Last updated: October 2026
Legal notice, privacy and terms
Everything RataMap keeps about you and about the places, on one page. No accounts, no ads, and no analytics unless you accept them.
1. Legal notice (Spanish LSSI-CE art. 10)
Email: hola@ratamap.com. Site: https://ratamap.com.
RataMap is a personal, non-commercial project. It sells nothing, shows no advertising and takes no money from restaurants.
Prices and ratings are user contributions backed by a photo and may have changed. Check before you go. RataMap does not guarantee their accuracy and is not responsible for what you do with them.
User content: prices, photos, ratings and nicknames are published by users. RataMap acts as a hosting provider (Spanish LSSI art. 16 and Digital Services Act art. 6) and is not liable for that content unless it has actual knowledge that it is unlawful; once it does, it removes it expeditiously.
Ratings and the value score are user opinions and an automatic calculation, not statements by RataMap about the quality, hygiene or legality of any venue.
RataMap has no relationship with the venues listed and receives nothing from them, and gives no information on allergens, opening hours or availability. Venue names and trademarks belong to their owners and are used only to identify them.
How to request removal: write to hola@ratamap.com with the page, which content it is and why it is wrong or unlawful. We review it and, where appropriate, remove it within 72 hours.
2. Privacy policy (GDPR / LOPDGDD)
Data controller: the operator of RataMap (hola@ratamap.com). There are no user accounts and no real names. This is what is processed and why:
- IP hash (SHA-256 with a secret salt, not reversible) when you submit a place or report a problem: 10-per-day cap and anti-abuse. Basis: legitimate interest (art. 6.1.f). Deleted after 30 days.
- Feedback form: your message, the language, an IP hash (5-per-day cap; deleted after 30 days) and, if you give one, an email so we can reply. Basis: consent (art. 6.1.a), which you can withdraw by writing to us. The email is deleted once we reply or after 90 days at most; messages after 12 months. Never published. Please avoid putting personal data in the message.
- Device cookie (random identifier, no personal data) so each device votes once per place and month. Basis: legitimate interest. Lasts 2 years; clear your cookies and it is gone.
- Optional nickname you choose, with no identity requirement. Shown on the contributor leaderboard. Basis: consent (art. 6.1.a). Email us to change or delete it at any time.
- Menu or receipt photo: processed first on your device (text reading and blurring of card numbers), then re-encoded on the server with all metadata stripped (GPS, camera model, timestamp). Published next to the price under CC BY 4.0 once approved. If rejected, the file is deleted.
- Dish photo (optional): re-encoded on the server with all metadata stripped and published on the place page, under CC BY 4.0, only once approved. It must not show people. If rejected, the file is deleted.
- Text extracted from the photo, with card numbers removed, becomes part of the open dataset.
- Technical logs kept briefly for security by our hosting (Vercel) and database/storage (Supabase) providers. Both act as processors under art. 28 data-processing agreements; EU regions are selected where available.
Third parties your browser talks to: OpenFreeMap (map tiles; receives your IP like any web server). Text reading of photos runs entirely in your browser with files served from this same domain. No pixels or ad networks.
Analytics (PostHog, EU servers): only if you accept them in the cookie notice. It records page views and a few actions (opening a place, filtering, voting, choosing a photo, submitting a price; never the photo or its text) with a random identifier; it does not record your screen or what you type, and IP addresses are not stored. Basis: consent (art. 6.1.a). Withdraw it any time via "Cookies" in the footer. PostHog Inc. acts as a processor (art. 28 DPA). Data is kept for at most 12 months.
AI-assisted extraction: if the administrator enables it, the already-blurred photo is sent to a vision-model provider (OpenAI) to suggest dish and price. The form says so when it is active; if you do not see that notice, the photo never leaves your device before it is uploaded to RataMap.
Your rights: access, rectification, erasure, objection, restriction and portability by writing to hola@ratamap.com. We answer within one month. You can complain to the Spanish Data Protection Agency (aepd.es). There is no automated decision-making with legal effects and no profiling.
Other people in photos: receipt photos may include the server’s name or a table number. Moderation rejects photos with readable personal data other than the price. If you appear in a photo or you are the restaurant and want it removed, write to hola@ratamap.com: we take it down within 72 hours.
4. Contribution terms and licence
By submitting a place you confirm that: you took the photo or have the right to share it; the price is what you paid or saw on the menu; it contains nobody’s personal data; and the place is not a national chain.
You are responsible for what you submit: if a contribution of yours infringes third-party rights or the law, you are liable for it and will hold the operator harmless from any resulting claims.
Licence for your contributions: you grant RataMap and the public a Creative Commons Attribution 4.0 International (CC BY 4.0) licence over the photo, price, dish and extracted text. It is irrevocable for copies already distributed, but you can ask us to remove your contribution from the site and dataset at any time.
Attribution: "RataMap (ratamap) — CC BY 4.0". The open dataset is published under the same licence; map tiles are © OpenStreetMap contributors and OpenFreeMap. The place search in the add form uses data © OpenStreetMap contributors, available under the ODbL.
Moderation: every contribution goes through a manual queue before publication. We may edit, merge or reject without explanation. "Queso" points have no monetary value and are not transferable.
Restaurants: we charge nothing to be listed or not listed. If you think a price is wrong, submit an updated photo or write to hola@ratamap.com. We remove unlawful content as soon as we have actual knowledge of it (art. 16 LSSI / art. 6 DSA).
Not allowed: aggressive scraping (use the dataset or /api/dataset), automated submissions, fake prices and any unlawful use. We may block abusive IP or device hashes.
Liability: RataMap is free and provided "as is", with no warranty of accuracy, availability or fitness for purpose. To the extent permitted by law, the operator is not liable for indirect damages or for damages arising from use of the site, the dataset or user content, except in cases of wilful misconduct or gross negligence. Nothing here limits the rights consumers have under the law.
Governing law and venue: Spanish law. For consumers, the courts of your domicile; otherwise, the courts of Barcelona. EU online dispute resolution platform: ec.europa.eu/consumers/odr.
5. Security
Photos awaiting moderation are visible only to the moderator; rejected ones are deleted from storage; approved ones are public because they are the proof of the price.
The whole site is served over HTTPS with security headers (CSP, HSTS, no third-party iframes). Moderation passwords are never stored in the database.
If you find a security issue, write to hola@ratamap.com before disclosing it publicly. We will fix it and thank you.