SafeBite is a brand and service operated by Meriguisla Romko, trading as LuxNeva (entreprise individuelle), at 6 Rue Joseph Leydenbach, L-1947 Luxembourg. In this Policy, "SafeBite", "we" and "us" refer to that operator.
This Privacy Policy explains how personal data is processed when you visit the commercial website safebite.lu, submit a contact request, or use the SafeBite HACCP application (the "App"), its Child Care mode and optional AI and connected services. These include Sofia on the commercial website, Sofia inside the App, AI-assisted document capture and reports, and the separate SafeBite connection for ChatGPT.
We act as controller for website enquiries, marketing choices, direct account administration, billing, support and security processing carried out for our own purposes. When an establishment uses SafeBite to process its staff, operational or Child Care records, the establishment determines the purposes and lawful basis of that processing, and we process those records on its instructions as a processor. The applicable scope, safeguards and instructions must be set out in the required data-processing agreement. This Policy does not replace such an agreement or establish that one has been signed.
1. Data we collect
| Category | Examples |
|---|---|
| Account data | Name, email address, business/company name and language preference. |
| Operational records and documents | HACCP records you enter, including temperatures, cleaning tasks, goods receipt, cooking and pest-control logs, staff names, suppliers, recipes and allergens; photographs and documents you upload as evidence or submit for AI-assisted extraction. |
| Child Care records | When an establishment uses Child Care mode, information entered by its authorised adult users may include children's names and dates of birth, guardian and emergency contact details, dietary restrictions, allergies, meals and incidents. Allergy and medical information may include health data. |
| Subscription data | Subscription tier, status and renewal information processed via Google Play or Apple and RevenueCat. We do not receive your full card details. |
| Technical data | App version, device type, and diagnostic/usage information needed to operate and secure the services. The commercial assistant's service limits use a daily pseudonymous identifier derived from the visitor's IP address, rather than storing the IP address in its quota-counter table. |
| Website enquiries | Your name, company, work email, business sector, optional telephone number and message, selected offer where applicable, website language and acknowledgement that we may contact you about SafeBite. |
| Website measurement and consent | Your saved choice to accept or reject marketing measurement. If you accept, Meta Pixel and Metricool process website visit information for audience and campaign measurement; this may include page-view events and browser or network information. This choice is separate from consent to speak with Sofia or be contacted. |
| Optional AI inputs and outputs | Questions, recent conversation turns and the selected language sent to Sofia on the website or in the App; the in-app assistant also receives the open-module context; microphone audio and generated replies during voice calls; and voice transcriptions displayed in the conversation where available. Other requested AI features process selected images/PDFs, dish and ingredient text, report summaries and logo prompts. These inputs can contain personal data if you include it or if it already appears in the selected records or documents. |
| Local device data | Sign-in state, language and other preferences, and cached records used to operate the App and support offline access. Sofia conversation history is kept in memory for the current page or app session, separately from stored HACCP records. The commercial website also stores your marketing-measurement choice in your browser. |
| Connected-service data | When you choose to connect SafeBite to ChatGPT, we process the connection authorisation and the SafeBite records needed to answer the requests you make through that service. |
2. How we use your data
- To provide and operate the App and store your HACCP and Child Care records.
- To create and manage your account and authenticate you.
- To manage subscriptions, free trials and billing status.
- To provide support and respond to your requests, including demonstrations, quotes and enquiries submitted on the commercial website.
- With your consent, to measure website visits and campaign performance using Meta Pixel and Metricool.
- To maintain security, prevent abuse and comply with legal obligations.
- To improve and maintain the App.
- To provide AI features when you request them: app help and general HACCP guidance, voice conversations, document extraction, draft allergen suggestions, report summaries and logo generation. AI suggestions require human review and do not certify food safety, legal compliance or the absence of allergens.
- When you explicitly connect ChatGPT, to authenticate the connection and return the SafeBite information requested through the read-only integration.
3. Legal bases (GDPR)
We process personal data to perform our contract with you (providing the App), to comply with legal obligations, on the basis of our legitimate interests (security, improvement, support), and, where required, with your consent.
Both the website and in-app versions of Sofia ask you to acknowledge transmission to OpenAI before you send a question or start a call. Voice also requires microphone permission. You may stop using Sofia or end a call at any time. Withdrawing consent stops future use based on that consent; it does not undo processing that has already taken place. The separate ChatGPT connection requires its own authorisation.
The contact form requires you to agree to be contacted about your SafeBite enquiry. We use that information to respond to your request and take steps at your request before any contract. Marketing-measurement tools use a separate choice: you can refuse them and still browse the website, use the form or choose to use Sofia.
4. Service providers and connected services
We use the following providers to operate the App and the features you request:
- Google Firebase — account authentication, Cloud Firestore storage of account and operational records, and Firebase Storage for uploaded evidence files.
- Cloudflare — website and backend hosting and delivery, processing of API requests and temporary technical/usage counters used for security and service limits.
- OpenAI — Sofia — processes the questions, recent conversation context and selected language needed to answer your requests on the commercial website or in the App; the in-app version also receives the open-module context. During a voice call, OpenAI processes microphone audio, generates the AI voice and provides transcriptions displayed in the App where available. Sofia is separate from the ChatGPT connection below.
- Google Gemini — processes content for the optional AI-assisted features you request, including selected photographs/PDF documents, dish names and ingredient lists, HACCP report summaries and logo prompts. Draft allergen suggestions may use Google Search. Report summaries may include staff/operator names and other personal information already present in the source records.
- LuxNeva contact service — the website form sends the enquiry fields you submit to LuxNeva's contact service at luxneva.lu so the team can handle your request. Submitting this form is separate from chatting with Sofia; your conversation is not automatically attached.
- Meta and Metricool — if you accept website marketing measurement, their scripts measure visits and campaign performance on safebite.lu. These website measurement tools are separate from the App's HACCP and Child Care data.
- RevenueCat — subscription management and entitlement verification.
- Google Play and Apple App Store — subscription payment processing and billing.
- OpenAI — optional ChatGPT connection — when you separately authorise this connection, SafeBite returns the requested records through its read-only integration so that ChatGPT can answer your request. SafeBite does not send your SafeBite password to OpenAI. Use of ChatGPT is also subject to the terms and privacy settings of your ChatGPT service.
Some providers operate internationally and processing may take place outside the EU/EEA. Any such transfer must have a valid legal basis and the safeguards required by the GDPR. You can contact us for information about the providers and transfer safeguards applicable to your service.
Sofia inside the App
Sofia receives what you type or say, relevant recent turns in the conversation, your selected app language and the name of the module currently open. It also uses general SafeBite product guidance. It does not automatically read your HACCP records, Child Care records, uploaded files, screen or account profile, and it cannot create, change or delete records. If you include personal information in a question or say it during a call, that information will be transmitted to OpenAI. Do not share passwords, PINs, contracts, children's details or other unnecessary personal information with Sofia.
Microphone capture starts when you choose to start a voice call and grant permission. Ending the call or closing the Sofia panel stops capture. Minimising the panel may leave the call active; the microphone indicator and End call control remain visible. The voice is generated by AI.
Sofia on the commercial website
The website assistant explains SafeBite and helps you find the contact form. It does not require a SafeBite login, has no access to your account or private records, and cannot save a contact, make a booking, take payment or activate a subscription. Text requests send your recent conversation and selected language to the website's backend; requests requiring an AI reply are passed to OpenAI. Some standard product questions can receive a prepared answer without an OpenAI request. Voice calls transmit microphone audio to OpenAI, which generates the spoken response and transcriptions shown in the conversation.
The website contact form is a separate action. Sofia does not automatically turn a conversation into an enquiry. Closing the assistant stops the microphone, but retains the displayed conversation while the page remains loaded. The website does not save this conversation for a later page load. Avoid including passwords, payment details, children's information or other sensitive personal data in the conversation or enquiry message.
Website measurement choices
Meta Pixel and Metricool are loaded on safebite.lu only after you choose Accept for marketing measurement, or when the browser remembers an earlier acceptance. You can choose Reject or change your choice through the Cookies button. A refusal prevents those scripts from being loaded on a subsequent page load. Changing an existing acceptance to refusal revokes Meta consent, removes the Meta cookies that the website can clear and reloads the page. It does not erase information already received by the providers.
Your choice is stored in browser local storage until you change it or clear the site's stored data; no automatic expiry is configured for this preference. It is separate from the assistant and enquiry consents. For provider information, see Meta's privacy policy and Metricool's privacy policy. Metricool describes its visit tracker in its tracking and cookies guidance.
5. Data retention
We keep your account and records for as long as your account is active. After account closure we delete or anonymise personal data within a reasonable period, unless we must keep certain information to meet legal obligations. For the optional ChatGPT connection, access tokens expire after one hour and refresh tokens after 30 days unless renewed through continued authorised use. You may disconnect the integration at any time.
For Sofia inside the App, conversation text and available voice transcriptions are held in memory for the current app session and are not saved as a conversation history in your SafeBite account database. You can clear the on-screen history with New conversation. Signing out, changing account or reloading the App clears this session history. Closing or minimising the panel alone does not clear it. SafeBite does not save an audio recording of Sofia calls in your account. We keep temporary pseudonymous usage counters to enforce service limits and prevent abuse.
The commercial website does not save Sofia conversation history or audio recordings in its assistant database. The displayed history remains in the current page's memory. Website assistant quota counters use daily pseudonymous identifiers derived from IP addresses; the quota records are assigned a two-day expiry and removed during subsequent service activity. This does not determine the retention of hosting logs or information processed by AI providers.
Enquiry information submitted through the contact form is processed separately to handle and follow up your request and to meet applicable legal obligations. Its retention depends on the enquiry and any resulting customer relationship. You can ask us to stop contacting you or request deletion using the contact details below.
These statements describe storage by SafeBite; they do not mean that AI providers retain no data. OpenAI and Google may retain request content or technical information for service operation, safety, abuse prevention or legal obligations under the terms applicable to the service. See OpenAI's API data controls and the Gemini API terms, including the separate data handling for Google Search grounding. Clearing a conversation in SafeBite does not delete information already processed by those providers or by a separately connected ChatGPT account.
6. Your rights
Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, and the right to data portability. You may also withdraw consent where processing is based on consent, and lodge a complaint with your data-protection authority (in Luxembourg, the CNPD). To exercise your rights, contact us at the address below.
7. Security
We use technical and organisational measures, including encrypted connections and access controls, to protect personal data. No method of transmission or storage is completely secure, but we work to protect your information.
8. Children and Child Care mode
The App is intended for use by adult professionals and is not offered as a service for children to use directly. Establishments using Child Care mode can enter information about children, guardians, allergies, meals and incidents. The establishment must ensure that it is authorised to enter that information, provide the relevant privacy information to families and limit access to authorised staff. Enter only information necessary for the establishment's work. Do not include children's personal or health information in Sofia questions or voice calls. Requests about records held by an establishment should first be directed to that establishment; you may also contact SafeBite using the privacy contact below.
9. We do not sell your data
We do not sell personal data and do not use your HACCP records for advertising.
10. Changes
We may update this Policy from time to time. Material changes will be notified in the App or by email, and the "Last updated" date above will change.
11. Contact
SafeBite — a brand and service of Meriguisla Romko, trading as LuxNeva (entreprise individuelle)
6 Rue Joseph Leydenbach, L-1947 Luxembourg
RCS Luxembourg: A47587
VAT number: LU32303150
Business permit: 101113788/1
Privacy, enquiries and support: hello@luxneva.lu