Privacy Policy

This Privacy Policy explains how MenusM collects, uses, and protects personal data. Restaurant owners and guests can both create an account. Business content a restaurant publishes is displayed publicly to anyone visiting MenusM.

You decide what to upload and what appears on your public venue page. MenusM stores and displays your data to operate the service but does not verify that your information is complete, correct, or lawful.

We reserve the right to change this policy at any time. Changes take effect upon publication on the website.

Only persons who have reached 18 years of age may use MenusM services. By registering, you confirm that you are of legal age and have the authority to represent the relevant restaurant or café.

Who is responsible

The controller is the operator of MenusM named below. The legal name, identification number, and address are taken from the site owner settings and apply as published there. For privacy requests, email the address below. There is no separate data-protection officer; use that email.

Your responsibility for your information

Before you save or publish anything on MenusM, you are solely responsible for:

• Ensuring details are accurate: contact info, location, menu, prices, and opening hours.
• Having a lawful basis to use and display any personal data in photos, staff names, or guest-facing content.
• Not uploading sensitive data (e.g. payment card numbers, health records, private guest details) unless you have a legal reason and appropriate safeguards.
• Reviewing what becomes public: menus, feed posts, map pin, ratings, and QR pages are visible to guests and may be indexed by search tools.

1. What we collect

• Account data: name, email, password hash, and profile details you provide.
• Restaurant data: venue name, location, menu content, and uploaded media you choose to add.
• Operational data: logs, basic analytics, and security-related events.
• Guest interaction data: ratings, session identifiers, and approximate location when guests use map or discovery features (where enabled).
• Optional PWA and push data: if you install the app or enable notifications, we store a push subscription, anonymous visitor ID, language preference, and technical data needed to deliver alerts.
• If you send an order with Share, the text stays in your browser until you send it yourself. MenusM does not receive that copy.
• If you send an order by email, MenusM stores your name, phone number, and the order text, emails them to that restaurant, and shows them to the restaurant owner. If you are signed in, the owner also sees the email and WhatsApp number on your guest account.
• If you save a restaurant, that restaurant's owner sees your name, account email, and WhatsApp number. Other guests on the public page see your name and photo only, not your email or phone.

2. How we use data

We process data you provide to run the service: account access, hosting your menu and public pages, feed and map display, service emails, product improvement, and security. We do not use your business content to verify factual accuracy — that remains your responsibility.

Table reservations

A table reservation requires a MenusM account. Email and phone are taken from that account. A WhatsApp number is required before the booking is sent. The guest also chooses the date, time, party size, and an optional note. MenusM does not build marketing lists or analytics on reservation data.

• We use those details only to record the booking request, deliver confirmation emails to the guest and the venue owner, and let the owner manage the reservation.
• We do not sell reservation data or use it for advertising. Data is kept only as long as needed to operate the booking feature.

Install app (PWA)

MenusM can be installed on your device as a Progressive Web App from the site menu. This is optional.

• Installation uses your browser's built-in add-to-home-screen or install prompt; we do not receive a separate app-store account.
• A service worker may cache pages and assets on your device to load the site faster and support optional features. You can remove the installed app through your browser or device settings at any time.

Push notifications (optional)

Guests and visitors without a MenusM account may turn on browser push notifications from the site menu. This is entirely optional and requires your explicit permission in the browser.

• If you enable notifications, we store a push subscription (endpoint and encryption keys) linked to an anonymous visitor identifier and your selected site language.
• We may send alerts about new restaurants on MenusM, new dishes on venue menus, and new feed posts. We do not send third-party marketing and do not sell subscription data.
• You can turn notifications off at any time from the site menu or through your browser or device notification settings. Disabled subscriptions are removed from our servers when possible.
• Push delivery depends on your browser, device, and network; we cannot guarantee that every alert will arrive.

When you register or sign in, we process your email, name, and related account fields to create and secure your profile. If owner registration limits apply, we also use aggregate slot counts (free and paid capacity) to decide whether new sign-up is accepted and may display approximate availability on the Pricing page. We do not sell this information.

3. Cookies and browser storage

MenusM uses browser storage and, with your consent, analytics cookies. We do not use cookies for advertising profiles or to sell your data.

• Essential storage (localStorage/sessionStorage): site language, login session, dashboard preferences, and an anonymous visitor identifier used for ratings and core platform features. These are needed to run the service and are not used for third-party marketing.
• Analytics cookies (optional): if you accept analytics in our cookie notice, Google Analytics may set cookies (such as _ga) to measure traffic and usage. MenusM also records anonymous venue and ad metrics on our own servers using the visitor identifier — without building marketing profiles.
• Cookie choice: you can accept or decline optional analytics cookies via the banner on first visit. You can change your mind by clearing site data in your browser, which will show the banner again.
• Browser controls: you can block or delete cookies and storage in your browser settings at any time.

Change your analytics choice: Cookie settings

4. Legal basis and consent

Each activity has one basis under the EU General Data Protection Regulation (GDPR), where it applies:

• Owner account, venue pages, and service email: contract (Article 6(1)(b)).
• Security logs and abuse prevention: legitimate interest in keeping MenusM secure (Article 6(1)(f)). You can object.
• Optional analytics (Google Analytics and our venue and ad counts): consent (Article 6(1)(a)). Withdrawing consent does not affect essential storage.
• Push notifications: consent, given in the browser and withdrawable from the site menu or the device settings.
• Anonymous visitor ID for ratings and dish likes: strictly necessary to run the feature you use (one rating or like per visitor). It is not used for advertising, and it is not used for analytics unless you accept analytics.
• Table reservation details: steps you ask for before a booking with the restaurant (Article 6(1)(b)).
• Records we must keep for tax, accounting, or a legal claim: legal obligation or legitimate interest, and only for that period.
• Email orders and saving a restaurant: you ask us to pass those contact details to that restaurant (Article 6(1)(b)).

5. Data sharing

We do not sell personal data. We share it only as needed with hosting and media storage that run MenusM; the email service that sends account and reservation messages; the restaurant, which receives the reservation you submit on its page; and, only if you accept analytics, Google (Google Ireland and Google LLC), which may process an IP address and cookie identifiers. Providers that act for us do so on our instructions. Google may also process Analytics data under its own terms.

Transfers outside your country

MenusM is operated from Georgia. Account and reservation data are stored on our hosting. If you accept analytics, Google Analytics can transfer personal data to the United States. Google LLC is certified under the EU-US Data Privacy Framework; where that decision does not cover a transfer, Google uses the European Commission's standard contractual clauses. Choosing Essential only avoids that analytics transfer.

6. Data retention

We keep data only as long as the purpose lasts:

• Account, venues, menus, posts, and reservations for those venues: until you delete the account in the dashboard. Deletion removes that data. We may keep a limited record if a law, a dispute, or an abuse report still requires it.
• Our own analytics events: 90 days, and never longer than 365 days.
• Push subscription: until you turn notifications off. We then delete it from our servers when we can.
• Cookie choice: in this browser until you change it or clear site data.
• Security logs: for the time needed to detect and investigate abuse, then deleted or anonymised.

7. Security

We apply reasonable technical and organizational safeguards to protect data stored on MenusM, but no online system can be guaranteed to be 100% secure. You are responsible for choosing a strong password, keeping login details private, and controlling who can access your account. We are not liable for unauthorized access caused by credentials you shared or failed to protect.

8. Your rights

You can ask us to access, correct, delete, or restrict personal data, and to receive a copy of the account data you gave us in a portable format. You can object to processing based on legitimate interest. You can withdraw consent for analytics or push at any time; withdrawal does not affect processing that already happened lawfully. Correct published venue details in your dashboard. Export or save content you need before you delete the account; after deletion we cannot restore it. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

You can lodge a complaint with a supervisory authority. In Georgia that is the Personal Data Protection Service. If you are in the EU or EEA, you may also complain to the authority in the country where you live or where the issue happened. Email us first so we can fix it.

9. Contact

Privacy requests: info@menusm.com