legal

privacy

1. who is responsible

The controller responsible for data processing on this website is:

Maus and Friends – Sole Establishment
Daniel Maus
Office 1915, Marquise Square Tower
Business Bay, Dubai
United Arab Emirates
Email: daniel@spooon.io

Our representative in the EU under Art. 27 GDPR is:

FERUN – Alte Post GmbH
Kirchplatz 2
83125 Eggstätt
Germany
Email: kontakt@ferun-alte-post.de

2. the short version

On spooon.io we use no analytics or advertising tools. The fonts are hosted on our own server. Cookies are only set on the order page by our payment providers, where needed for a secure payment (see section 5). We store your language choice only in your browser so the site appears in your language on your next visit.

We process personal data when you contact us or place an order, when it is technically necessary to deliver the site, and when we approach restaurants on our own initiative and show them a website draft (see sections 6 and 7).

We are based in the United Arab Emirates and therefore also process data there. There is no European Commission adequacy decision for this country. The GDPR still applies to our processing.

3. hosting and server log files

This website is hosted by Cloudflare, Inc., San Francisco, USA (Cloudflare privacy policy). When you visit the site, the server automatically stores technical information sent by your browser, such as your IP address, date and time of access, the page visited, browser type and operating system.

We need this data to run the website securely and reliably. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Log files are kept only as long as necessary for this purpose and then deleted. As Cloudflare is based in the USA, a transfer there cannot be ruled out; it takes place on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR) or the EU-US Data Privacy Framework (Art. 45 GDPR), where the provider is certified under it.

4. contact by email and form

If you email us or use the enquiry form, we process the details you give us (e.g. name, email address, name of your restaurant, website and your message) to answer your enquiry. Our email runs on Microsoft 365 (Microsoft); a transfer to the USA cannot be ruled out.

For the enquiry form we use the service Web3Forms (web3forms.com). When you submit the form, your details are sent to Web3Forms and forwarded to us by email. A transfer to countries outside the EU cannot be ruled out. More information is in the Web3Forms privacy policy.

The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at a contract, otherwise Art. 6(1)(f) GDPR. We delete your enquiry once it has been dealt with and no statutory retention obligations (e.g. for quotes and invoices) remain.

5. orders and payment (stripe)

When you order a package on our order page (spooon.io/checkout), we process the details you enter there: email address, full name and billing address. We need them to perform the contract, send you your monthly invoice and manage your subscription. The legal basis is Art. 6(1)(b) GDPR (contract); we also keep invoice data for as long as statutory retention obligations apply (Art. 6(1)(c) GDPR).

Payment and monthly billing are handled by the payment service provider Stripe (Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA, and its affiliates, in Europe including Stripe Payments Europe, Ltd., Dublin, Ireland). For this purpose we pass your order details to Stripe. You enter your payment details (e.g. card number, expiry date, security code) directly into an input field provided by Stripe; they are sent to Stripe encrypted, and we never see or store them. On our behalf, Stripe also sends payment confirmations, invoices and notices about failed payments by email and provides the customer portal where you can manage and cancel your subscription.

To keep payments secure and prevent fraud, the order page loads a script from Stripe. Stripe processes technical data such as your IP address, browser and device information and may set cookies required for this. The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interest lies in secure payment processing. These cookies are strictly necessary for the payment you requested (Section 25(2) no. 2 TDDDG). The script is not loaded on the other pages of this website.

Stripe also processes data in the USA. Transfers take place on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR), under which Stripe is certified, and the EU Standard Contractual Clauses (Art. 46 GDPR). For some processing (e.g. fraud prevention and its own legal obligations) Stripe is a controller in its own right. More information: Stripe privacy policy.

If you choose PayPal, your name, email address and payment data are passed to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, or the PayPal company responsible for our account, to process the subscription. For this the order page loads a script from PayPal, which processes technical data such as your IP address and device information and may set cookies required for the payment. The legal basis is Art. 6(1)(b) and (f) GDPR (Section 25(2) no. 2 TDDDG). PayPal is a controller in its own right for payment processing and may process data outside the EU. More information: PayPal privacy policy.

6. when we approach your restaurant

We approach restaurants on our own initiative, including by email. For this we process business contact data: name and address of the business, phone, website, email address, name of the owner and details about the business such as cuisine and closing day.

This data comes from publicly accessible sources, mainly the business’s website and imprint, Google Maps, OpenStreetMap and business directories, and from business data providers such as Clay.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our offer to restaurants. To collect, check and send, we use service providers: Apify (retrieving public data), Clay, MillionVerifier and Scrubby (finding and checking email addresses), Instantly (sending, including recording opens, clicks and replies) and Cloudflare (storage). A transfer to countries outside the EU, in particular the USA, cannot be ruled out.

You can object to this processing and to being approached at any time, for example with a short email to daniel@spooon.io. We will then stop contacting you and keep only what is needed to ensure that. We delete events such as opens and clicks after 90 days at the latest. We delete the remaining contact data when we no longer need it for approaching you.

7. website drafts (demo pages)

We put website drafts online for the restaurants we approach. On these pages we measure page views, clicks, scroll depth and active time. We store this with a random identifier per visit and the address of the draft. Because each draft belongs to a specific restaurant, we can attribute visits to that restaurant. We do not store IP addresses for this, and the measurement sets no cookies. The data is held at Cloudflare and deleted after 90 days at the latest.

This shows us whether the draft was viewed and whether we should follow up. The legal basis is Art. 6(1)(f) GDPR. You can object to this at any time as well. The drafts also load fonts from Google Fonts (Google Ireland Limited, Dublin); your IP address is sent to Google, and a transfer to the USA cannot be ruled out.

8. links to other websites

On this site we link to restaurant websites. You only leave our site once you click such a link. The respective operator is responsible for data processing there.

9. your rights

You have the right at any time to

A short email to daniel@spooon.io is enough.

10. right to complain

If you believe we are not handling your data properly, you can complain to a data protection supervisory authority in the EU, in particular in the member state where you live or work.

11. changes

We update this privacy policy when the website or legal requirements change. The version published here applies.

Last updated: November 2026