Privacy policy

Guests viewing a menu

If you opened a restaurant's menu by scanning a QR code or following a link, this is everything that happens on our side:

• No cookies. Public menu pages don't set cookies, local storage identifiers or any other tracking identifiers for diners.
• No IP addresses or user agents are stored. Your browser's user-agent string is read once, at the moment of the request, to work out a coarse device class (mobile, tablet or desktop) and to filter out bots. It is then discarded.
• What we do record so the restaurant can see how its menu is used: the type of event (a menu view, a QR code scan or a dish being opened), the restaurant, menu, dish or QR code it relates to, the coarse device class, the host name of the referring website (for example instagram.com — never the full address), and the time.
• Do Not Track and Global Privacy Control are honoured. If your browser sends either signal, no event is recorded at all.

These events can't be used to identify you or to follow you between visits or between restaurants. Like any website, the infrastructure that delivers the page necessarily sees your IP address in order to send it to you; MenuMint does not keep it as part of its analytics.

Menu content — dishes, prices, allergen and dietary information — is provided by the restaurant, which is responsible for its accuracy. Please always tell the restaurant's team about allergies before ordering.

Restaurant owners and team members

What we collect

• Account details: your name, email address and a securely hashed password (or sign-in managed by our authentication provider).
• Restaurant content you add: restaurant details, menus, dishes, photos, logos, branding choices and QR code settings.
• Team members you invite: their name, email address and role.
• Billing: payments are handled by Stripe. We never see or store your full card number; we keep your plan, subscription status and the Stripe customer and subscription identifiers needed to manage it.
• A session cookie that keeps you signed in. It is strictly necessary and isn't used for tracking.

How we use it

• To provide the service: hosting your menus, generating QR codes and showing you analytics.
• To process subscriptions and send essential account and billing messages.
• To keep the service secure and prevent abuse.

Service providers

We use a small number of providers to run MenuMint: a hosting provider to serve the website, Supabase for our database, authentication and file storage, and Stripe for payments. They process data on our behalf and only as needed to provide their service.

Retention and deletion

We keep your account and restaurant content for as long as your account is active. When you delete your account, or ask us to, we delete your content and the analytics events tied to your restaurants, except where we must keep limited records (such as invoices) to meet legal obligations.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how it's used. Account holders can update most information directly in the dashboard. For anything else, contact the MenuMint team and we'll respond within 30 days. Because we don't store identifiers for diners, we can't link analytics events to an individual guest.

Changes

If we make material changes to this policy we'll update the date above and, for account holders, let you know before the changes take effect. See also our terms of service.