Information on the processing of personal data related to RistoBoost.

1. Data Controller

Name / business name: Cosmin Dumitru Rusu

Address / registered office: via delle Mandorle 14/C

Privacy email: privacy@cdrapps.com

PEC: Not yet available

VAT / Tax code: To be inserted before final publication

2. Legal framework

This notice is provided under Articles 13 and 14 GDPR and the Italian Privacy Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

3. Scope

This notice applies to the RistoBoost product and related processing linked to accounts, core product functionality, business profiles, AI features, support, security, and any analytics or billing components when actually active.

4. Categories of data

• account and authentication data, including email and user identifiers;
• restaurant or business profile data;
• content entered by the user into the product;
• AI inputs and generated outputs;
• technical logs, diagnostics and application metadata;
• support communications;
• subscription or billing data only if and when such features are really active.

5. Purposes

• account creation and management;
• service delivery;
• management of restaurant/business profile data;
• AI-assisted product features;
• security, abuse prevention and fraud prevention;
• user support;
• analytics only if actually enabled;
• billing and subscription management only if actually enabled.

6. Legal bases

• performance of a contract or pre-contractual steps;
• legitimate interest for security and service protection;
• legal obligations where applicable;
• consent where required by law.

7. Providers and recipients

• Firebase / Google services;
• external AI provider used for product features;
• technical or infrastructure providers;
• payment / billing providers only if active;
• analytics provider only if active;

8. AI-related processing

RistoBoost may include AI features. User inputs may be processed through external infrastructure needed to generate outputs. Users remain responsible for reviewing outputs before use.

9. Transfers outside the EEA

If some providers process data outside the EEA, the final public version must be aligned with the real providers and safeguards used.

10. Retention

Personal data must be kept only for the time necessary for the relevant purposes and according to the internal retention schedule.

11. Rights of the data subject

• access;
• rectification;
• erasure;
• restriction;
• data portability;
• objection;
• withdrawal of consent where applicable;
• right to lodge a complaint with the Italian Data Protection Authority.

12. Security

Appropriate technical and organizational measures should be adopted to protect personal data.

13. Coordination with other documents

This notice should be read together with the Terms of Service, Account Deletion page, and any future subscription terms actually activated.

14. Before final publication

• confirm the real provider list;
• confirm whether analytics is actually active;
• confirm whether subscriptions are actually active;
• align retention wording with the internal retention document;