Where our restaurant listings come from

Updated October 28, 2026

This notice covers restaurant information obtained from other sources, including information about individual proprietors. The Privacy Policy covers people using or contributing to Cibus.

Who is responsible

Skript It Oy (business ID 3483624-4), Kustaantie 9a 2, 01400 Vantaa, Finland, is the controller. Contact: privacy@skriptit.fi.

Sources and information held

Restaurant listings come from the publicly available Overture Maps Foundation Places dataset. Its contributors include Meta, Microsoft, Foursquare, AllThePlaces, PinMeTo, Krick, RenderSEO, DAC and BrightQuery. Each listing carries its source and release attribution. A few listings are added by us from the restaurant's own published details. We do not contact restaurants individually about this notice, including those we added ourselves and Cibus Picks; this notice gives the information instead.

We hold names and search aliases; coordinates and addresses; telephone numbers, websites and social handles; brand identifiers; categories and operating status; source confidence values; and identifiers, versions, sources and licences. For some places we also hold opening hours, closure and move statements, read from the restaurant's own website or its chain's own branch list, with the page text they were read from.

Data licences: Overture data uses CDLA-Permissive-2.0, with Apache-2.0 for Foursquare contributions and CC0-1.0 for AllThePlaces contributions.

Locality search separately uses GeoNames under CC BY 4.0.

Purposes and legal basis

We maintain the catalogue and provide area scans and name searches under Article 6(1)(f) of the GDPR: our legitimate interest in helping people find restaurants in an area, including places whose names they do not know. We also retain removal records under legitimate interests to prevent removed listings from returning, and calculate community badges in our legitimate interest in helping people choose places using recent community answers.

About Most loved in a city

This badge comes from account holders' answers: Not for me, Good or Loved it. We do not check whether they visited. Accounts sign in by email, Apple or Google; rules against invented visits, conflicts of interest and coordinated answers are enforced through reports and review. Individual answers and answer totals are not public.

• Each account counts equally, using its latest answer for the place. Private answers and answers from accounts less than 14 days old do not count. Only the current calendar month and the eleven preceding months count. Answers before a place moved do not count at its new location.
• Restaurants and cafés are compared together within their assigned city or nearby town, using GeoNames localities. The comparison area does not change with your scan.
• A place qualifies with Good or Loved it from at least three accounts. A city needs at least five qualifying places and ten distinct accounts giving Good or Loved it at those places before it awards badges.
• The number of badges is 10% of the qualifying places, rounded down with a minimum of one. Places are ordered by Loved it, then Good and Loved it together, then the latest Loved it visit month. A fixed place identifier breaks any remaining tie. Each winner needs at least one Loved it.
• A place cannot receive the badge when Not for me accounts make up at least a third of its counting accounts. Blocked places and places whose badge is withheld still contribute to the city's qualifying totals; the next eligible place can receive the badge.
• Badges are recalculated weekly and can change or disappear. A badge can be withheld after a report or review. Report a badge in the app or contact us below.

About Cibus Picks

Cibus Picks are our recommendations on independently sourced restaurant listings.

New Picks must have qualifying recognition in dining publications and meet our standards for public feedback. We give similar importance to how positive that feedback is and how much is available, with minimum requirements for both.

Picks research uses publicly available Michelin Guide Bib Gourmand and Selected categories through the third-party michelin-my-maps dataset, aggregate Google Maps ratings and review counts, and names, locations and contact details for matching. We record selection and removal decisions. The purpose is to choose Cibus Picks, and the legal basis is our legitimate interest in offering that selection.

Recipients and international transfers

App users receive listings, published Picks and community badges. Cloudflare, Inc. processes data for hosting, storage and delivery. Anthropic, PBC processes the website text we read for opening hours, closures and moves. Private research is held by Cibus.

Catalogue databases are stored in the EU. Cloudflare also processes data internationally, including in the United States; not all stored copies are restricted to the EU. Its data processing addendum provides for the EU–US Data Privacy Framework and standard contractual clauses for applicable transfers. Anthropic may process website text outside the EU under the standard contractual clauses in its data processing addendum. Contact us for a copy of the safeguards that apply to your data.

Retention

• Catalogue listings: retained while included in the current release, until replacement or removal. Releases are updated on demand. Older database versions are retained for rollback until their storage is reused. Source extracts and release evidence currently have no fixed deletion date.
• Removal records: retained indefinitely while the catalogue is rebuilt to prevent reintroduction. These contain the listing's name, address, coordinates and source identifier, request and decision details and dates, and matching settings and review notes. Request correspondence and the record of its outcome are held separately for three years after the request closes, in our legitimate interest in defending legal claims about how requests were handled.
• Opening hours, closure and move statements: kept until we read the restaurant's site again, and shown only while the listing keeps the name and location they were read for. The page text they were read from is kept until we read that country's sites again.
• Community badges: the current and previous weekly results are kept. A record withholding a badge remains until it is released or the place leaves the catalogue. The Privacy Policy gives the periods for answers and reports.
• Picks: captured Google evidence and recognised report, export and cache copies are kept until we refresh or remove them. Other source files, backups and copies need separate retention review. Membership and necessary selection and removal records are retained while needed to maintain Picks and prevent reintroduction. Inactive publication archives become eligible for on-demand deletion thirty days after registration, except while a publication operation remains unresolved. Deletion is not automatic.

How results are presented

Area scans order places by distance. You can choose to show Picks or Most loved places first; each group keeps distance order. Their filters show only matching places. Picks use the separate selection criteria above.

Your rights

You can request access, correction, erasure or restriction of personal data about you. Send the restaurant name and location to privacy@skriptit.fi; no app account is required. We respond within one month. If a lawful extension is needed, we explain it within that month. Data portability and withdrawal of consent do not apply to this processing based on legitimate interests.

You can object at any time to processing based on legitimate interests. We must stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data for legal claims.

Corrections and removals affect Cibus's records, not the upstream datasets. Removal records help prevent reintroduction, but changed source details can prevent a match. Contact us if a removed listing reappears. Copies already delivered to devices cannot be recalled.

You can complain to the Finnish Data Protection Ombudsman or the supervisory authority where you live, work or believe an infringement occurred.