Where our restaurant listings come from

Updated September 23, 2026

This notice covers restaurant information obtained from other sources, including information about individual proprietors. The Privacy Policy covers people using or contributing to Cibus.

Who is responsible

Skript It Oy (business ID 3483624-4), Kustaantie 9a 2, 01400 Vantaa, Finland, is the controller. Contact: privacy@skriptit.fi.

Sources and information held

Restaurant listings come from the publicly available Overture Maps Foundation Places dataset. Its contributors include Meta, Microsoft, Foursquare, AllThePlaces, PinMeTo, Krick, RenderSEO, DAC and BrightQuery. Each listing carries its source and release attribution. A few listings are added by us from the restaurant's own published details.

We hold names and search aliases; coordinates and addresses; telephone numbers, websites and social handles; brand identifiers; categories and operating status; source confidence values; and identifiers, versions, sources and licences.

Data licences: Overture data uses CDLA-Permissive-2.0, with Apache-2.0 for Foursquare contributions and CC0-1.0 for AllThePlaces contributions.

Locality search separately uses GeoNames under CC BY 4.0.

Purposes and legal basis

We maintain the catalogue and provide area scans and name searches under Article 6(1)(f) of the GDPR: our legitimate interest in helping people find restaurants in an area, including places whose names they do not know. We also retain removal records under legitimate interests to prevent removed listings from returning, and calculate community badges in our legitimate interest in helping people choose places using recent community answers.

About Most loved in a city

This badge comes from account holders' answers: Not for me, Good or Loved it. We do not check whether they visited. Accounts sign in by email; rules against invented visits, conflicts of interest and coordinated answers are enforced through reports and review. Individual answers and answer totals are not public.

• Each account counts equally, using its latest answer for the place. Private answers and answers from accounts less than 14 days old do not count. Only the current calendar month and the eleven preceding months count. Answers before a place moved do not count at its new location.
• Restaurants and cafés are compared together within their assigned city or nearby town, using GeoNames localities. The comparison area does not change with your scan.
• A place qualifies with Good or Loved it from at least three accounts. A city needs at least five qualifying places and ten distinct accounts giving Good or Loved it at those places before it awards badges.
• The number of badges is 10% of the qualifying places, rounded down with a minimum of one. Places are ordered by Loved it, then Good and Loved it together, then the latest Loved it visit month. A fixed place identifier breaks any remaining tie. Each winner needs at least one Loved it.
• A place cannot receive the badge when Not for me accounts make up at least a third of its counting accounts. Blocked places and places whose badge is withheld still contribute to the city's qualifying totals; the next eligible place can receive the badge.
• Badges are recalculated weekly and can change or disappear. A badge can be withheld after a report or review. Report a badge in the app or contact us below.

About Cibus Picks

The crown identifies Cibus’s selection, separate from the Most loved community badge.

Picks are chosen using restaurant-guide categories and aggregate online ratings and review volume.

Picks research uses publicly available Michelin Guide Bib Gourmand and Selected categories through the third-party michelin-my-maps dataset, aggregate Google Maps ratings and review counts, and names, locations and contact details for matching. We record selection and removal decisions. The purpose is to compare restaurants for Cibus's public selection. The proposed legal basis is legitimate interests in providing that selection; this additional basis remains subject to assessment.

Recipients and international transfers

App users receive listings, published Picks and community badges. Cloudflare, Inc. processes data for hosting, storage and delivery. Private research is held by Cibus.

Catalogue databases are stored in the EU. Cloudflare also processes data internationally, including in the United States; not all stored copies are restricted to the EU. Its data processing addendum provides for the EU–US Data Privacy Framework and standard contractual clauses for applicable transfers. Contact us for a copy of the safeguards that apply to your data.

Retention

• Catalogue listings: retained while included in the current release, until replacement or removal. Releases are updated on demand. Older database versions are retained for rollback until their storage is reused. Source extracts and release evidence currently have no fixed deletion date.
• Removal records: retained indefinitely while the catalogue is rebuilt to prevent reintroduction. These contain the listing's name, address, coordinates and source identifier, request and decision details and dates, and matching settings and review notes. Request correspondence and the record of its outcome are held separately for three years after the request closes, in our legitimate interest in defending legal claims about how requests were handled.
• Community badges: the current and previous weekly results are kept. A record withholding a badge remains until it is released or the place leaves the catalogue. The Privacy Policy gives the periods for answers and reports.
• Picks: captured Google evidence and recognised report, export and cache copies become eligible for on-demand deletion after thirty days. Other source files, backups and copies need separate retention review. Membership and necessary selection and removal records are retained while needed to maintain Picks and prevent reintroduction. Inactive publication archives become eligible for on-demand deletion thirty days after registration, except while a publication operation remains unresolved. Deletion is not automatic.

How results are presented

Area scans order places by distance. You can choose to show Picks or Most loved places first; each group keeps distance order. Their filters show only matching places. Picks use the separate selection criteria above.

Your rights

You can request access, correction, erasure or restriction of personal data about you. Send the restaurant name and location to privacy@skriptit.fi; no app account is required. We respond within one month. If a lawful extension is needed, we explain it within that month. Data portability and withdrawal of consent do not apply to this processing based on legitimate interests.

You can object at any time to processing based on legitimate interests. We must stop unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data for legal claims.

Corrections and removals affect Cibus's records, not the upstream datasets. Removal records help prevent reintroduction, but changed source details can prevent a match. Contact us if a removed listing reappears. Copies already delivered to devices cannot be recalled.

You can complain to the Finnish Data Protection Ombudsman or the supervisory authority where you live, work or believe an infringement occurred.