Privacy policy

Controller

The controller for data processing on letuzz.com is:

Simon Petz
Vienna, Austria
simon.petz@gmx.at

There is no data protection officer; Letuzz is not required to have one.

The essentials

• You don't need an account. We never ask for your name or email address.
• There are no analytics tools, no ads and no social media plugins.
• Fonts and images come from Letuzz itself, not from Google or other services.
• As long as you only read, Letuzz stores nothing on your device. Only once you contribute something yourself do we set a cookie with a random ID. It lasts until the end of the week at most.
• We don't sell any data. It only goes to the two services Letuzz runs on: Vercel (hosting) and Neon (database).

Visiting the site and hosting

Letuzz runs on Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. With every request Vercel processes technically necessary data: IP address, time, requested address (including the search term if you search), referrer, browser and operating system, and the response status. No page can be delivered without it.

Letuzz's server functions run in the Frankfurt am Main region. Files such as fonts and images are delivered by Vercel's worldwide network from the nearest location. As Vercel is a US company, data may be transferred to the USA. Vercel is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR).

In our Vercel account, server logs can be viewed for one hour. Letuzz adds its own events to the log, such as "lunch page viewed, language English, day Monday" or a search term. These entries contain no IP address. How long Vercel itself keeps data is set out in the Vercel privacy policy.

The legal basis is our legitimate interest in delivering the site securely and without errors (Art. 6(1)(f) GDPR).

Offer data and your contributions are stored in a database at Neon, LLC, San Francisco, USA, a Databricks company. Neon processes them on our behalf (Art. 28 GDPR). The database is located in the Frankfurt am Main region. Neon is also certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), with standard contractual clauses as a fallback (Art. 46 GDPR). More: Databricks and Neon privacy notice.

Cookie and storage on your device

As long as you only read Letuzz, we store nothing on your device and read nothing from it. We don't remember your language either: it is part of the address (/de/ or /en/). If you open letuzz.com without a language, we follow your browser's language setting.

Only once you contribute something yourself do we set a single cookie:

• Name: letuzz_sid, set by letuzz.com itself.
• Content: a random ID (UUID). It contains nothing about you or your device.
• When: only once you confirm an offer, choose a dish or suggest a restaurant.
• Purpose: Letuzz links your contributions of this week to your browser. That way your vote counts once, you see your own answer and you can change or withdraw it.
• Duration: until 23:59 on Friday of the week Letuzz is showing (at the weekend that is already the next week), so seven days at most. It is never extended.

Scripts on the page cannot read the cookie, and it is only sent over encrypted connections.

This cookie needs no consent. Under § 165(3) of the Austrian Telecommunications Act 2021, storing information on your device without consent is allowed where it is strictly necessary for us to provide a service you have explicitly requested. You request that service when you tap an answer, a dish or "Suggest a restaurant" yourself. Without the ID we could not count your vote only once, and you could neither change nor withdraw it.

We also store the ID in our database, with every contribution you make with it. We don't know who you are, but we can recognise your browser while the cookie is valid. We therefore treat the ID as personal data. The legal basis for processing it is Art. 6(1)(f) GDPR. Our legitimate interest is that every vote counts only once and that you can change or withdraw your own contributions. As the cookie expires with the week, contributions from different weeks get different IDs and cannot be linked to each other.

You can delete the cookie in your browser settings at any time. Letuzz can then no longer link your contributions to this browser: they still count, but you can no longer change them.

When you contribute

You can contribute on the lunch page without signing in. We store:

• "Is this lunch offer still current?" Your answer, the time and, if you write one, your note on what changed. Only the number of confirmations and the time of the latest one are shown publicly, never your note.
• "I'm having this today" Which dish you chose for today. Only the number of people who chose a dish is shown publicly.
• "Suggest a restaurant" The name of the restaurant and, if given, the district.

Each contribution is linked only to the random ID in the letuzz_sid cookie, not to your name or email address. Please don't put details about yourself or other people in a note.

We use contributions to show current offers, find mistakes in them and add new restaurants. The legal basis is our legitimate interest in correct and complete lunch offers (Art. 6(1)(f) GDPR). We delete contributions, including the ID, no later than 12 months after the day they refer to, and suggestions no later than 12 months after we receive them.

Protection against abuse

So that nobody can skew the counts with automated requests, the server counts how often contributions come from one IP address. This count lives only in memory, is stored neither in the database nor in the log, and is discarded after ten minutes. The legal basis is our legitimate interest in reliable information (Art. 6(1)(f) GDPR).

Links to restaurants

Every offer links to the restaurant's source. Your browser connects to that site only when you click the link. From then on, that operator's privacy policy applies.

Your rights

You have the right of access, rectification, erasure and restriction of processing, and the right to data portability (Art. 15 to 20 GDPR). To use them, write to simon.petz@gmx.at.

As we don't know who you are, we can only link contributions to you if you send us the ID from the letuzz_sid cookie while it is still valid (Art. 11 GDPR). Once the cookie has expired or been deleted, Letuzz itself can no longer link your contributions to anyone.

You can also lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

Your right to object

You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR). This covers all processing described here. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. To object, write to simon.petz@gmx.at.

No automated decisions

Letuzz makes no automated decisions about people and builds no profiles. You are not obliged to provide any data. Without the letuzz_sid cookie you can read Letuzz but not contribute.