Privacy Policy
Last updated: September 24, 2026
Introduction
Welcome to Menull. We are committed to protecting your privacy and ensuring you understand how we collect, use, and safeguard your personal information.
This Privacy Policy explains our practices regarding data collection and use when you use our digital menu platform. By using Menull, you agree to the collection and use of information in accordance with this policy.
Information We Collect
We collect several types of information to provide and improve our service:
Account Information
- Name and business/restaurant name
- Email address
- Password hash (we do not store the original password)
Menu Content
- Menu items, descriptions, and prices
- Category names and organization
- Images uploaded for menu items and branding
- Custom styling preferences (colors, fonts)
Orders, Reservations and Billing
- Guest names, phone numbers, email addresses and delivery addresses when provided
- Order items, prices, notes, reservation times and restaurant decisions
- Invoices, payment references, payment status and any manual payment proof
- Card artwork, shipping details and support inquiries
Usage Data
- Menu view counts and analytics
- QR code scan statistics
- Device type and browser information
- Referring website origin and a browser session identifier
How We Use Your Information
We use the collected information for the following purposes:
- Provide the Service: To create, host, and display your digital menus
- Improve the Platform: To understand usage patterns and enhance features
- Communication: To send important updates about your account or service changes
- Support: To respond to your inquiries and provide customer assistance
- Security: To detect and prevent fraud or abuse of our platform
Data Sharing
We do not sell your personal information. We may share your data with third-party service providers who assist us in operating our platform:
- Infrastructure providers: Database, API hosting, file storage, and content delivery
- Restaurants: The restaurant receives the order, reservation and contact details needed to serve the guest and arrange its own delivery and payment
- Resend: Account verification, invoices and order or reservation messages
When assisted import is used, the private menu photo is sent to OpenAI to extract a draft. Menull requests that the response is not stored through the API. Provider data handling remains subject to its service terms. We review the draft before the restaurant approves and publishes it. Original photos require authenticated access and are not public menu images. Only upload content we need to prepare the menu.
PayPal processes branch subscriptions and one-time NFC card payments. Menull retains transaction references, amounts, status, subscription schedules and verified payment events for billing and reconciliation. PayPal handles payment credentials under its own privacy terms. Menull does not collect guest food payments.
Data Security
Our software uses these protections:
- HTTPS is required for the production service
- Passwords are hashed using secure algorithms
- Role and branch access checks for private business data
- Authenticated private menu-photo access
- Public proxy logs remove headers and URL query values and mask IP addresses
While we strive to protect your data, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but will notify you of any breach that may affect your personal information.
Your Rights
You have the following rights regarding your personal data:
- Access: Request a copy of your personal data
- Correction: Update or correct inaccurate information
- Deletion: Request deletion of your account and associated data
- Export: Request a copy of your data in a portable format
- Opt-out: Unsubscribe from marketing communications
To exercise these rights, please contact us.
Data Retention
We retain your data for as long as your account is active or as needed to provide our services:
- Account and business content remain while needed to operate the service. Deleting a personal account does not automatically delete shared business records.
- Guest order contacts and notes become eligible for removal 90 days after the last update to a completed or cancelled order. Reservation contacts become eligible after both the reservation time and last update are 90 days old.
- Raw analytics become eligible for removal after 90 days. Aggregate counts remain.
- Closed inquiries and unused waitlist entries become eligible after one year. Completed notification message bodies become eligible after 30 days.
- Invoice, payment and accepted order history remain separate from guest contact removal. Referenced menu photos and publication history remain available for review.
Removal is carried out through scheduled maintenance, with safeguards for active work and record integrity. Backup copies follow a separate operator-managed expiry schedule. Contact us about deletion requests and any records that must be retained.
Children's Privacy
Menull is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly. If you believe we have collected information from a child, please contact us immediately.
Changes to This Policy
We may update this Privacy Policy from time to time. When we make changes, we will:
- Update the "Last updated" date at the top of this page
- Notify you via email for significant changes that affect your rights
- Post a notice on our platform for material changes
We encourage you to review this policy periodically. Your continued use of Menull after changes constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this Privacy Policy or our data practices, please reach out to us:
We aim to respond to all inquiries within 48 hours.