 4). The following data is processed:

Searching for your restaurant

When you search for your restaurant, our server sends your search term to the Google Places API of Google Ireland Limited (Ireland). For the selected restaurant, we retrieve publicly available business data: name, address, phone number, website, category, Google rating and number of reviews. The request to Google is made by our server; your IP address is not transmitted to Google.

Your answers and the AI evaluation

We store your answers to the AI consultant's questions in our database together with a randomly generated session ID. To create short comments on your answers and your personal evaluation, we send your answers and the public business data to the AI service fal.ai of Features & Labels, Inc. (USA). It forwards the request via OpenRouter, Inc. (USA) to a language model (currently Google Gemini). Your contact details (name, email address, phone number) are not sent to the AI services. Please do not enter information about other people in free-text fields. Transfers to the USA are based on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) or, where the respective provider is certified, on the EU-US Data Privacy Framework (Art. 45 GDPR).

Contact details and delivery of the evaluation

To receive your evaluation, you provide your first name, last name, email address and optionally your phone number, and can indicate whether you would like a personal consultation. We send you the evaluation as a PDF by email and receive a copy ourselves so that we can contact you if you wish. Emails are sent via SendGrid (Twilio Inc., see section 6).

Legal basis, abuse protection and storage period

The legal basis for processing in the AI consultant is your consent (Art. 6 (1) (a) GDPR), which you give before submitting your contact details, and Art. 6 (1) (b) GDPR insofar as you request a consultation. You can withdraw your consent at any time with effect for the future, e.g. by email to gastrify@gastrify.de.

To protect against abuse and disproportionate costs, we limit the number of requests per IP address. For this purpose, the IP address is stored for no more than 24 hours (Art. 6 (1) (f) GDPR). We delete your answers, the evaluation and your contact details once they are no longer needed for the purposes stated, at the latest 24 months after your request or when you withdraw your consent.

The evaluation is a non-binding assessment. There is no automated decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

8. Registration and automatic shop creation

Via "Get started" you can register your restaurant. Gastrify automatically creates a draft of your restaurant shop from your details and uploaded documents. Because this uses Google and AI services, registration is only possible after your consent (section 4). We process:

  • your restaurant's details: name, address and optionally phone number – either entered by you or taken from Google (see below)
  • your choice of whether you want to offer reservations, ordering and delivery
  • the files you upload (e.g. menus, logo, flyers, photos), including file name, file type and size
  • to complete your Gastrify account: first and last name, email address, phone number and password (stored encrypted), as well as the time and version of the accepted terms and privacy policy

Searching for your restaurant

When you search for your restaurant, our server sends your search term to the Google Places API of Google Ireland Limited (Ireland) and retrieves publicly available business data for the selected restaurant: name, address, phone number, website, category, location and opening hours. The request is made by our server; your IP address is not transmitted to Google.

Analysis of your documents

To automatically recognize the menu, opening hours, colors and other details, we send your uploaded files to the text recognition service Google Cloud Vision (Google Cloud EMEA Limited, Ireland) and to the AI service fal.ai of Features & Labels, Inc. (USA), which forwards the request to an AI model. Please do not upload documents containing data about your guests or employees. Transfers to the USA are based on the EU Commission's standard contractual clauses (Art. 46 (2) (c) GDPR) or, where the respective provider is certified, the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis, abuse protection and storage period

The legal basis is Art. 6 (1) (b) GDPR (steps taken at your request prior to entering into a contract). Your progress is linked to your registration via the technically necessary cookie gastrify_onboarding (see section 4). To protect against abuse and disproportionate costs, we limit the number of registrations and uploads per connection; for this purpose we store a non-reversible hash of your IP address (Art. 6 (1) (f) GDPR). Uploaded files are not stored in a publicly accessible location. We automatically delete incomplete registrations including their files, usually 14 days after the last change. After publishing, we send you a welcome email with a link to confirm your email address (valid for 7 days); it is sent via SendGrid (Twilio Inc., see section 6). Once registration is complete, the terms of your contract with us apply.

9. Your rights

You have the following rights regarding your personal data:

  • right of access (Art. 15 GDPR)
  • right to rectification (Art. 16 GDPR)
  • right to erasure (Art. 17 GDPR)
  • right to restriction of processing (Art. 18 GDPR)
  • right to data portability (Art. 20 GDPR)
  • right to withdraw consent with effect for the future (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

To exercise your rights, an informal message to gastrify@gastrify.de is sufficient.

Right to lodge a complaint: You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

10. Obligation to provide data

You are not legally or contractually obliged to provide us with personal data. However, without the information marked as required in the consultation form or the AI consultant, we cannot handle your request or send you an evaluation.

11. Changes to this privacy policy

We update this privacy policy whenever the processing on this website or the legal situation changes. The version published here applies.