Privacy Policy

1. Information We Collect

We collect information you provide when you create an account, use our services, or communicate with us.

This includes restaurant details, menu content, payment information, and customer feedback.

• Restaurant name, address, and contact details
• Owner account email and hashed password
• Menu items, categories, prices, and allergen information
• Payment billing details (processed via Stripe - we do not store card numbers)
• Visits to our public website pages, measured with Google Analytics only if you allow it
• Support correspondence and feedback submissions

2. How We Use Your Information

We use your data to operate, maintain, and improve Menuté, process transactions, send updates, respond to requests, and analyze usage trends.

• Deliver and operate the digital menu platform
• Process subscription payments and send receipts
• Send transactional emails: account verification, password reset, billing notices
• Analyze aggregate usage trends to improve platform features
• Respond to support requests and bug reports
• Comply with legal obligations under Romanian and EU law

3. Data Storage and Security

Data is stored securely using Supabase with enterprise-grade encryption and SSL/TLS for data in transit.

• All data stored in EU-based data centers (Frankfurt region)
• Encryption at rest using AES-256
• Encryption in transit via TLS 1.2 or higher
• Row Level Security (RLS) ensures each restaurant accesses only its own data
• Supabase infrastructure meets SOC 2 Type II standards
• Access logs retained for 90 days for security auditing

4. Data Sharing

We do not sell personal information. Data is shared only with service providers, when required by law, or to prevent fraud.

5. Cookies and Tracking

We use strictly necessary cookies to keep you signed in to the restaurant dashboard (Supabase session cookies) and to remember your language (NEXT_LOCALE). Your cookie choice, your preferred language (preferredLanguage) and, on restaurant menus, your allergen filter are kept in your browser's local storage; your menu cart is kept in session storage until you close the tab or place the order. None of these is sent to us until you place an order. These need no consent; blocking them in your browser can break sign-in.

Restaurant menus opened from a QR code, table ordering and waiter calls run no analytics or tracking. If a diner chooses to type a name when ordering or rating a dish, it is sent to that restaurant with the order or review.

Google Analytics. If you choose Allow analytics in the cookie banner, we use Google Analytics 4, provided by Google Ireland Limited, to measure visits to our public pages (home, blog, contact, integrations, partners, privacy, terms and sitemap). It never runs on restaurant menus opened from a QR code, on table ordering or waiter calls, in the restaurant dashboard, the admin area, login and registration pages, invitations, or any page whose address carries a token.

Google Analytics is loaded only after you allow it. It sets the cookies _ga and _ga_<ID>, which last up to 2 years. Advertising features, ad personalisation and Google signals are switched off. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can withdraw your consent at any time with the Cookie settings button at the bottom left of our public pages. When you do, we delete the _ga cookies and Google Analytics stops loading. Google may process data in the United States under the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses. Google's privacy policy: https://policies.google.com/privacy

6. Your Rights

You may access, correct, delete, or export your data and withdraw consent at any time. Under GDPR, EEA residents have the following rights:

• Right of access - request a copy of all data we hold about you
• Right to rectification - correct inaccurate or incomplete data
• Right to erasure - request deletion of your account and all associated data
• Right to portability - export your menu content and account data in JSON format
• Right to restrict processing - limit how we use your data
• Right to object - opt out of analytics and non-essential processing
• Right to lodge a complaint with the Romanian National Supervisory Authority (ANSPDCP)

7. GDPR Compliance

European Economic Area users have GDPR rights and we provide mechanisms to exercise those rights.

8. Children's Privacy

The Service is not intended for children under 18 and we do not knowingly collect their data.

9. Changes to This Policy

We may update this policy and will update the "Last updated" date when changes are published.