Privacy Policy
This is an English translation provided for information. The legally binding version is the Slovak one: Zásady ochrany súkromia.
This policy explains which personal data we process when running the Menullo service (the menullo.eu website, the app for restaurant owners, and the menu pages and screens for guests), why we process it, how long we keep it and what rights you have. We follow Regulation (EU) 2016/679 (GDPR) and Slovak Act No. 18/2018 Coll. on the Protection of Personal Data.
In short
- We use data only to run the service. We do not sell it and we have no ads.
- We do not track guests who view a menu: they have no account, and we use no analytics and no advertising cookies.
- Payments are handled by Stripe. We never see your full card number.
- Menu photos and texts are sent to an AI provider (Anthropic) only so that they can be read and translated.
- You can delete your account at any time and we then erase your data.
1. Who the controller is
Ján Juhász – JeyJeyZáhradná 890/10, 059 21 Svit, Slovak Republic
Business ID (IČO): 55293026, registered in the Trade Register of the District Office Poprad, No. 740-42251
E-mail: info@menullo.eu
We have not appointed a data protection officer because we are not required to. Please send any questions about personal data to the e-mail address above.
2. What data we process
2.1 Restaurant account (our customers)
- e-mail address and password – we store the password only as a hash, from which it cannot be recovered;
- business name, address, phone number and opening hours of the establishment, logo;
- menus and My dishes (dish names, prices, portion weights, allergens) and settings;
- menu photos and text that you upload or dictate to be read;
- subscription details (plan, period, payment status).
If the business is run by a sole trader, this data may also be personal data. Details of the establishment that you enter for publication (for example name, address, phone number and opening hours) are visible to guests on the web.
2.2 Payments and invoices
Card payments are processed by Stripe. We never see or store the full card number or the security code. From Stripe we receive only the data needed to manage the subscription and invoicing, for example the name or business name, billing address, business ID or VAT ID, e-mail, card brand and its last four digits, and payment status and history.
2.3 Technical logs
On every visit to the service, including the guest menu pages, our server automatically records the IP address, time, requested address, browser type and error messages. We use them only for security, abuse prevention and troubleshooting, and delete them after 14 days.
2.4 Communication
If you write to us, we process your e-mail address, the content of your message and our reply.
2.5 Guests viewing a menu
Guests (people who open a menu via a QR code or a link, or see it on a TV screen) have no account and we collect nothing from them. We use no analytics and no tracking or advertising tools. We only process the technical logs described in section 2.3. The language and text size chosen by a guest stay stored only in the guest’s own browser and are not sent to us.
2.6 Visitors to this sales website
We use no analytics and no advertising tools on menullo.eu. Your browser only remembers the page language you have chosen. The number of free founding places that the page loads contains no personal data.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the service: account, menus, guest outputs, AI features, support | restaurant account, communication | performance of a contract – Art. 6(1)(b) GDPR |
| Subscription and payments | subscription and payment data | performance of a contract – Art. 6(1)(b) GDPR |
| Service e-mails (for example password reset, notice of price or terms changes) | e-mail address | performance of a contract – Art. 6(1)(b) GDPR |
| Invoices and accounting | billing data | legal obligation – Art. 6(1)(c) GDPR (Slovak Accounting Act No. 431/2002 Coll., VAT Act No. 222/2004 Coll.) |
| Security, abuse prevention and troubleshooting | technical logs | legitimate interest – Art. 6(1)(f) GDPR (a secure, working service) |
| Establishing or defending legal claims | necessary data from the above | legitimate interest – Art. 6(1)(f) GDPR |
We do not send marketing e-mails. If we ever want to, we will do so only in line with the law and with a one-click option to opt out at any time.
4. Cookies and browser storage
| Name | Where | Purpose | Duration |
|---|---|---|---|
| cookie “mt” (HttpOnly) | owner app | keeps the owner logged in | until logout, at most 12 months |
| localStorage – language and text size | guest menu page | remembers the guest’s choice | until the guest clears it in the browser |
| localStorage – page language | menullo.eu | remembers the chosen language | until you clear it in the browser |
| localStorage – app settings | owner app | may remember your display settings (for example the language) | until you clear them in the browser |
Why there is no cookie banner: under Section 109(8) of Slovak Act No. 452/2021 Coll. on Electronic Communications, consent is not required for storage that is strictly necessary to provide a service you have explicitly requested. Every item in the table is strictly necessary – it keeps you logged in or remembers a choice you made yourself. We use no analytics, advertising or tracking cookies and share no data from them. If we ever want to use such cookies, we will ask for your consent first.
When you pay, you are redirected to Stripe’s payment page, which may use its own strictly necessary cookies, for example to prevent fraud. These are governed by Stripe’s policies.
5. Recipients and processors
We do not sell data. We share it only with the following recipients, and only to the extent they need for their task:
| Recipient | Task | Country |
|---|---|---|
| WebSupport s.r.o., Karadžičova 12, 821 08 Bratislava | hosting – the servers that run the service and store the data | Slovakia (EU) |
| Stripe Payments Europe, Limited | card payments, subscriptions, invoices, customer portal | Ireland (EU); some data may also be processed in the USA |
| Anthropic PBC | artificial intelligence: reads menu photos and texts, turns them into dishes, translates dish names and suggests dish ideas | USA |
| WebSupport s.r.o. | sending e-mails (for example password reset) | Slovakia (EU) |
| our accountant | processing invoices and accounting records | Slovakia (EU) |
Processors handle data only on our instructions under a contract pursuant to Art. 28 GDPR. For some activities (for example fraud prevention and its obligations as a payment service provider) Stripe acts as an independent controller. Under Anthropic’s commercial terms, data we send through its interface (API) is not used to train its models. Please photograph only the menu, not people.
We may also disclose data to public authorities where the law requires it (for example the tax office).
6. Transfers outside the EU
Anthropic PBC is based in the USA and Stripe may process some data in the USA. These transfers are protected by standard contractual clauses approved by the European Commission (Art. 46 GDPR) or, where the recipient is certified, by the adequacy decision for the EU-US Data Privacy Framework. We will provide a copy of these safeguards on request.
7. How long we keep data
| Data | Retention |
|---|---|
| Restaurant account and its content (menus, My dishes, logo, uploaded photos, settings) | for the life of the account and 30 days after it is deleted |
| Backups | at most 14 days (older backups are overwritten automatically) |
| Technical logs (including IP addresses) | 14 days |
| Invoices and accounting records | 10 years from the end of the year they relate to (Accounting Act, VAT Act) |
| E-mail communication | as long as needed to deal with the matter, at most 12 months after it is closed; longer only if needed to protect legal claims |
| Data held by Stripe | according to Stripe’s policies and payment services law |
8. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you. The AI only transcribes and translates menus; the restaurant always checks the result.
9. Security
The connection to the service is encrypted (HTTPS), passwords are stored only as hashes, data is backed up regularly, and only the controller and the processors have access to it, to the extent necessary. If a personal data breach occurs, we will act in accordance with Articles 33 and 34 GDPR.
10. Your rights
- right of access (Art. 15 GDPR),
- right to rectification (Art. 16 GDPR),
- right to erasure (Art. 17 GDPR),
- right to restriction of processing (Art. 18 GDPR),
- right to data portability (Art. 20 GDPR),
- right to object to processing based on legitimate interest (Art. 21 GDPR),
- if we ever process data based on consent, the right to withdraw consent at any time.
To exercise your rights, e-mail info@menullo.eu. We will reply without undue delay and within one month at the latest. To avoid disclosing data to the wrong person, we may verify your identity (for example by asking you to reply from the e-mail address of the account).
You also have the right to lodge a complaint with the supervisory authority: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk, or with the supervisory authority of the EU country where you live or work.
If you are a guest with a question about the menu itself (for example about allergens), please contact the restaurant directly – the restaurant is responsible for the content of its menu.
11. Do you have to provide data?
An e-mail address and password are needed to create an account, details of the establishment to show the menu to guests, and billing details for a paid plan. Without them we cannot provide the service. We do not ask you for any other data.
12. Changes to this policy
We may update this policy, for example when we add a new feature or change a processor. We will inform you of significant changes in advance by e-mail or in the app. This version is effective from 3 November 2026. The Slovak version is legally binding.