Privacy Policy

This Privacy Policy explains how Menünden ("we", "us") collects and uses personal data when you use our websites and our digital menu, ordering and restaurant management service (the "Service"), and what rights you have.

1. Who is responsible for your data

For account holders (restaurants, cafés and their staff), Menünden is the data controller of the data described below. For data about a restaurant's own guests (orders placed through a QR menu, reviews, loyalty details), the restaurant is the controller and Menünden acts as its processor. Contact: [email protected]

2. Data we collect

• Account data: business name, contact person's name, email address, phone number, password (stored only as a one-way hash), preferred language and currency.
• Service data: menus, products, orders, table sessions, payment status, reports, staff accounts, and activity logs.
• Guest data (entered through a restaurant's QR menu): order contents, optional notes, optional ratings/reviews, and — only if the restaurant enables loyalty — a phone number.
• Billing data: subscription plan, invoices and payment status. Card details are handled directly by our payment provider (Stripe) and never stored on our servers.
• Technical data: IP address, approximate country, device and browser information, session and security cookies.

3. Why we use it, and our legal bases

• To provide the Service (account, menus, orders, kitchen and waiter tools, reports) — performance of a contract.
• To process payments and invoices — performance of a contract and legal obligations.
• To keep the Service secure (login protection, fraud and abuse prevention) — our legitimate interests.
• To improve the Service and communicate with you (support, important notices) — legitimate interests; marketing emails only with your consent where required.
• To comply with the law — legal obligation.

We do not sell personal data.

4. Who we share data with

Only as needed to run the Service: hosting and infrastructure providers, payment providers (such as Stripe), email and SMS delivery providers, and authorities where the law requires. These providers process data on our instructions and under appropriate contracts.

5. International transfers

Our providers may process data in countries other than your own. Where data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses or adequacy decisions where applicable.

6. Retention

We keep data while your account is active. After you close your account or ask us to delete your data, we delete or anonymise it within 30 days, except records we must retain by law (for example invoices), which are kept for the legally required period.

7. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA or Turkey's KVKK), you may have the right to access, correct, delete or export your data, to restrict or object to certain processing, to withdraw consent at any time, and to lodge a complaint with your local data protection authority. Account holders can request a copy of their data or deletion from the Data & Privacy page of the dashboard; anyone can write to [email protected]. If you are a guest of a restaurant, please contact that restaurant first; we will assist them in answering your request.

8. Security

Data is transmitted over encrypted connections (HTTPS). Passwords are stored hashed, API credentials are stored encrypted, access is limited by role, and each business's data is isolated from others. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.

9. Cookies

We use essential cookies (login, security) and preference cookies (language, currency). See our Cookie Policy.

10. Children

The Service is intended for businesses and is not directed at children under 16.

11. Changes

We may update this policy; material changes will be announced in the dashboard or by email. The date of the latest update appears at the top of this page.

12. Contact

Privacy questions: [email protected]