This policy explains which personal data we process when you use Gnam, why we do it, how long we keep it and what rights you have. We write it as simply as we can. If something is unclear, write to us.

This is a translation. If it differs from the Italian version, the Italian version prevails.

Who we are and how to contact us

The data controller is CodeLab srls, Corso Giuseppe Garibaldi 22, 00034 Colleferro (RM), Italy, VAT number 17925991006.

For any privacy question, or to exercise your rights, write to info@codelab.email.

We have not appointed a Data Protection Officer (DPO): the law does not require one for our activity. We answer directly at the address above.

Who this policy is for

Gnam is a platform for restaurants and venues. This policy applies to:

customers: anyone using the menu and map site (menu.gnam.ai and the pages of each venue), with or without an account;
visitors to gnam.ai;
restaurateurs: anyone who opens an account to manage one or more venues;
venue staff: anyone who signs in to the back office, the kitchen display or the floor app.

When we are the controller and when we are not

For the Gnam account, the map, your preferences, the assistant, the gnam.ai site and the restaurateurs’ subscription, we decide how and why data is processed: we are the controller.

When you book a table, order or pay the bill at a venue, that data is needed by the venue. In that case the controller is the restaurateur, and we process the data on their behalf as a processor (Art. 28 GDPR), under a written agreement (data processing agreement). For these activities you can contact the venue directly; if you write to us, we forward the request.

In short

We use your data to run Gnam. We do not sell it and we do not do personalised advertising.
Food preferences (allergens, diets, religious or cultural restrictions) are special category data: we store and use them only with your explicit consent, and we send them to the AI assistant only with a second, separate consent.
Your location stays in your browser. We do not store it in our database.
We do not store your conversations with the assistant on our servers.
Statistics cookies (Google Analytics) start only if you accept them.
You can download your data and delete your account at any time from the Account section.

What data we process

If you are a customer

Account data: name, email, password (stored only as a cryptographic hash, never in plain text), date of birth, phone (optional), language and time zone.
Consents: the choices you make (privacy, terms, promotional messages, food preferences, assistant), with the document version and the date.
Food preferences: allergens to avoid, diets (for example vegetarian, vegan, gluten-free, halal, kosher), religious or cultural restrictions (for example no pork, no alcohol, Jain), the religious calendar you observe and the notes you write. See Food preferences.
Favourite cuisines: the kinds of cuisine you like. These are not special category data.
Favourites and lists: the dishes and venues you save, the lists you create. A list becomes public only if you choose to share it with a link: anyone with the link sees the list’s name and description, the venues and dishes it contains and your name.
Bookings and orders: date, time, party size, special requests, dishes ordered, bill status. See Bookings and orders at venues.
Location: your device’s location, if you allow it, or the centre of the map. See Location.
Assistant conversations: what you write to the AI assistant. See AI assistant.
Technical data: IP address, browser type, date and time of requests, needed to run and protect the service.

If you visit gnam.ai

Technical data about your visit (IP address, browser, pages requested).
Statistics from Google Analytics, only if you accept statistics cookies. See the cookie policy.

If you are a restaurateur

Account: name, email, password (hash), phone.
Venue data: name, address, coordinates, opening hours, menus, photos, public contacts.
Billing: company name, VAT number, tax code, registered address, SDI recipient code or certified email (PEC), subscription and invoice data. Card data is handled by Stripe: we never see it.

If you are part of a venue’s staff

Sign-in: name, email or username, phone (optional), password and PIN (both stored only as hashes).
Role and permissions in the venue.
Sessions and devices: which of the venue’s devices you signed in on, and when.
Activity log (audit): who did what and when, for important operations.
Voice commands, if the venue uses them: the transcript of the command and its result.

Why we process data and on what legal basis

Purpose	Legal basis	Data	How long
Creating and managing your customer account	Contract (Art. 6(1)(b) GDPR)	Account data	As long as you keep the account. If you ask for deletion: 30 days to change your mind, then we anonymise
Checking that you are at least 14	Legal obligation (Art. 6(1)(c); Art. 8 GDPR; Art. 2-quinquies Italian Privacy Code)	Date of birth	Same as the account
Menus, map, search, favourites, lists, favourite cuisines	Contract (Art. 6(1)(b))	Favourites, lists, cuisines, location	Same as the account; favourites and lists are deleted with the account
Storing and using food preferences (menu filters, “Safe for me” badge)	Explicit consent (Art. 9(2)(a) and 6(1)(a))	Allergens, diets, restrictions, observed calendar, notes	Until you withdraw consent (withdrawal deletes them) or delete the account
Answering your questions with the AI assistant	Contract (Art. 6(1)(b))	Conversation text, location, language	We do not store conversations; OpenAI keeps them for up to 30 days
Sending food preferences to the AI assistant	Separate explicit consent (Art. 9(2)(a) and 6(1)(a))	Food preferences	As above
Service emails (email verification, password recovery, account notices)	Contract (Art. 6(1)(b))	Email, name	Verification links expire after 24 hours and are deleted 7 days after expiry
Promotional messages	Consent (Art. 6(1)(a)), optional	Email	Until you withdraw consent
Site usage statistics (Google Analytics)	Consent (Art. 6(1)(a))	Cookie identifiers, pages visited, device data	Cookies: up to 2 years; data in Google Analytics: 14 months
Security, abuse and fraud prevention, request limits, technical logs	Legitimate interest (Art. 6(1)(f))	IP address, technical data	Anti-abuse counters: a few minutes; technical logs: up to 30 days, unless an incident is being investigated
Restaurateur and venue account	Contract (Art. 6(1)(b))	Account, venue data	For the whole term of the contract; then we delete within 90 days, except data we must keep by law
Subscription, payments, invoices	Contract and legal obligation (Art. 6(1)(b) and 6(1)(c))	Billing data, subscription, invoices	Invoices and accounting records: 10 years (Art. 2220 Italian Civil Code)
Staff sign-in, sessions, devices	Contract (Art. 6(1)(b)) and legitimate interest in security (Art. 6(1)(f))	Sign-in data, sessions	Sessions: 30 days after they end; sign-in: as long as the venue keeps you on staff
Activity log (audit)	Legitimate interest in security and traceability (Art. 6(1)(f))	Who, what, when	12 months
Back-office AI features (menus, dish photos, voice commands)	Contract (Art. 6(1)(b))	Menu text, images, voice command transcripts	Voice transcripts: 90 days
Notifications (email, push) and their outcome	Contract (Art. 6(1)(b))	Recipient, notification type, outcome	90 days; device tokens for push notifications: 30 days after they expire or are deactivated
Answering your emails	Legitimate interest (Art. 6(1)(f)) or contract	Email, message content	As long as needed to reply, then up to 24 months
Complying with the law and defending our rights	Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f))	The data the case requires	As long as the law or the proceedings require

If you do not give us the data needed for the account (name, email, password, date of birth), we cannot create it. Everything else is optional: you can use menus and the map without an account, and without giving preferences, location or consents.

Food preferences: special category data and consents

Allergens, diets and restrictions can reveal information about your health (for example an allergy or coeliac disease) or your religious or philosophical beliefs (for example a halal, kosher, Jain or vegan diet). For this reason we treat all food preferences as special categories of data (Art. 9 GDPR), even when a single choice reveals nothing sensitive.

Favourite cuisines (for example “Japanese” or “pizza”) do not fall into this category.

The two consents

We ask for two explicit consents, separate and always optional:

Storing and using your preferences on Gnam. This lets us filter menus, show you the “Safe for me” badge and remember your choices. Without this consent we do not store food preferences.
Sending your preferences to the AI assistant. This lets the assistant suggest dishes and venues that suit you. The assistant uses a service by OpenAI, based in the United States (see AI assistant). You can give this consent only if you have given the first one.

If you give neither consent, you can still use Gnam: you set the filters by hand each time, and the assistant answers without knowing your preferences.

How to withdraw them

Go to Account → Privacy and consents.

If you withdraw the first consent, we delete all your food preferences (allergens, diets, restrictions, calendar, notes) and also withdraw the second consent.
If you withdraw only the second, your preferences stay on Gnam but we no longer send them to the assistant.

Withdrawal does not make unlawful what we did before.

If you had already saved preferences

If you saved preferences before we introduced these consents, we do not use them until you choose. The first time you sign in we ask whether you want to give consent or delete them. We do not delete them unless you decide so.

An important warning

Information about allergens and ingredients is declared by the venue. Gnam shows it as it receives it and cannot guarantee it. Before ordering, always check with the venue’s staff, especially if you have an allergy.

Location

When you open the site, your browser asks whether you want to share your location. You can say no: the map still works and you can move it by hand.

If you say yes:

we use your location to centre the map and to search for nearby venues or calculate distances;
your location stays in your browser, in the tab’s memory (sessionStorage), and is refreshed after 10 minutes; it is deleted when you close the tab;
we send it to our server only when you run a search or write to the assistant, for that single request;
we do not store it in our database.

Your browser also remembers the last map view (centre and zoom) so it reopens where you left it. This stays on your device only.

You can withdraw the permission at any time from your browser settings.

The legal basis is the service you ask us for (Art. 6(1)(b) GDPR). Your device’s location is accessed only with your permission in the browser.

AI assistant

The assistant is an artificial intelligence program that helps you find venues and dishes. To use it you need an account with a verified email and a complete profile.

Who provides it

We use services by OpenAI (OpenAI Ireland Ltd and OpenAI OpCo LLC, United States), with the gpt-5-mini model and a moderation service that blocks prohibited content.

What we send to OpenAI

the text of the conversation;
your location (your device’s, if you allowed it, or the centre of the map) and your language;
the public data about venues and dishes the assistant looks up to answer you;
your food preferences, only if you have given both consents (see Food preferences).

We do not send your name, email, phone or date of birth.

What OpenAI does with this data

It does not use it to train its models.
It keeps it for up to 30 days to monitor for abuse, then deletes it.
The data goes to the United States. The transfer is protected by the Standard Contractual Clauses approved by the European Commission. OpenAI is not certified under the EU-U.S. Data Privacy Framework.

What we keep

We do not store the content of conversations on our servers. We record only technical data: how long the message is, which tools the assistant used, how many tokens it consumed and how the answer went.

The conversation history stays in your browser (sessionStorage) and is deleted when you close the tab, when you sign out or when you delete your account.

Keep in mind

The assistant can make mistakes. Its answers are not medical or nutritional advice. For allergies and intolerances, always check with the venue.

Bookings and orders at venues

When you book, order at the table or pay the bill through Gnam, we process the data on behalf of the venue, which is the controller. The venue decides how long to keep it and answers your requests. We help it do so.

In your account you see the history of your bookings and orders: we manage this part ourselves, to provide the service to you.

If you delete your account, we unlink bookings and orders from your profile. The data the venue received (for example the name you booked under) stays with the venue, which keeps it according to its own rules and legal obligations.

Payments are handled by Stripe. We do not see or store your card data.

Feedback requests. If the venue has turned them on, after your visit (a completed booking or a table closed with your account) we email you on its behalf asking for a score from 0 to 10 and, if you like, a comment. You get at most one every 30 days per venue, and never during the venue’s religious observance windows. The link to answer is personal and works for 14 days. The venue sees the score and the comment; it sees your name only if you allow it in the form. You can stop a venue’s requests in one click, from the link at the bottom of the email: to remember your choice we keep only a hash of your address instead of the address itself. That is pseudonymous data, not anonymous: someone who already knows your address can check that it matches. Answers and comments are deleted after 24 months; if you delete your account, the comment and your name are removed and only the anonymous score stays in the venue’s statistics.

Restaurateurs and staff

For the restaurateur’s account, subscription and billing we are the controller.

For staff data within a venue (roles, shifts, sessions on the venue’s devices, activity log, voice commands) the controller is the restaurateur, and we process the data on their behalf under the data processing agreement. Sign-in credentials and the security of the Gnam account remain our responsibility.

For some back-office features we use artificial intelligence services:

Anthropic (Claude) to create and read menus, recognise allergens in dish descriptions and understand voice commands;
OpenAI (Whisper) to transcribe voice commands and (DALL-E) to generate dish photos.

To find a venue’s coordinates from its address we use OpenStreetMap’s Nominatim. For religious calendars we use Hebcal and Aladhan, to which we send only the venue’s coordinates.

Our legitimate interest

Some processing is based on our legitimate interest (Art. 6(1)(f) GDPR): protecting the service from attacks and abuse, limiting excessive requests, keeping technical logs to fix problems, tracking important operations in the back office, answering emails.

We have assessed that these interests do not override your rights because:

this is processing you can reasonably expect from an online service;
we use little data, for a short time, and we do not use it to profile you;
it also protects you, your data and your account.

You can always object to this processing (see Your rights).

Minors

To create a Gnam account you must be at least 14 years old (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code, Legislative Decree 196/2003). We ask for your date of birth to check this. If we find that an account belongs to someone younger, we delete it.

Restaurateur accounts are reserved for adults acting for a business.

We do not sell your data. We share it only with those who help us provide the service, with venues when they are the ones who need to receive it, or when the law requires it.

Suppliers processing data on our behalf (processors)

Supplier	What it does	Where
Hetzner Online GmbH	Servers, database and file storage (photos, documents)	European Union
Email service provider (SMTP)	Sending service emails	Name and location available on request
OpenAI (OpenAI Ireland Ltd, OpenAI OpCo LLC)	AI assistant, moderation, voice transcription, dish images	Ireland and United States
Anthropic PBC	Back-office AI features (menus, allergens, voice commands)	United States
Stripe (Stripe Payments Europe Ltd, Stripe Inc.)	Payments and subscriptions	Ireland and United States
TeamSystem S.p.A. (Fatture in Cloud)	Issuing electronic invoices to restaurateurs	Italy
Google Ireland Ltd, Google LLC	Statistics (Google Analytics), only with your consent	Ireland and United States
Cloudflare Inc.	DNS management for the gnam.ai domain	United States

Other recipients

Venues: they receive the data of the bookings and orders you make with them, and the messages you send them.
Services the venue chooses to connect, such as TheFork for bookings or Deliverect for deliveries: they receive the data they need only if the venue turns on the integration, and they process it under their own terms.
Third-party services you open yourself: the map loads its images from OpenFreeMap (Hyperknot Software Kft., Hungary), which receives from your browser the IP address needed to download them, as an independent controller. Links to Google Maps, Apple Maps, WhatsApp or TheFork open those services only if you tap them.
Authorities, when the law requires it.
Our advisers (for example our accountant or lawyer), bound by confidentiality.

If in the future we use other suppliers (for example for SMS or push notifications), we will update this list before we start.

Transfers outside the European Union

Our servers are in the European Union. Some suppliers, however, are based in the United States or may access the data from there:

OpenAI and Anthropic: European Commission Standard Contractual Clauses (Art. 46 GDPR). They are not certified under the Data Privacy Framework.
Google (Google Analytics), Stripe and Cloudflare: certified under the EU-U.S. Data Privacy Framework, which the European Commission has found adequate (Art. 45 GDPR). Where needed, Standard Contractual Clauses also apply.

You can ask us for a copy of the safeguards by writing to info@codelab.email.

How we protect data

All connections to our sites are encrypted (HTTPS).
We store passwords and PINs only as hashes: nobody, not even us, can read them.
Session cookies cannot be read by the page’s scripts (httpOnly).
Each venue sees only its own data; each staff member sees only what their role allows.
We log important operations and limit requests to block abuse.

If a personal data breach occurs, we notify the Italian Data Protection Authority within 72 hours when the law requires it and, if there is a high risk to you, we tell you directly.

Your rights

You have the right to:

access your data and get a copy (Art. 15);
correct it if it is wrong (Art. 16);
erase it (Art. 17);
restrict its processing (Art. 18);
receive your data in a machine-readable format and pass it to another service (portability, Art. 20);
object to processing based on legitimate interest (Art. 21);
not be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22). Gnam makes no such decisions: filters and suggestions help you choose, but you always decide;
withdraw your consents at any time, without affecting what was done before.

How to exercise them

From your account you can download your data, edit it, manage your consents and delete your account. After the deletion request you have 30 days to change your mind; then we anonymise the profile, delete favourites and lists and, if you do not also manage a venue, anonymise your sign-in and close all sessions.
For everything else write to info@codelab.email. We reply within one month (for complex cases we may extend by two more months, letting you know). We may ask you to confirm your identity.
If the request concerns data we process on behalf of a venue, we forward it to the venue.

Complaint to the supervisory authority

If you think we process your data incorrectly, you can lodge a complaint with the Italian Garante per la protezione dei dati personali (garanteprivacy.it) or with the authority of the EU country where you live or work.

How to manage and withdraw consents

Consent	Where to manage it	What happens if you withdraw it
Food preferences on Gnam	Account → Privacy and consents	We delete your food preferences and also withdraw the assistant consent
Preferences to the AI assistant	Account → Privacy and consents	Your preferences stay on Gnam, but we no longer send them to the assistant
Promotional messages	Account → Privacy and consents	We no longer send you promotional messages
Statistics cookies	”Manage cookies” link at the bottom of every page	Google Analytics stops from the next page
Location	Browser settings	We no longer use your device’s location

Cookies

We use technical cookies, needed to run the sites, and statistics cookies only with your consent. You find all the details in the cookie policy.

Changes to this policy

We may update this policy when the service or the law changes. At the top you find the date of the latest version. If the changes are significant, we tell you on the site or by email and, where needed, ask for your consent again.

Version 2026-09-24 · Last updated: 24 September 2026

Privacy Policy