Privacy Policy

Last updated: 2026-07-16

This privacy policy explains what personal data the MensaPlus mobile application and website process, on what legal basis, and what rights you have. It applies to all versions of the MensaPlus app (Android, iOS, WeChat Mini Program) and this website.

1. Data Controller

The data controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR) is:

Xiaoyu Yin
Jingxing Apartments Zone B, Building 8, Unit 1, Apt 401
Suzhou Industrial Park
Suzhou, Jiangsu Province 215123
People's Republic of China
contact@mensaplus.com

2. Data We Process

MensaPlus is designed to work with minimal personal data. Most of your data stays on your device.

Backend API Access

When the app queries our backend (api.mensaplus.com) to fetch canteen and menu data, our server receives standard HTTP request metadata:

• IP address (used only during the request; not stored beyond short-term server logs)
• User agent string (device type, app version)
• Timestamp of the request and the API endpoint accessed

privacy.legalBasisLabel: Art. 6(1)(f) GDPR — legitimate interest in operating and securing the service.

privacy.retentionLabel: Standard access logs are retained for up to 30 days for security and debugging purposes, after which they are automatically deleted.

Third-Party Services

The app uses the following third-party services, which may collect data as described in their own privacy policies:

• Firebase Analytics & Crashlytics (provider: Google Ireland Limited): Usage analytics and crash reports (device identifier, app usage events, crash traces). Data is processed in the EU and USA. See firebase.google.com/support/privacy
• Google AdMob (provider: Google Ireland Limited): Advertising identifier and ad interaction data used to serve and measure ads. Consent for personalized advertising is collected on first launch via the Google User Messaging Platform. See policies.google.com/technologies/ads
• Google Play Services (provider: Google Ireland Limited): Google Play delivers app updates and manages billing / licensing (Android only). See policies.google.com/privacy
• Firebase Remote Config (provider: Google Ireland Limited): Fetches feature flags and configuration from Firebase. Does not identify individual users. Same provider as Firebase Analytics.

privacy.legalBasisLabel: Art. 6(1)(a) GDPR — your consent (for AdMob personalized ads and analytics beyond what is strictly necessary), and Art. 6(1)(f) GDPR — legitimate interest (for crash reporting and non-personalized ads).

Location Data

If you grant location permission, MensaPlus reads your device's current location on your device only, in order to rank nearby canteens. Your coordinates are not sent to our backend or to any third party. You can revoke location permission at any time in your device settings.

privacy.legalBasisLabel: Art. 6(1)(a) GDPR — your consent, which you grant by allowing the permission.

privacy.retentionLabel: Not retained. Coordinates exist only in memory during the ranking calculation.

Favorites, Frequency, and Settings

Your favorited canteens, usage frequency, and app settings are stored only on your device. We do not sync this data to any server. Uninstalling the app removes it.

3. International Data Transfers

Our backend infrastructure is hosted in the European Union (Microsoft Azure, North Europe region). Third-party services (Google Firebase, Google AdMob) may process data in the United States under Standard Contractual Clauses and the EU-US Data Privacy Framework. As the data controller is based in China, some administrative access to logs may occur from China; no user personal data is transferred to Chinese servers.

4. Your Rights under the GDPR

If you are located in the EU/EEA, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You may request confirmation of whether we process personal data about you and, if so, obtain a copy.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR): You may request that we limit the processing of your personal data in certain circumstances.
• Right to data portability (Art. 20 GDPR): You may request a machine-readable copy of the data you have provided.
• Right to object (Art. 21 GDPR): You may object to processing based on legitimate interest, including profiling for advertising.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at contact@mensaplus.com. Because we do not store account-level personal data (we do not require user accounts), a request for access or deletion will generally be a no-op — we do not have data tied to you to return or delete.

5. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR. For users in Germany, this is typically the state data protection authority (Landesdatenschutzbeauftragter).

6. Children

MensaPlus is intended for university students and staff, generally aged 16 and older. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected such data, we will delete it.

7. Data Security

We use HTTPS for all connections between the app and our backend and store application data encrypted at rest at our hosting providers. No internet transmission or electronic storage is 100% secure, so we cannot guarantee absolute security.

8. Changes to This Policy

We may update this privacy policy from time to time. The current version, together with its last-updated date, is always available at mensaplus.com/privacy. Substantive changes will be highlighted in the app or via release notes.

9. Contact

For any questions about this privacy policy or your personal data, please contact us at contact@mensaplus.com