Menurium Privacy Policy
Effective date: 14 October 2026. This Policy explains how Menurium handles personal data across its public website, administration portal, mobile applications, QR menus, restaurant pages and related services under Moldova Law No. 195/2024 on Personal Data Protection and, where its territorial scope applies, Regulation (EU) 2016/679 (GDPR).
1. Who we are and scope
1.1
The controller for the processing described as Menurium's own processing is LOW TAB STUDIO S.R.L., registered at MD-2032, mun. Chișinău, str. Nicolae Titulescu, 36A, ap. 5, Republic of Moldova, IDNO 1026600009563 (Menurium, we, us or our).
1.2
This Policy applies to the Menurium website and landing pages, administration portal, iOS and Android apps, restaurant websites and QR menus powered by Menurium, ordering, reservations, delivery, analytics, support and related services (the Services).
1.3
A Restaurant using Menurium may independently determine how it handles customer, reservation, order and employee data. For that processing, the Restaurant is normally the controller and Menurium may act as its processor. The Restaurant must provide any additional privacy notice required for its own processing.
2. Personal data we process
2.1
Account and identity data: name, email address, telephone number, authentication identifiers, language, account status, Restaurant or tenant membership, location assignments and role such as owner, administrator, manager, waiter, delivery or kitchen worker.
2.2
Restaurant and content data: legal and business contact details, locations, addresses, opening hours, menus, prices, product descriptions, allergens, photographs, branding, tables, delivery zones and other information uploaded or configured through the Services.
2.3
Order and reservation data: customer contact details, selected Restaurant Products, quantities, comments, table or fulfilment details, delivery or pickup address, scheduled time, order status, reservation details and payment status. Menurium does not need to store full payment-card numbers processed by a payment provider.
2.4
Subscription and transaction data: selected plan, billing interval, currency, transaction and subscription identifiers, status, invoices, tax information and limited payment-method details returned by the payment provider.
2.5
Technical and usage data: IP address, browser and device type, operating system, app version, language, session and security events, pages or features used, timestamps, referral information and diagnostic or error information.
2.6
Communications: support requests, complaints, feedback and related correspondence. We also process information you voluntarily provide in forms, uploads or communications.
2.7
Trust, safety and abuse data: reports sent to our abuse or support channels; reporter and affected account contact details; tenant, subdomain and URL information; reported content and supporting evidence; account actions; and relevant login, access, audit, transaction, device, network and security logs.
2.8
Sensitive information in free-text fields: an End User may voluntarily include allergy, dietary, disability, health or religious information in an order, reservation, support request or other free-text field. Restaurants should request only information that is necessary and avoid recording sensitive information where it is not required. Menurium processes such information primarily on the relevant Restaurant's documented instructions.
3. Mobile application permissions
3.1
The mobile app uses the camera when an authorised user chooses to scan a table QR code or barcode to open the corresponding table and orders. Scanning uses Apple VisionKit on iOS and Google Play services Code Scanner on Android. Images are processed on the device; Menurium receives the recognised code and the selected Restaurant location context, rather than camera images or video. Where the operating system requires camera permission, it is requested before access and can be withdrawn in device settings.
3.2
The mobile app uses local device storage for necessary settings, language, tenant context and authentication or session information. It also uses network-status information to provide and troubleshoot online functionality.
3.3
We do not use the mobile camera for advertising or unrelated tracking. If a future version introduces a new permission or materially different collection, this Policy and the relevant app-store disclosure will be updated before or when that feature is released.
4. How we use personal data
4.1
We process data to create and secure accounts; authenticate users; maintain roles and permissions; provide menus, orders, reservations, delivery, analytics and other requested functions; synchronise data across authorised devices; provide support; and communicate service or security information.
4.2
We process subscription and transaction data to provide plans, administer trials and renewals, reconcile payments, issue or support invoices, prevent fraud and maintain required financial records.
4.3
We use technical, security and diagnostic information to operate, protect, debug and improve the Services, prevent misuse, investigate incidents and comply with legal obligations.
4.4
We use optional analytics on the website or Admin only when required consent has been given. This includes PostHog and Google Tag Manager, which we use to manage and deploy consent-based measurement tags. The tags configured in Google Tag Manager determine the data they collect; we do not use the container to deploy optional tags before consent. We do not sell personal data.
4.5
We process relevant account, content, communication and log data to enforce our Terms; receive, assess and respond to reports of unlawful content or activity; prevent and investigate fraud, abuse and security incidents; protect users, third parties and the Services; preserve evidence; establish, exercise or defend legal claims; and comply with valid legal requests and binding orders.
5. Legal bases
5.1
We rely on contract or requested pre-contract steps to create accounts, provide subscribed features, process orders or reservations and administer billing; legal obligation to keep required tax and accounting records and respond to lawful requests; legitimate interests to secure and reliably operate the Services, prevent fraud, provide support and improve essential functionality, balanced against individual rights; and consent for optional analytics, marketing or device permissions where consent is required. Another basis is used only where recognised by applicable law.
5.2
Consent is used where legally required, including for optional website or Admin analytics. Withdrawing consent does not affect processing already lawfully carried out and does not prevent processing based on another valid legal basis.
5.3
Trust, safety, fraud-prevention and security processing is based, as applicable, on performance and enforcement of our contract, compliance with legal obligations, and our legitimate interests and those of affected users or third parties in preventing unlawful activity, protecting the Services and legal rights, and responding to substantiated reports. We assess necessity and proportionality and do not rely on legitimate interests where overridden by the individual's rights and freedoms.
5.4
Where information reveals health, religion or another legally protected special category, the relevant Restaurant must identify and document an additional lawful condition, such as explicit consent, necessity to protect vital interests, establishment or defence of legal claims, or another condition permitted by applicable law. Menurium does not use such information for advertising or unrelated profiling.
6. Sources and sharing
6.1
We receive data directly from users, from the Business Customer or Restaurant that creates or manages an account, from End Users interacting with a Restaurant, automatically from devices and browsers, and from service providers involved in authentication, billing or operation of the Services.
6.2
We share data only as necessary with the relevant Restaurant and its authorised personnel; hosting and database providers; authentication providers such as SuperTokens; billing providers such as Paddle; map providers used for addresses and delivery configuration; PostHog for consent-based product analytics; Google for Google Tag Manager and the consent-based tags configured in it; Sentry for Admin error and diagnostic reporting; professional advisers; and authorities where legally required.
6.3
Providers may process data only for contracted purposes and under appropriate confidentiality, security and data protection obligations. Paddle independently processes checkout and payment information under its own privacy notice. Apple, Google or an identity provider may also independently process data when their services are used.
6.4
For trust, safety and legal-compliance matters, we may share relevant information with the reporting person, affected account holder or Business Customer, professional advisers, infrastructure or security providers, and competent courts, regulators or law-enforcement authorities, but only where necessary, proportionate and lawful. We do not promise a reporter confidentiality where disclosure is legally required, but we avoid unnecessary disclosure of identities and personal data.
7. International transfers
7.1
Some providers or support operations may process data outside Moldova or the European Economic Area. Where required, we use an adequacy decision, approved contractual safeguards such as standard contractual clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate.
8. Retention
8.1
We retain account and service data while the account or Business Customer relationship remains active and for a reasonable period afterwards to permit account closure, data export, dispute resolution and security review.
8.2
Transaction, invoice and legal records are retained for periods required by applicable accounting, tax and other laws. Abuse reports, enforcement records and relevant audit or security logs may be retained for as long as reasonably necessary to investigate and prevent repeated misconduct, preserve evidence, resolve disputes, protect legal rights and comply with law. Other security logs, support records, analytics and backups are retained only for periods reasonably necessary for their stated purposes, then deleted or anonymised where feasible.
8.3
Data processed for a Restaurant may be retained or deleted according to that Restaurant's instructions, our agreement with it, backup cycles and applicable legal obligations.
9. Security
9.1
We use reasonable technical and organisational safeguards appropriate to the risk, including access controls, role restrictions, secure communications, monitoring and backup practices. No internet or storage system is completely secure, so absolute security cannot be guaranteed.
9.2
Users must protect credentials, use appropriate account roles, keep devices secure and notify us promptly of suspected unauthorised access. Business Customers are responsible for promptly removing access no longer required.
9.3
Menurium is a multi-tenant service. We use logical tenant separation and role-based permissions intended to prevent one Restaurant from accessing another Restaurant's data, together with logging and other controls appropriate to the risk.
10. Your rights and choices
10.1
Subject to applicable law, you may request access to personal data, correction, deletion, restriction, objection, portability, information about processing, or withdrawal of consent. You may also complain to a competent data protection authority.
10.2
Requests concerning data controlled by a Restaurant should normally be sent to that Restaurant. We will assist the Restaurant where Menurium processes the relevant data on its behalf.
10.3
To exercise a right or request account deletion, email [email protected]. We may request information necessary to verify identity and authority. We will respond within the period required by applicable law.
10.4
Moldova's supervisory authority is the National Center for Personal Data Protection, 48 Serghei Lazo Street, Chisinau MD-2004, email [email protected], website datepersonale.md.
10.5
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on individuals. If this changes, we will provide the information and safeguards required by applicable law before such processing begins.
11. Children
11.1
Business and staff accounts are not intended for children. Menurium does not knowingly permit a child to create a Business Customer or staff account. Restaurant-facing pages may be viewed by younger users, but a Restaurant is responsible for any age restrictions applicable to its Products. Contact us if you believe a child provided data improperly.
12. Cookies, changes and contact
12.1
Our Cookie Policy describes cookies and similar technologies on the website and Admin. Necessary technologies support security, sessions and preferences. Optional analytics technologies, including PostHog and Google Tag Manager, are controlled through the consent choice shown on the website.
12.2
We may update this Policy when our Services, providers or legal obligations change. Material changes will be communicated through the Services, account email or another appropriate method. The effective date above identifies the current version.
12.3
Privacy questions and requests may be sent to LOW TAB STUDIO S.R.L., MD-2032, mun. Chișinău, str. Nicolae Titulescu, 36A, ap. 5, Republic of Moldova; email [email protected]; telephone +373 78 576 409.
13. Additional information for the mobile application
13.1
Existing accounts and sign-in. The Menurium mobile app is used by authorised owners, administrators and staff to access existing accounts; it does not create new accounts. Account data, Restaurant membership and roles determine the functions available to each user. When you choose Google Sign-In, the app requests basic identity, email and profile access and sends the Google identity token to our authentication service to verify access to your existing account. Google processes the sign-in under its own Privacy Policy.
13.2
Notification identifiers and technical data. We use Google Firebase Cloud Messaging and Firebase Installations to support push notifications, and Apple Push Notification service (APNs) for delivery on iOS. These services process installation identifiers and push registration tokens, including FCM and APNs tokens, and technical information such as device and operating-system information, app identifiers and versions, language and SDK information, depending on the platform. Menurium associates the registered notification endpoint with your account and Restaurant, role, language, platform and app version to route relevant messages.
13.3
Notification content and purposes. Notifications support updates about tables and orders, Restaurant analytics, and Menurium news, offers or recommendations, according to your role and available features. To deliver a message, our server sends its registration token, title, body and related data to Firebase and, on iOS, through APNs. Related data may include the order identifier, table identifier or name and order status. These providers therefore process the message content, not only a device identifier. Google describes Firebase processing in its Firebase privacy information; Apple describes its processing in its Privacy Policy.
13.4
System permission and service initialization. The app explains notifications before requesting operating-system permission where required, and you may choose to set them up later. Permission controls the display of notifications on your device. Firebase and push-registration components may initialize and process installation or technical data when the app starts, before you enable notification display. Declining or withdrawing display permission does not itself delete data already held by Menurium or a push provider.
13.5
Notification settings. The app stores your notification choices on the device, including the overall setting and order or marketing category preferences. Category settings filter messages locally after receipt; they are not currently sent to our server as delivery preferences and do not stop the server from transmitting message content through push providers. You can also manage notification display and lock-screen previews in device settings. Signing out deactivates the Menurium notification endpoint; it does not delete the endpoint record, Firebase installation identifier or associated provider data.
13.6
Local storage, scanning and support. The app stores necessary language, settings, session information and notification choices locally. The scanned table code is sent to Menurium to find the table within the selected Restaurant location; this location is a Restaurant location, not the phone's GPS position. When you submit a support request, we process your email address, message and language to respond. Server-side error reporting may use Sentry for diagnostic information when configured, as well as email service providers for correspondence.
13.7
Remote resources and web pages. Displaying remotely hosted images, including notification attachments, sends a network request to the host of that image. Restaurant media may be served through our Cloudflare R2 file infrastructure. Language flags are currently loaded from GitHub Pages at purecatamphetamine.github.io. Resource hosts receive IP addresses and normal HTTP request information. Legal pages opened inside the app and Admin pages opened in a browser may also load website resources and use the website technologies described in this Policy and our Cookie Policy.
13.8
Retention and deletion requests. The retention principles in section 8 apply to mobile account, support, diagnostic and notification records. Disabling notifications, signing out or uninstalling the app is not a request to delete your account or server records. To request deletion of your existing account and associated personal data, email [email protected], as described in section 10. We may verify your identity and authority; data controlled by a Restaurant and records subject to legal retention obligations are handled as described in this Policy.