Privacy Policy

1. Introduction

This Privacy Policy describes how Andrea Calotychos ("we", "our" or "Data Controller") collects, uses and protects personal data when you use the Menurl platform ("Service"). We respect your privacy and are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Italian law.

2. Data Controller

3. Data We Collect

We collect different types of data to provide and improve our Service:

4. Data We Do NOT Collect

To protect your customers' privacy and simplify GDPR compliance, Menurl is designed to NOT collect:

• Personal data of end customers who view digital menus
• Customer browsing or behavior information in menus
• User geolocation data
• Profiling cookies (unless explicitly authorized)
• Audio or video recordings

5. Legal Basis for Processing

We process your personal data based on the following legal bases provided by GDPR:

6. How We Use Your Data

We use the personal data collected to:

• Provide and manage the Menurl Service
• Process payments and manage subscriptions through Stripe
• Provide technical support and respond to your requests
• Improve and personalize the Service
• Send you important service-related communications
• Comply with legal and regulatory obligations
• Prevent fraud and ensure platform security

7. Data Sharing

We do not sell, rent or commercialize your personal data. We only share data with:

8. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected:

• Account data: Until account deletion
• Restaurant data: Until removal or account deletion
• Billing data: 10 years for Italian fiscal obligations
• Technical logs: Maximum 12 months

After account deletion, all data is removed within 30 days, except for data subject to legal obligations.

9. Inactive Account Deletion

To optimize resources and ensure data security, we apply an inactive account deletion policy for users with free plans:

Deletion conditions:
• Last access to the admin account was over 2 years ago
• Last access to the restaurant's public menu was over 2 years ago
• The account has a free (FREE) subscription

Notification procedure:
• We will send an email notification to the address associated with your account
• You will have 15 days to log in and keep your account active
• If you do not log in within 15 days, we will proceed with complete deletion

Data deleted:
• All shop data (menu, settings, customizations)
• All connected accounts (administrators, staff)
• Order history and activity logs
• All information associated with the restaurant

Exemptions:
• Accounts with paid subscriptions are not subject to this policy
• Accounts that log in within the notice period remain active

10. Your Rights

In accordance with GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we process
• Right of rectification: You can correct inaccurate or incomplete data
• Right to erasure: You can request deletion of your data
• Right to restriction: You can limit processing in certain circumstances
• Right to portability: You can obtain your data in structured format
• Right to object: You can object to processing based on legitimate interest
• Withdraw consent: You can withdraw consent at any time
• Right to complain: You can file a complaint with the Italian Privacy Authority

To exercise these rights, contact us at the email address indicated in the "Contact" section.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: HTTPS connections and encryption of sensitive data
• Limited access: Only authorized personnel can access data
• Secure backups: Regular backups with encryption
• Monitoring: Monitoring systems to detect unauthorized access
• Updates: Regular software security updates

However, no system is completely secure. We invite you to use secure passwords and not share access credentials.

12. International Transfers

Your data is primarily processed and stored within the European Union. Some third-party services (such as Stripe) may transfer data to third countries, but only in compliance with GDPR and with adequate protection guarantees provided by articles 44-49 of GDPR.

13. Children's Privacy

Our Service is intended for commercial operators (restaurateurs) and does not intentionally collect personal data from minors under 16 years old. If you become aware that a minor has provided us with personal data, please contact us for immediate removal.

14. Changes to this Policy

We may update this Privacy Policy periodically. We will inform you of any changes by posting the new version on this page and updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance of the new Policy.

15. Contact