Privacy Policy

Last updated: 12 October 2026

CBTECS LLC ("we") operates MenuQR. This policy explains what data we collect, why, who we share it with and what you can do about it. It applies to people who create an account to publish a menu ("customers") and, where relevant, to people who open a menu by scanning a QR code ("diners").

1. Data we collect from account holders

• Account: email and/or phone, name, password (stored encrypted, never in plain text) and your chosen language. If you sign in with Google we receive your name and email from Google.
• Business content: business name and details, menus, categories, dishes, prices, descriptions, photos, logos, schedules, promotions and the WhatsApp number you choose to publish. This information is public on your menu.
• Payments: payments are processed by Stripe. We keep which plan you have, its period and Stripe identifiers, but not your card number.
• Sessions: when you sign in we store a description of the device (for example browser and operating system) and the date, so you can see and close your sessions.
• Referral program: if you take part, we store your code, your referrals and commissions and any payout details you give us. When someone opens a referral link we store their IP address, browser and a random visitor key to prevent fraud and attribute the sale.
• AI menu scan: the photo you upload is sent to our AI provider to read the menu and is not kept after processing. To limit free use we store a random cookie in your browser (lasts up to 1 year) and, in our records, an irreversible hash of the IP that is deleted after 60 days.

2. Diner data

When someone opens a menu we record an anonymous event (for example that the menu was viewed, the approximate time and, if applicable, that a button was tapped) so the menu owner can see statistics. We do not store the IP address, browser, cookies or any diner identifier in those events. If the menu has WhatsApp ordering, the message is sent from the diner's phone to WhatsApp and does not pass through our servers.

3. Cookies and local storage

We use only what is needed for the site to work; we do not use advertising or cross-site tracking cookies:

• Browser local storage: session token, active location, editor preferences (guide seen, collapsed sections) and referral code, if you arrived through one.
• Language cookie.
• Random cookie for the free scan (see above).

4. How we use data

• To provide the Service: create your account, store and publish your menus, bill your plan.
• Security and fraud/abuse prevention (usage limits, code verification).
• To communicate with you: verification codes, payment notices, important changes, support.
• To improve the Service and detect technical errors.
• To comply with legal obligations.

We do not sell your data or your diners' data and we do not use it for third-party advertising.

5. Who we share it with

Only with providers that help us operate the Service, and only for that purpose:

• Stripe — payments.
• Twilio — sending verification codes by SMS or WhatsApp.
• Google — Google sign-in and fonts (Google Fonts).
• Anthropic — AI reading of menu photos you choose to scan.
• Email provider — sending the Service's emails.
• Hosting and storage provider — where the application, database and photos run.
• Sentry — technical error monitoring; we configure it so it does not include cookies, form contents or personal data.
• cdnjs / Cloudflare — delivery of public code libraries.

We may also disclose data if required by a valid law or legal order, or to protect the security of the Service and of people. If the business is sold or merged, data may be transferred with the same protection as this policy. Some providers are in other countries (for example the United States).

6. How long we keep it

• Account and menu data: as long as you have the account. Deleting it from My account removes your profile, menus, photos and associated data.
• Anonymous statistics events: up to 400 days.
• Free-scan records: up to 60 days.
• Payment and billing records: as long as tax and accounting laws require, even if you close the account.
• Backups: may retain deleted data for a limited period before it is removed.
• Server and error logs: for short periods.

7. Your rights

Depending on where you live (for example under Mexico's LFPDPPP, the GDPR in Europe or US state privacy laws such as the CCPA), you may request access to your data, correction, deletion, restriction or objection to its use, or a copy. You can edit your information and delete your account from My account, or write to soporte@getmenuqr.app. We will respond within a reasonable time and may ask you to verify your identity. If you believe we mishandled your data, you can also contact your country's data protection authority.

8. Security

We use encrypted connections (HTTPS), encrypted passwords, abuse limits and restricted access to data. No system is 100% secure; if a breach affects you, we will notify you as the law requires.

9. Children

The Service is for businesses and adults. We do not knowingly collect data from minors; if you believe we did, write to us and we will delete it.

10. Changes to this policy

We may update it. We will post the new version here with its date and, if the change is significant, notify you by email or within the Service.

11. Contact

CBTECS LLC — soporte@getmenuqr.app. Terms of use: Terms of Service.