Privacy Policy

1. Who we are

Menoro is operated by Alex Psaila (business registration in progress), Malta. We are the controller of the personal data described here. You can reach us about anything in this policy at hello@menoro.app.

2. Who this policy covers

• Restaurant owners and staff who create an account to build and publish a menu.
• Guests who open a restaurant's menu, for example by scanning its QR code.

3. What we collect

If you have an account (owners and staff):

• Your name, email address and password (stored only in encrypted, hashed form by our login provider).
• Your dashboard language and the date you accepted our Terms and this policy.
• The restaurant details and content you add: name, address, phone, email, website, opening hours, logo, menus, dishes, prices, descriptions, allergen labels, photos and translations.
• Menu files you upload for import (PDFs or photos). These are read automatically and deleted from our storage immediately afterwards.
• Dish photos, if you turn photos on. We crop and shrink them, keep only the resized copy, and delete the original upload straight away.

If you are a guest viewing a menu:

• We don't ask for or store any personal data, and we use no analytics, advertising or tracking tools.
• Your browser remembers the menu language you choose, on your own device only.
• Our hosting provider keeps short-lived technical logs (such as IP address and browser type) to keep the service secure and working.

4. Why we use it

• To provide the service you signed up for (performance of a contract): your account, your menu, publishing it and showing it to guests.
• To keep Menoro secure and working (legitimate interests): preventing abuse, fixing errors, and sending essential account emails such as sign-up confirmations and password resets.
• To meet legal obligations, such as keeping invoices once paid plans are introduced.

We don't sell your data, and we don't use it for advertising.

5. Service providers we use

These companies process data on our behalf, only to provide the features listed:

• Supabase: database, file storage, login and account emails.
• Vercel: website hosting.
• OpenAI: reads menu files you upload for import.
• DeepL: translates your menu text when you turn on extra languages.
• GitHub: stores our encrypted daily backups, each kept for 30 days.

Some of these providers process data outside the European Economic Area, for example in the United States. Where they do, the transfer is covered by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

6. How long we keep it

• Account and restaurant data: for as long as your account exists. When you delete your account, it's removed straight away, and from any backups within 30 days.
• Uploaded menu files for import: deleted immediately after they're read.
• Hosting logs: kept briefly by our hosting provider, then deleted automatically.

7. Your rights

Under the GDPR you can access, correct, download, or delete your data, object to or restrict how we use it, and withdraw any consent you gave. Account holders can download their data and delete their account themselves from the Account page in the dashboard. For anything else, contact us at hello@menoro.app.

You can also complain to Malta's data protection authority, the Information and Data Protection Commissioner (idpc.org.mt).

8. Cookies and local storage

We only use what's strictly necessary: login cookies that keep owners and staff signed in, and small settings stored in your browser (such as your chosen menu language). There are no tracking or advertising cookies, so no cookie banner is needed.

9. Children

Menoro accounts are for businesses and aren't intended for anyone under 18.

10. Changes to this policy

If we make important changes, we'll tell account holders by email or in the dashboard before they take effect. The date at the top shows the latest version.

11. Contact

Menoro, Alex Psaila, Malta. Email: hello@menoro.app