Hazely Privacy Policy
Hazely is a 21+ coffeeshop map and menu-scanning app for adults. This policy explains what data we collect, why we use it, who receives it, and what rights you have under the GDPR.
1. Controller
Hazely is operated by the publisher identified in the Google Play listing for nl.hazely.app, operating from Amsterdam, the Netherlands. Privacy contact: privacy@hazely.nl. Data-protection contact: dpo@hazely.nl.
2. What We Collect
- 21+ age confirmation, accepted Terms version, and consent choices, stored on your device only.
- Search queries, held in memory while you use the app and not sent to our server.
- Approximate device location for the on-device map. We do not send this to our server.
- Precise location during active navigation. Route endpoints are sent to Mapbox to calculate directions.
- Public shop listing data: ratings, review snippets, editorial summaries, price-level indicators, photos, phone, website, and opening hours from public sources such as Google Places/OpenStreetMap.
- Menu photos you choose to scan. They are sent over HTTPS to our server, stripped of EXIF metadata, forwarded to Anthropic or Google Gemini for text extraction, and discarded after processing.
- Menu scan text results, held in server memory for up to 30 minutes so the app can poll enrichment status.
- Owner verification/correction requests: shop name, contact name, business email, optional phone, and message.
- Illegal-content reports: report message and optional contact email.
- Crash reports, only when enabled: anonymous device-generated ID, device model, app version, and stack trace. Retention: 90 days.
- Anonymous analytics if you opt in. Retention: 14 months.
- Advertising signals for AdMob after consent is recorded; non-personalised ad requests are used when personalised ads are off.
- Truncated IP addresses in server access logs: /24 for IPv4 or /48 for IPv6.
We do not collect your name, account credentials, payment information, home address, health data, biometric data, or records of what you purchased.
3. Legal Bases
Age gate, terms acceptance, and local consent flags are processed for legal obligation and legitimate interest. Map and navigation features are processed for performance of contract. Owner requests and illegal-content reports are processed to handle your request and platform-safety obligations. Menu scanning, crash reports, analytics, and personalised ads rely on consent or user choice.
4. Recipients
- Anthropic, when configured, for AI menu OCR.
- Google Gemini, when configured, for AI menu OCR.
- Google Firebase Crashlytics and Analytics.
- Google AdMob.
- Mapbox for map tiles and directions.
- Our VPS provider in the EU.
US transfers rely on EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. We never sell your data.
5. Retention
- Age and consent flags: until uninstall.
- Search queries: discarded when the app closes.
- Menu photos: discarded after AI processing returns.
- Menu scan text results: up to 30 minutes in server memory.
- Owner requests and illegal-content reports: up to 24 months unless legal obligations require longer.
- Crash reports: 90 days.
- Analytics events: 14 months.
- Server access logs: 30 days, with truncated IP addresses only.
- AI audit log: 90 days, without image content.
6. Your GDPR Rights
You can request access, rectification, erasure, restriction, portability, objection, or withdrawal of consent. Submit requests at hazely.nl/data-request or email privacy@hazely.nl. We respond within 30 days. You may complain to the Dutch Autoriteit Persoonsgegevens.
7. Opt Out
- In-app: open Settings, then Privacy, to reset analytics, ads, and crash-report choices.
- Personalised ads: turn off Personalised Ads in Hazely settings and use Android privacy ad controls.
- Menu scanning: do not tap Scan Menu.
- Everything: uninstalling Hazely clears all on-device data.
8. Security
Hazely uses TLS 1.2+ for network traffic. API keys are stored only on the server in a restricted environment file. The server database does not contain personal user accounts. Menu scan uploads have metadata stripped before OCR processing.
9. Children
Hazely is not intended for anyone under 21 and is age-gated on first launch.
10. Contact
Email privacy@hazely.nl or dpo@hazely.nl.