Privacy policy

MenudoQR is responsible for personal data processed to operate the website, user accounts, commercial relationship and platform support.

• Account and access: email, technical identifiers, encrypted credentials and session data.
• Restaurant: trading name, public URL, address, contact details, opening hours, menu, products, images and configured information.
• Billing: plan, subscription status, invoices, tax address and payment references. Stripe processes full card details; MenudoQR does not store them.
• Orders and reviews: information submitted by customers when the restaurant enables these features.
• Contact and support: name, email, subject, message, uploaded files and subsequent communications.
• Technical information: security logs, device, browser, pages viewed and aggregated usage information.

• Provide the platform and maintain the account: performance of a contract or pre-contractual steps.
• Manage payments, invoices and accounting duties: contractual performance and legal obligations.
• Respond to enquiries: consent expressed by contacting us and, where relevant, pre-contractual steps.
• Protect the service and prevent fraud: legitimate interest in security and continuity.
• Measure website usage and conversions: consent for Google Analytics 4 and Vercel Web Analytics. You can reject or withdraw this choice without losing essential features.
• Send essential communications: service performance, including verification, security, billing and important change notices.

If optional marketing communications are introduced, consent will be requested where required and an easy opt-out will be provided.

When a restaurant uses MenudoQR to receive orders, reviews or other customer information, the restaurant normally determines the purpose and acts as data controller. MenudoQR acts as technology provider or processor, as applicable.

People wishing to exercise rights concerning an order or review should first contact the restaurant that received their data. We will assist the restaurant where necessary.

We do not sell personal data. To operate the platform, providers may access data under our instructions:

• Supabase: database, storage and authentication.
• Vercel: hosting, website delivery and aggregated web analytics.
• Google Analytics: optional measurement of visits, navigation and conversions after consent.
• Stripe: payments, billing and subscription management.
• Resend: transactional and support email delivery.
• Security or technical support providers where needed to resolve an incident.

Where data is processed outside the European Economic Area, safeguards such as adequacy decisions, the EU–US Data Privacy Framework or standard contractual clauses are used. Read the policies of Supabase, Vercel, Stripe, Google and Resend.

Account and restaurant data is kept while the account remains active. After closure, it is erased or restricted according to the periods needed for liability, security, backups and legal obligations.

• Enquiries are retained for the time needed to respond and follow up.
• Contractual, tax and billing records follow statutory retention periods.
• Security logs are retained for limited periods proportionate to risk.
• Orders and reviews follow restaurant settings and applicable obligations.

You may request access, rectification, erasure, objection, restriction and portability, and withdraw consent without affecting earlier lawful processing.

Email gp20eu@gmail.com and identify the right you wish to exercise. We may ask for reasonable proof of identity.

You may also lodge a complaint with the Spanish Data Protection Agency.

We use technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure. No system is completely infallible, so measures are reviewed as the service develops.

MenudoQR is intended for professionals and businesses, not children. We do not knowingly ask a child to create a professional account.

This policy may be updated for legal, technical or functional changes. Material changes will be communicated by reasonable means and given a new update date.