Privacy Policy
Last updated: 18 July 2026
1. Introduction
This privacy policy describes how Reliefs (Deverlabs) processes the personal data of people who do not have a Reliefs account:
- visitors to the marketing website reliefsapp.com (contact form, audience measurement);
- visitors to a restaurant's digital menus, viewed after scanning a QR code (visit statistics, advertising).
Are you a restaurant owner or a team member with a Reliefs account? The processing of your data (account, billing, mobile app) is described in the privacy policy of the professional area.
In accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the French Data Protection Act (loi Informatique et Libertés) No. 78-17 of 6 January 1978, as amended, we are committed to protecting the privacy and personal data of our users.
2. Data controller
- Company name: Deverlabs (trading name: Reliefs)
- Legal form: simplified joint-stock company (Société par Actions Simplifiée, SAS) with a share capital of €1,000
- Registered office: 173 rue de Courcelles, 75017 Paris
- SIREN: 105 753 297, RCS: Paris B 105 753 297
- Email: contact@reliefsapp.com
For processing related to digital menus, Reliefs's role varies: Reliefs acts as a processor (Article 28 GDPR) on behalf of the restaurant for the visit statistics reported back to it. For the advertising displayed on menus under the free plan, Reliefs provides the advertising space, while consent is collected by Google's certified consent management platform (CMP) (IAB TCF framework): Google and its advertising partners handle consent collection, ad serving and ad measurement (see sections 6 and 7).
3. Personal data collected
3.1 On the marketing website
Through the contact form:
- First and last name (required), to personalise our exchanges
- Business email address (required), to get back to you
- Phone number (optional), to make it easier to get in touch
Collected automatically:
- Browsing data: IP address, browser type, operating system (website security)
- Usage data: pages viewed and interactions (clicks), measured through PostHog, see section 6
3.2 When viewing a digital menu
Viewing a menu requires no account: we know neither your name, nor your email address, nor your phone number.
- Visit measurement (cookieless): to tell the restaurant how many people view its menu, we count browsing events (menu viewed, dish viewed) associated with a random session identifier passed in the page address (without any cookie or tracker), as well as with the type of device, browser and operating system, the IP address, the referring page (referer) and an approximate location (country/city) derived from the IP address. These statistics are anonymised and cannot be used to identify you.
- Service improvement: aggregated usage measurement and error detection through PostHog (hosted in the European Union). Menu visitors' events are anonymous, and no profile is built.
- Advertising (menus under the free plan only): see section 7.
4. Purposes and legal bases
| Purpose | Legal basis | Retention / tool |
|---|---|---|
| Contact and demo requests | Consent (Art. 6(1)(a) GDPR) | 3 years from the last interaction |
| Audience measurement and service improvement | Legitimate interest (Art. 6(1)(f) GDPR) | PostHog (European Union) |
| Menu visit statistics | Legitimate interest (Art. 6(1)(f) GDPR); Reliefs acting as the restaurant's processor (Art. 28) | 90 days |
| Advertising on menus under the free plan | Consent (Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act) | See section 7 |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f) GDPR) | Cloudflare Turnstile, deleted after validation |
5. Data recipients
- Attio: customer relationship management and contact data (hosted in Europe)
- Cloudflare: hosting, CDN, security and anti-spam (Turnstile), menu visit measurement
- PostHog: audience measurement and usage analytics (hosted in the European Union)
- Google: consent collection (certified consent management platform, IAB TCF framework), serving and measurement of advertising on menus under the free plan, together with its advertising partners (see section 7)
With the exception of the advertising served on menus under the free plan, we do not sell or rent your personal data to third parties. Our service providers process your data only on our instructions.
6. Cookies and trackers
| Cookie / Tracker | Purpose | Duration |
|---|---|---|
| Cloudflare Turnstile | Form anti-spam (strictly necessary) | Deleted after validation |
| PostHog (marketing website) | Audience and usage measurement (pages, clicks, heatmaps) | Up to 12 months |
| NEXT_LOCALE (menus) | Remember the language chosen for the menu | 12 months |
| FCCDCF (free menus) | Google CMP: remember your advertising consent choice (IAB TCF) | Up to 390 days |
TCF storage IABTCF_* (free menus) | Google CMP: consent string (TC string) read by advertising partners | Up to 390 days |
| Google and partner advertising cookies (free menus) | Only after consent: ad serving and measurement | Up to 13 months (set by Google) |
Strictly necessary cookies (Turnstile, storing your language and your consent choice) are exempt from consent. Menu visit measurement (section 3.2) uses no cookies. Advertising cookies are only set after your consent, collected by Google's certified consent management platform (CMP) when the menu is opened (section 7).
7. Advertising on menus under the free plan
Some establishments use Reliefs's free plan. On these menus only, advertisements are displayed through Google AdSense. No advertising is served on the menus of establishments on a paid plan.
Consent collection (Google CMP / IAB TCF). Consent is collected by Google's certified consent management platform (CMP), which complies with the IAB Transparency & Consent Framework (IAB TCF v2.2). On your first visit, a message displayed by this CMP lets you accept or refuse, for advertising purposes (displaying ads, personalised ads, audience measurement) and for Google's advertising partners. The full list of these partners (IAB TCF vendors) can be viewed directly from this message, via "Manage options".
Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act). If you refuse, contextual, non-personalised ads may still be displayed. Accepting and refusing are two equivalent choices: the menu remains fully usable in both cases.
Roles. Reliefs provides the advertising space within the menu. Google and the IAB TCF advertising partners handle consent collection, ad serving and ad measurement and act, depending on the purposes, as (joint or independent) controllers. Google may transfer data outside the European Union (Google LLC, United States), under the safeguards provided for in Chapter V of the GDPR (Standard Contractual Clauses and EU-US Data Privacy Framework certification). See Google's policy for partner sites.
Withdrawing or changing your consent is possible at any time and is as easy as giving it (Art. 7(3) GDPR), via the link for managing your privacy choices provided by Google's CMP, which displays the consent message again.
8. Your GDPR rights
You have the rights of access, rectification, erasure, restriction, portability and objection (Articles 15 to 21 GDPR), as well as the right to withdraw your consent at any time.
Note: since viewing a menu collects no directly identifying data, we may not be able to link data to you (Article 11 GDPR); in that case, some rights may not apply.
To exercise your rights: contact@reliefsapp.com (subject: "Exercising my GDPR rights"). We will reply within 1 month at most.
You may also lodge a complaint with the CNIL: www.cnil.fr, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
9. Data security
- SSL/TLS encryption: all communications are secured over HTTPS
- Secure hosting: Cloudflare infrastructure (ISO 27001 and SOC 2 certified)
- Restricted access: only authorised persons have access to the data
10. Transfers outside the European Union
Our service providers Attio, Cloudflare and PostHog process data within the European Economic Area. Google (advertising on free menus) may transfer data outside the EU; these transfers are governed by the Standard Contractual Clauses and the EU-US Data Privacy Framework certification (Chapter V of the GDPR).
11. Retention periods
| Type of data | Duration |
|---|---|
| Contact form | 3 years from the last interaction |
| Website audience measurement (PostHog) | Up to 12 months |
| Menu visit statistics | 90 days |
| Advertising consent choice, Google CMP (FCCDCF / TCF storage) | Up to 390 days |
| Google and partner advertising cookies (free menus) | Up to 13 months (set by Google) |
| Cloudflare security logs | 30 days maximum |
12. Protection of minors
We do not knowingly collect personal data from persons under the age of 15. If you are a parent or guardian and believe that a minor has provided us with data, contact us at contact@reliefsapp.com.
13. Changes to this policy
We reserve the right to change this policy at any time. Any change will be published on this page with a new "Last updated" date.
14. Contact us
Email: contact@reliefsapp.com: subject: "Data protection" or "Exercising my GDPR rights".
This privacy policy complies with the GDPR (Regulation (EU) 2016/679) and the French Data Protection Act (loi Informatique et Libertés), as amended.