Privacy Policy

1. Data Controller

The Data Controller is the operator of the MenuMaster platform (menumasterapp.it). Contact: info@menumasterapp.it.

2. Data we process

• Account data: name, email, username, password (stored encrypted with hashing).
• Billing data (paid plans only): name/company name, address, Tax Code/VAT number, SDI code or certified email.
• Uploaded content: menus, dishes, prices, descriptions, imported files (PDF, images, documents).
• Payment data: handled entirely by PayPal/Stripe; MenuMaster never receives or stores card numbers.
• Technical data: IP address, access and error logs, technical session cookies.
• Social login: if you sign in with Google, we receive name, email and profile picture.

3. Purposes and legal bases

• Service provision (account creation, menu management, PDF and QR generation) — contract performance, art. 6(1)(b) GDPR.
• Billing and tax obligations — legal obligation, art. 6(1)(c) GDPR.
• AI features (automatic import, allergen detection, translations): menu content is sent to Anthropic (Claude API) for processing — contract performance, art. 6(1)(b).
• Security and abuse prevention (technical logs) — legitimate interest, art. 6(1)(f).
• Service communications (welcome, password reset, receipts) — contract performance.

4. Processors and recipients

Data is processed through providers acting as processors under art. 28 GDPR:

• Hostinger International Ltd. — application and data hosting (EU servers).
• PayPal (Europe) S.à r.l. and Stripe — payment processing.
• Anthropic PBC — AI processing of menu content (only texts/files you choose to process; not used for model training under commercial API terms).
• Google LLC — OAuth authentication (if you choose "Sign in with Google") and public menu page translation (Google Translate, activated by the visitor).

Some providers may involve transfers outside the EU; in such cases Standard Contractual Clauses (SCC) under art. 46 GDPR or adequacy decisions (EU-US Data Privacy Framework, where applicable) apply.

5. Retention

• Account data and content: for the entire duration of the account and up to 30 days after deletion.
• Billing data: 10 years (civil and tax obligations).
• Technical logs: maximum 12 months.

6. Your rights

Under arts. 15-22 GDPR you have the right to: access, rectification, erasure, restriction, data portability, objection. Exercise them by writing to info@menumasterapp.it. You also have the right to lodge a complaint with your supervisory authority (in Italy: Garante per la Protezione dei Dati Personali, www.garanteprivacy.it).

7. Public menus and restaurant data

Published menus are visible to anyone with the link or QR code. The restaurateur is an independent controller for data entered in their menus and is responsible for its accuracy, including allergen information.

8. Minors

The service is intended for adults and professional operators. We do not knowingly collect data from anyone under 18.

9. Cookies

We only use strictly necessary technical cookies (session, preferences). Details in the Cookie Policy.

10. Changes

Any substantial changes to this notice will be communicated via email or in-platform notice.