Privacy Policy

Introduction

Menujo ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service to create and manage digital restaurant menus.

Information We Collect

We collect personal information when you create an account, including your name and email address. If you use OAuth authentication with Google or Apple, we receive basic profile information such as your name, email, profile picture, and unique identifier. Authentication tokens are stored securely and used only for account verification. We do not access Google Drive, Apple iCloud, or other services beyond basic profile information unless explicitly authorized.

When someone opens a public menu, we record a menu visit after the page becomes visible, or through a small image request when JavaScript is disabled. We collect the time, IP address, approximate country and city, browser information, inferred device and operating system. We use IP addresses to estimate unique visitors; shared networks can combine visitors, and these estimates do not identify individual diners. We also record the referring website's origin and allowlisted source tags. We do not retain referral URL paths or query parameters in new visit records. A QR tag indicates which link was used and does not prove a camera scan.

Known automated traffic and signed-in owner tests are excluded from diner reports. Analytics uses first-party requests without setting a dedicated visitor-tracking cookie.

Dated menu interaction events can be tied to a menu visit for aggregate reporting, including an available QR placement or source label. A QR placement is a label supplied with a link, not proof of a camera scan. These interaction records follow the parent visit cleanup horizon.

We also collect usage patterns and feature interactions inside the dashboard, and performance and error logs.

For paid subscriptions, payment processing is handled by Stripe, Inc. We do not store your full credit card information on our servers. Stripe may share limited transaction data with us, including transaction IDs, payment status, last four digits of credit card numbers, billing address information, and subscription status.

How We Use Your Information

We use collected information to provide and maintain our service, process payments and manage subscriptions, authenticate users and prevent fraud, generate menu analytics and insights, communicate with you about your account and our services, improve our service and develop new features, and comply with legal obligations.

Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties. We share data only with the service providers needed to run the platform: Stripe for payment processing and subscription management, Google and Apple for the sign-in methods you choose to use, our email provider for sign-in links and service messages, and Cloudflare for hosting, storage, and delivering menu pages. Menujo does not run third-party advertising or marketing pixels on its own pages or on the menus you publish. Published diner menus are excluded from Clarity.

We may disclose your information if required by law or court order, or to protect our rights, property, or safety.

AI-assisted insights

For paid AI Insights, we may send aggregate menu-view counts and dates, along with generic suggestions, to Cloudflare Workers AI to prioritize verified highlights. This request does not include diner IP addresses, user agents, menu names, menu links or customer account identifiers. If AI is unavailable, the same feature provides a calculated summary. We cache one summary per account, normally refreshing it daily when visited. Account deletion removes this cache; inactive cached summaries are removed once more than 90 days past expiry at the next scheduled cleanup.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including encryption in transit with modern TLS and encryption at rest on our infrastructure provider's platform, passwordless authentication so we hold no password of yours, restricted access to production data, dependency and security updates applied as they are released, and payment processing handled entirely by a PCI-compliant provider that we never see card numbers through.

On eligible public pages, Microsoft Clarity helps us understand use of the site through behavioral metrics, heatmaps, and session replay when it is enabled and allowed by the applicable consent choice. Clarity may use first- and third-party cookies and similar technologies. Learn how Microsoft handles this data in the Microsoft Privacy Statement. Microsoft says ordinary playback is retained for 30 days, while labeled or favorited sessions, click data, and heatmaps are retained for 9 months. See Clarity data retention for current provider terms.

Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations. Account and menu data are retained for as long as your account exists. When you delete your account the removal is immediate and permanent, not queued or delayed. Payment records are retained by our payment processor as required by tax and financial regulations, and survive account deletion because we are not the party holding them.

An hourly cleanup removes individual menu visits once they are older than 90 days. Records can remain until the next scheduled cleanup. Daily menu aggregates and collection-health counts follow the same retention horizon; owner test receipts are removed after one day at the next cleanup. Menu lifetime counters remain until the menu is deleted and can include activity measured under older counting rules. Account deletion removes the account's raw visits, test receipts and menu aggregates. This analytics release does not extend history beyond 90 days.

Your Rights and Choices

Depending on your location, you may have rights regarding your personal information including the right to access (request a copy of your personal information), correction (correct inaccurate or incomplete information), erasure (request deletion of your personal information), portability (receive your data in a machine-readable format), restriction (restrict how we process your information), and objection (object to certain types of processing).

To exercise these rights, please contact us through our contact page.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience. For detailed information about our use of cookies, please see our Cookie Policy.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you learn that a child has provided us with personal information, please contact us.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us through our contact page.