Cookie Policy
Last updated: August 17, 2026 Version: 1.3
This Cookie Policy explains how Food22 uses cookies, local storage and similar technologies across its digital menus, microsites, reservation forms and other web interfaces for diners.
This policy should be read together with the Food22 Privacy Policy.
1. Who uses these technologies
Food22 provides the technology used by restaurants to display menus, receive reservations, manage orders and offer personalization features.
For questions related to this Cookie Policy, you can contact:
hello@food22.club
When a technology is used exclusively to provide Food22 services, Food22 determines how it operates. When a restaurant activates its own advertising or marketing technologies, the restaurant may act as controller for those purposes.
2. What we mean by cookies and similar technologies
A cookie is a small file that a website stores on your device to remember certain information.
Food22 also uses technologies that are not strictly cookies but may perform similar functions:
| Technology | What it is |
|---|---|
| localStorage | Browser storage that may persist between visits until deleted or expired according to the application logic. |
| sessionStorage | Temporary storage that normally disappears when the relevant tab or session is closed. |
| Browser or device identifiers | Identifiers generated from technical browser or device information to distinguish visits or sessions. |
| Third-party technologies | Cookies, storage or identifiers used by providers loaded to deliver specific functions. |
When these technologies are not strictly necessary to provide a service you requested, Food22 activates them only after obtaining your consent.
3. How your consent works
The first time you visit a Food22 interface, we show you a preference panel.
You can:
- accept all optional categories;
- reject them;
- choose categories individually;
- change or withdraw your consent later from “Cookie preferences”.
Optional categories remain disabled until you accept them.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal and does not prevent you from using the basic menu functions.
Preferences related to allergies, intolerances or diets are requested through a specific consent within that feature, separate from general cookie consent.
4. Categories we use
4.1 Strictly necessary
These technologies enable functions requested by the user and cannot be disabled from the consent panel without affecting how the service works.
| Name or type | Purpose | Approximate duration |
|---|---|---|
theme | Remember the selected light or dark mode | Until you change the preference or delete the storage |
food22_language | Remember the selected language | Until you change the preference or delete the storage |
food22_cart, food22_cart_restaurant | Maintain the cart and associate it with the correct restaurant | Until checkout is completed, the cart is emptied or the restaurant changes |
food22_session_id | Maintain a technical session needed for the menu or order flow | During the session or until the relevant storage is deleted |
temp_order_<id> | Temporarily maintain an order while payment is being completed | Until the payment process is completed or abandoned |
sb-<project>-auth-token | Maintain a signed-in Food22 account session | While the session remains active |
food22-diner-flow, food22-selected-restaurant | Maintain the state of the access, registration or restaurant-selection flow | During the relevant flow |
reorder-dismissed-<id> | Remember that you dismissed a functional notice during the session | Until the tab is closed |
| Consent preferences | Remember which categories you accepted or rejected | Until you change your choice or consent needs to be requested again |
| Technical infrastructure security cookies | Protect the platform against automated traffic, abuse and threats | According to the duration defined by the technical provider |
The last category may include technical cookies or identifiers used by infrastructure and security providers to protect traffic, prevent abuse and maintain service availability.
4.2 Analytics
Default status: disabled.
They are activated only if you accept the analytics category.
They allow us to understand how menus and other Food22 interfaces are used and to improve the product.
We may measure:
- menu open and exit;
- time spent;
- scroll depth;
- dishes viewed;
- searches performed;
- language;
- device type;
- referring page or channel;
- aggregated functional events related to menu usage.
Food22 does not store lists of allergies, intolerances, diets or other health-related preferences in analytics events.
When we use a technical identifier to distinguish returning visitors, it is generated only after consent for analytics has been obtained. It is not used to link health data to an identified account.
Planned maximum retention period for analytics data: 14 months, unless anonymized earlier.
4.3 Food personalization and health data
Default status: disabled.
Allergies, intolerances and certain dietary information may reveal health-related data. For that reason, this feature uses explicit and separate consent.
The flow works at several levels:
| Level | What happens | Consent |
|---|---|---|
| Local detection | We may detect certain words or allergies directly in your browser without sending them to the server | Not required when processing remains exclusively on your device |
| Intelligent text analysis | If you authorize it, the text you enter is sent to Food22 and to an artificial intelligence service provider to convert it into a structured list of allergies, foods to avoid and dietary preferences | Explicit consent |
| Dish compatibility check | Your preferences are sent to the Food22 server to compare the profile against ingredients and menu characteristics | Explicit consent |
| Remember preferences on this device | We store the structured lists in food22_profile within localStorage | Separate explicit consent for persistence |
| Save to your account | If you have an account and choose to save your preferences, we associate them with your profile for use on future visits | Explicit consent |
The free text sent to the analysis service is processed to extract preferences. Food22 does not retain that text in the technical logs of the extraction endpoint once the request has finished, unless the user expressly chooses to save it as part of their profile.
Artificial intelligence service providers used for this function process the information under the applicable contractual and data-protection terms. Food22 seeks to limit the data sent to what is necessary to provide the authorized function.
Preferences stored in food22_profile remain until:
- you delete them from your preferences;
- you withdraw the relevant consent;
- you sign out when the device should no longer retain that profile;
- or you delete the data from your browser.
Food22 provides an action to delete preferences stored on the device and, where applicable, in your account.
4.4 Marketing and advertising
Default status: disabled.
Some restaurants may activate third-party advertising or measurement tools to measure campaigns or attribute reservations and other conversions.
These tools load only after you accept the marketing category.
If a restaurant does not use advertising tools within Food22, this category may not appear.
When a restaurant determines the purposes of an advertising campaign, it may act as controller for that activity. Food22 provides the technical infrastructure necessary to run the integration.
5. Third-party services related to the web experience
Food22 uses external providers to deliver certain functions. Depending on the function used, your device may connect directly to third-party services and transmit technical information such as IP address, browser data or identifiers needed to provide that function.
These categories may include:
- infrastructure, hosting, content-delivery and security providers;
- artificial intelligence service providers when you use functions requiring that processing;
- map, location or place-search providers;
- payment providers when you start a payment process;
- remote-content providers used on certain interfaces;
- advertising or measurement providers when a restaurant activates those functions and you give the relevant consent.
The presence of a provider in Food22's infrastructure does not by itself mean that it uses cookies or similar technologies on your device. Optional technologies requiring consent remain disabled until you make the corresponding choice.
Telephone, SMS, WhatsApp, telephone reservations and call-recording services are described in the Privacy Policy, as they do not depend on browser cookies.
6. International transfers
The providers used by Food22 may be established in the European Economic Area or in third countries, including the United States, depending on the function and service used.
Some providers or their subprocessors may therefore process information outside the European Economic Area or the country from which you use Food22.
Where the GDPR applies, any international transfer subject to Chapter V will be carried out using a legally valid mechanism, such as an adequacy decision, the European Commission Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where applicable, or another mechanism recognized by applicable law.
The specific mechanism will depend on the category of recipient, the country and the service used.
7. Retention
As a general rule:
| Category | Retention |
|---|---|
| Strictly necessary technical preferences | While necessary for the relevant function |
| Consent preference | Until you change it or we need to request consent again |
| Analytics | Maximum 14 months |
| Analytics identifiers | Maximum 14 months or until consent is withdrawn |
food22_profile | Until consent is withdrawn, the profile is deleted or the storage is cleared |
| Personalization data saved to an account | Until the user deletes it, withdraws consent or the period defined in the Privacy Policy applies |
| Marketing | According to the provider and never longer than necessary for the stated purpose |
When the applicable period ends, the data is deleted or irreversibly anonymized.
8. How to change or withdraw your consent
You can open “Cookie preferences” from the footer of Food22's public interfaces.
From there, you can change optional categories at any time.
For health data and food preferences, you can also use the specific controls in My preferences to:
- stop using personalization;
- delete stored preferences;
- withdraw consent;
- delete data stored on the device and, where applicable, in your account.
You can also delete cookies and local storage directly from your browser settings.
Please note that deleting strictly necessary technologies may cause functions such as sign-in, language, cart or payment flow to stop working correctly.
9. Your rights
Where cookies or similar technologies involve the processing of personal data, you may exercise the rights recognized by applicable law, including rights of access, rectification, erasure or cancellation, objection, restriction and portability where applicable.
You can contact Food22 at:
hello@food22.club
You may also lodge a complaint with the competent data-protection authority in your country.
- Poland / European Economic Area: in Poland, the supervisory authority is the Urząd Ochrony Danych Osobowych (UODO).
- Mexico: the federal authority competent for personal data protection in possession of private parties is the Secretaría Anticorrupción y Buen Gobierno, under the Federal Law on Protection of Personal Data Held by Private Parties.
10. Changes to this policy
Food22 may update this Cookie Policy when the technologies used on the device, processing purposes, categories of third parties involved or legal requirements change.
Where a change materially affects categories that depend on consent, we will request your choice again where necessary.
The current date and version appear at the beginning of this document.