Privacy Policy

Overview

AspireCore LLC ("we", "us", "our") operates Servd (the "Service"). This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over it.

We aim to collect the minimum data required to make the Service work, keep it on systems we control where reasonable, and never sell it to third parties for advertising.

Information You Provide

When you create an account or use the Service, you may provide:

• Account info: email, display name, handle, profile photo, bio, and your date of birth (used to confirm you are 18 or older).
• Home city + cities you frequent (Taste Travels).
• Plate posts: photos, dish names, captions, restaurant tags, flavor reactions, comments.
• Dish ratings + reviews you write.
• Memory queries (natural-language searches like "the lamb taco I had in Mexico City").
• Friend requests + accepted friendships.
• Private messages and attachments you send, including voice memos. Messages are stored on our servers and protected by access controls; they are not end-to-end encrypted.
• TONIGHT session participation (group restaurant decisions).
• Booking confirmations you log via the post-booking sheet.
• Removal requests: if you ask us to take down an intimate image, the name, email address and details you give us. You do not need an account to ask.

Information Collected Automatically

When you use the Service, we automatically collect:

• Device info: device model, OS version, app version, language.
• Approximate location, when you grant the OS permission, used to surface restaurants near you. We do not track your precise location in the background.
• Approximate location you choose to share with a TONIGHT group: sharing is off unless you switch it on, and you switch it on per session. When you do, the app rounds your location to roughly a kilometre before it leaves your device and never stores it more precisely than that. It is used only to centre the group's restaurant suggestions fairly between everyone instead of around whoever started the session, it is visible only to people in that session, and it is erased when the session ends.
• A push-notification token for each device where you allow notifications — an identifier issued by the device's operating system that lets a notification reach that install. It is stored with your account, replaced when the device issues a new one, removed when you sign out of that device, and deleted with your account.
• Usage telemetry and diagnostics: feature interactions, error and crash reports, performance metrics. These events are recorded against your account so we can reproduce a problem you hit and tell whether a feature works. They are kept for up to 90 days and then deleted automatically. If you delete your account, the link between these events and you is severed at once and only de-identified records remain. Telemetry is never used for advertising and is never sold.
• Purchase receipts and subscription status from the app store when you buy a subscription. We never receive your card or bank details.
• IP address, used by our cloud infrastructure for security and rate limiting.

How We Use Your Information

We use your information to:

• Provide, operate, and improve core features (your feed, dish ranking, restaurant briefs, friend graph, group decisions, bookings).
• Personalize content based on your taste profile and history.
• Process your subscription purchases and manage access to paid features.
• Send transactional notifications (friend accepted you, your TONIGHT group made a pick, your booking was confirmed).
• Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms.
• Comply with legal obligations and respond to lawful requests.

Service Providers We Use

To provide the Service, we share data with a small set of service providers. Each receives only the minimum data needed for its function, and providers processing personal information on our behalf are bound by data-processing agreements:

• Cloud database and application hosting — stores your account, plate posts, friendships, and most app data, and runs our server-side functions.
• AI model provider — generates dish recommendations and restaurant briefs, interprets your natural-language searches, and reads the photos you submit to features like Taste DNA, the plate scanner, and the check scanner that reads a restaurant bill so a group can split it. That last one means a photo of a paper check — which can show the venue, the items ordered, and the totals — is transmitted for reading like any other photo you submit. Photos you submit to these features ARE transmitted to the provider for processing and are discarded by us after the response — only the resulting structured palate axes, dish reads, descriptors, and (for a check) the line items you then edit and split are saved. We do not send your name, email, or other account identifiers with these requests.
• Chat assistance — when you request a message summary or translation, the relevant message text is transmitted to our AI provider. We do not attach sender names or account identifiers to these requests, but names, contact details, or other personal information written inside the messages are part of that text. Updated app versions ask you to allow AI chat assistance before using these features; you can withdraw that permission for your account on that device in Chat & Privacy. Withdrawing permission stops future requests from that device and does not undo processing already completed.
• Venue-data and availability providers — supply restaurant information, menus, and reservation availability drawn from venues' own published materials and public listings. When you check availability we send venue identifiers and your party size and time; we never send your account details to these providers or to any venue platform.
• Google (Google Maps Platform) — restaurant data, photos, and reviews. Google's handling of data is described in the Google Privacy Policy at https://policies.google.com/privacy.
• Apple / Google (sign-in providers) — only if you choose to sign in via these.
• Email delivery provider — sends the emails for restaurants' group dinner pages: sign-in links, email confirmations, booking emails and calendar files. It receives each recipient's address and the email itself, with open and link tracking turned off.
• Apple App Store / Google Play (purchases) — process payment for any subscription you buy. We receive purchase receipts and subscription status, validated for us by a subscription-management provider; your payment details stay with Apple or Google.
• Push-notification delivery — a push-delivery service that receives your device's notification token and the contents of the notification, and hands them to Apple's and Google's device-push networks for delivery. Used only for the transactional pushes you opt into.
• Error and crash reporting — receives technical diagnostics (device model, OS version, what the app was doing when it failed) so we can find and fix defects. Not used for advertising.
• Live-video infrastructure — real-time streaming and video-delivery providers that carry the audio and video of live broadcasts and replays between you and your viewers.

How We Share Your Information

We share your information only as described in this policy. Specifically:

• With other users when you opt in: e.g., your handle + display name + avatar are visible to anyone who can see your plate posts (per your visibility settings); your taste DNA may be used (in aggregate, not exposed) to help your TONIGHT group decisions.
• With service providers (above) under written data-processing agreements.
• In response to valid legal requests (subpoena, court order, government investigation).
• In connection with a business transaction (merger, acquisition, asset sale) — we will notify you and you will have an opportunity to delete your account before any transfer.
• We do NOT sell your personal information for advertising. We do NOT share your taste DNA, plate posts, or memory queries with advertisers.

Your Choices and Controls

You have the following controls:

• Edit profile: change name, handle, bio, home city, cities, photos at any time.
• Plate visibility: choose "public" or "Circle-only" per post.
• Friend control: send, accept, decline, or remove friendships at any time.
• TONIGHT participation: decline an invite at any time; the initiator can cancel a session.
• Subscriptions: manage or cancel an auto-renewing subscription at any time in your device's app-store subscription settings.
• Notifications: control via the OS permissions or in-app settings.
• Chat assistance: in updated app versions, allow or turn off message summaries and translations in Chat & Privacy on each device. Sending and reading messages does not require allowing AI chat assistance.
• Location: revoke OS location permission at any time; you can still use most features but restaurant lists default to a fallback location.
• Account deletion: delete your account and associated data via the in-app data deletion flow (see the "Data Deletion" page).

Your Privacy Rights

Depending on where you live, you may have additional rights under laws like the California Consumer Privacy Act (CCPA), the EU General Data Protection Regulation (GDPR), the UK Data Protection Act, or Canadian PIPEDA, including:

Where the GDPR applies, our legal bases for processing are: performance of our contract with you (running the Service you signed up for); your consent, which you may withdraw at any time (for example, location permission and photo features); our legitimate interests (keeping the Service secure, preventing abuse, improving features); and compliance with legal obligations.

• Right to access — request a copy of the personal information we hold about you.
• Right to correction — request that we fix inaccurate information.
• Right to deletion — request that we delete your data (see Data Deletion).
• Right to portability — request your data in a machine-readable format.
• Right to restrict or object to certain processing.
• Right to withdraw consent for processing that relies on consent.
• Right to lodge a complaint with your local data-protection authority.

Data Retention

We retain your account data for as long as your account is active. Content you have published (plate posts) stays on your profile until you delete it or delete your account. When you delete your account, we delete your personal information from our active systems within 30 days, except where retention is required by law (e.g., financial records) or where data has already been de-identified or aggregated for analytics.

Backups containing your data may persist for up to 90 days after deletion; they are not used for any active processing and roll off according to our backup rotation.

We keep a removal request for three years so we can show how we handled it, then delete it. When someone reports content, we keep the report and our decision. If we remove a comment, we keep a copy of it with that record.

Security

We use industry-standard practices to protect your data — encrypted connections (TLS 1.2+), encryption at rest where supported by our cloud providers, scoped access controls, and per-user access rules enforced at the data layer. No system is perfectly secure; please use a strong, unique password and notify us immediately at the contact below if you suspect unauthorized access to your account.

Children's Privacy

Servd is for adults 18 and over. We ask for your date of birth when you create an account and enforce the 18+ requirement at account creation. The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 — or any child under 13 — has provided us with personal information, contact us and we will delete it.

International Transfers

We are based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or any country where our service providers operate. By using the Service, you consent to this transfer.

Our Websites

Our public web pages (for example theservd.com and aspirecorellc.com) use Google Tag Manager to measure page visits. Those analytics run on the websites only — they are separate from the app and are not linked to your Servd account. You can limit them with standard browser controls such as content blockers and cookie settings.

Do Not Track

Some browsers can send a "Do Not Track" signal. There is no common industry standard for what a site must do when it receives one, and our websites do not currently respond to it. We say so plainly because California law requires us to disclose how we treat that signal rather than leave you guessing.

What that signal usually aims at is not something we do in the first place: we do not follow you across other companies' websites or apps to build an advertising profile, and we do not sell your personal information for advertising (see "How We Share Your Information"). The website analytics described above can be blocked with ordinary browser controls.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be surfaced in the app and the "Last updated" date above will change. We encourage you to review this page periodically.

Contact Us

For privacy questions, requests to exercise rights, or to report a privacy concern, contact us at privacy@aspirecorellc.com.

AspireCore LLC

Group Dinner Pages (theservd.com/g/)

On our group dinner pages, a group plans a set-menu dinner at one restaurant: an organizer starts a plan and shares a link, and each guest picks a night and a course and, if they choose, shares their allergies. No app or account is needed. The demo, theservd.com/g/demo, uses a fictional restaurant ("Juniper & Rye"); a restaurant that signs up with Servd has its own page, as described under "Real restaurants" below. This section covers these pages; the rest of this policy covers the Servd app and applies to them where it fits.

What we collect on these pages:

• A first name for each person at the table. We don't ask for last names, email addresses or phone numbers.
• Each person's answers: which nights work and which course they pick.
• Allergies, only if you tick the box to share them: which of the nine major allergens you report, one level for how serious they are (prefer to avoid, allergy or severe), and a note to the chef of up to 200 characters. These are what you tell us. We don't check them, and they are no substitute for telling the restaurant at the table.
• When someone starts a plan, a one-way code made from their network address (for IPv6, from its network prefix) with a secret key we keep private. It lets us limit how many plans one network can start; we don't store the address itself, and the code is deleted within a day.
• Cookies that keep your own plan, your seat or the restaurant's view open on this browser. They are needed for the page to work, last a day and aren't used for analytics or advertising. These pages don't load Google Tag Manager or any other analytics.
• A bot check (Cloudflare Turnstile) when you start a plan. Cloudflare processes signals from your browser and network, including your IP address (our server also passes it to Cloudflare when it checks the result), to tell people from automated traffic.

Who sees what:

• The restaurant's view of a plan shows each guest's first name and course and, for guests who chose to share them, their allergies and note, on its prep sheet and in a file it can download.
• In the demo, whoever starts a plan also plays the restaurant, so they see the shared allergy answers of the guests they invite. The page says so before a guest shares anything, and asks everyone to use made-up details.
• In the organizer's own view, they see each guest's progress but not their allergies; in the demo they also see the shared allergy answers in the restaurant's view, as described above. Guests see the organizer's first name, but not other guests' names or individual answers (they do see how many people can make each night).
• Our cloud database and hosting providers (see "Service Providers We Use") store and process this data for us. We don't sell it, use it for advertising or link it to Servd app accounts.

Withdrawing consent: open your invitation link again, choose "Change my answers", and on the allergy step untick every allergen and clear the note before you continue. That removes your allergies and your note from the plan. In the last day before the dinner, answers can no longer be changed through the link; tell the restaurant at the table, or email us (below).

How long we keep it: a demo plan stops working within 24 hours of starting, and an hourly job deletes it, with everything typed into it, within about 25 hours of starting. Copies can remain in our database backups after that until they roll off, as described in "Data Retention"; they aren't used for anything else.

Deleting it sooner: email privacy@aspirecorellc.com with the plan's link, or the night and the first name used, and we will delete it.

Real restaurants

A restaurant that has signed up with Servd has its own page, theservd.com/g/ followed by its name. Those pages work as described above, with these differences:

• The organizer gives their email address, and a phone number if they choose, and ticks a box agreeing that the restaurant receives their name, email and any phone number for this booking. We use the address to confirm that it is theirs (with a one-time link that works for 7 days), to send the booking email and calendar file when the restaurant confirms or cancels, and for this plan's own messages, such as the list of guests who haven't finished. We send nothing else to it. Guests still give only a first name: we don't ask guests for email addresses or phone numbers.
• These pages don't ask about allergies. Tell the restaurant directly.
• The restaurant receives the organizer's first name, email address and any phone number, and each guest's first name, the nights they can make and the course they pick. Servd processes this booking data for the restaurant, as its service provider.
• The restaurant's staff sign in with their work email and a one-time link. We keep their email address and first name. Their sign-in cookie lasts up to 30 days at a time, and 90 days at most.
• The cookies that keep a plan or a seat open on this browser last until the browser drops them (at most 400 days). They open nothing once the plan's data is deleted.
• Our email delivery provider sends these emails for us (see "Service Providers We Use"), with open and link tracking turned off.

How long we keep a real restaurant's plans: the organizer's email address and any phone number, and every guest's first name and answers, are deleted 30 days after the dinner; for a plan that is never confirmed, 7 days after its last hold ends or its last open night passes, whichever is later; for a cancelled plan, 7 days after it is cancelled. What remains is a count for the restaurant's report (party size, menu, room, night, status and where the plan came from), with no names, addresses or phone numbers. The text of each email is deleted 14 days after it is sent; a record that it was sent, without its text, is kept for 13 months. Sign-in links are deleted after a day, and ended sign-ins 7 days after they end. When a restaurant leaves Servd, everything about its plans is deleted within 30 days. Copies can remain in our database backups until they roll off, as described in "Data Retention".