Privacy Policy

1. Information we collect

We collect the account details you provide (such as your name, email, and restaurant information), menu content, and basic technical data (such as IP address, device and browser type, and usage logs) needed to operate and secure the service. Guests can browse public menus without an account. Selections stay on the guest’s device until an order request is submitted. Submitted requests are stored by MenuCat and made available to authorized restaurant staff, including a guest identifier, any guest name, selected items and options, notes, and location or table details. Staff orders and their service history are also stored.

2. How we use information

We use your information to provide and improve MenuCat, authenticate your account, process subscriptions and restaurant order requests, provide support, communicate important updates, and keep the service secure. When restaurant staff use AI import or translation, we send the supplied menu text, image or document content to the configured AI provider to produce a draft. We do not sell your personal information.

3. Service providers

We use service providers for the following functions:

• Logto — secure sign-in and account authentication.
• Paddle — payment processing and merchant of record.
• Hosting infrastructure — running and storing the service.
• Email provider — transactional and account emails.
• OpenAI and Fireworks AI — optional menu import and translation. OpenAI processes menu text, images or documents for import and menu text for translation; Fireworks processes menu text for translation if OpenAI is unavailable.

4. Data retention

Retention depends on the type of record. We periodically remove expired temporary results, older unaccepted order details and older raw menu-visit events. Accepted order details and staff service history remain in the restaurant workspace until a reviewed removal. Contact support to request an export or workspace erasure; cancelling a subscription does not itself erase the workspace. Erasure removes workspace records and schedules stored-file cleanup. We retain limited identifiers, deletion and audit receipts, billing references and short-lived AI usage records to prevent duplicate requests, investigate delayed billing events and enforce usage limits. Copies held by authentication, payment or AI providers, backups, caches and previously downloaded exports require separate handling and may remain after removal from the active application.

5. Your rights

You can access, correct, export, or delete your personal information. To make a request, contact us using the details below. We will respond within a reasonable timeframe and in line with applicable law.

6. Security

We use appropriate technical and organizational measures to protect your information, including encryption in transit. No system is completely secure, but we work to keep your data safe and to notify you of significant incidents where required.

7. International transfers

Your information may be processed in countries other than your own. Where it is, we take steps to ensure it remains protected in line with this policy and applicable law.

8. Changes and contact

We may update this policy from time to time and will post the new version here. For privacy questions or requests, reach us using the contact details below.