Privacy policy

1. Who we are

SmartMenu is a service that lets restaurants publish QR menus with an AI waiter. We are the operator of the service and the controller of the account information described below. For the guest chats and menu data a restaurant creates, the restaurant decides what is collected and we process it on its behalf.

2. Information from restaurants and their staff

Account details: name, email address, a hashed password, language, and optional two-factor and passkey credentials.

Restaurant content: names, locations, opening hours, menus, dishes, prices, photos, branding, staff invitations and settings.

Billing records: plan, payment amounts, dates, receipt numbers and notes. Payments are collected offline, so we do not store card numbers.

Activity records: important account and admin actions are logged, with a one-way hash of the network address instead of the address itself.

3. Information from guests

Guests do not need an account. When a guest opens a menu we count anonymous visits and interactions (for example QR scans, dish views and table orders) using a random identifier from their browser that is stored in hashed form. We do not collect names, phone numbers or exact locations.

If a guest chats with the AI waiter, the conversation is stored so the restaurant can review it and improve answers. Guests are asked not to share personal information in the chat. Allergies or diets a guest mentions are kept with that conversation to make the answers safer.

When guests share a table order, the dishes and quantities they add are stored for the duration of the visit and then closed automatically.

4. How we use information

To run the service: show menus, answer guests, translate content, import menus, send sign-up codes, receipts and renewal reminders, and give restaurants insights about their own menu.

To keep the service safe and reliable: prevent abuse, investigate problems, and limit AI usage.

To contact restaurant owners about the service, such as new features or maintenance. We do not sell personal information and we do not use guest conversations for advertising.

5. AI providers

The AI waiter, menu import, translation and assistant features send the relevant text, menu content or images to AI model providers through OpenRouter so they can produce a reply. These providers process the content to return a result for us. Please do not put sensitive personal information in guest chats or menu content.

6. Cookies

We use cookies that the service needs to work: a session cookie to keep people signed in, a security token, and a language preference. We do not use advertising cookies.

7. How long we keep information

Account and restaurant data is kept while the account is active. Anonymous menu analytics are deleted after 180 days and detailed AI call logs after 90 days. Guest conversations are kept for the restaurant to review until the restaurant or we remove them. Billing records are kept as long as needed for accounting.

8. Sharing

We share information only with service providers that help us run the service (hosting, email delivery and AI providers), when the law requires it, or to protect the service and its users. Restaurants can see their own conversations, analytics and staff accounts.

9. Your choices

Restaurant owners can edit or delete their restaurant data and can ask us to delete their account. Guests and anyone else can ask us to access, correct or delete information about them. Write to us and we will reply within a reasonable time.

10. Security

Passwords are stored hashed, connections use HTTPS, and platform admins must use two-factor authentication. No system is perfectly secure, so please use a strong, unique password and turn on two-factor authentication.

11. Changes

We may update this policy. We will change the date above and, for significant changes, tell restaurant owners by email.