Legal

    Privacy Policy

    Last updated: 5 May 2026

    This Privacy Policy explains how not yet published — available on request ("we", "us", "our") collects, uses and protects personal data when you use our website, dashboard and related services (the "Service"). We act as the data controller for the personal data described below. We follow the UK GDPR, EU GDPR and the ePrivacy regulations where applicable.

    1. Who we are

    The data controller is not yet published — available on request, registered at not yet published — available on request under company number not yet published — available on request. You can contact us at privacy@instaqrmenu.com.

    2. Data we collect

    Data you provide

    • Account data: name, email, password hash, role.
    • Business data: business name, address, phone, currency, branding assets.
    • Menu data: menus, categories, items, prices, allergens, images you upload.
    • Payment data: handled by Stripe — we never see your full card number.
    • Support data: messages, attachments and metadata when you contact us.

    Data we collect automatically

    • Log data: IP address, browser, device, pages viewed, timestamps.
    • Cookies and similar technologies — see our Cookie Policy.
    • Guest menu view counts, only after the guest accepts analytics cookies: the restaurant, menu, day, whether the visit came from a QR code, a web link or an embedded menu, and the referring website's domain. We don't store browser details or any identifier with these counts.

    3. How and why we use your data

    PurposeLawful basis
    Providing the Service (account, menus, publishing)Contract
    Billing and fraud preventionContract / Legal obligation
    Transactional emails (e.g. import ready, password reset)Contract
    Product analytics and improvementConsent
    Measuring advertising performance (Google Ads conversion tracking, e.g. counting sign-ups from our ads)Consent (marketing cookies)
    Marketing emailsConsent (you can opt out at any time)
    Security, abuse prevention, legal complianceLegitimate interest / Legal obligation

    4. Who we share data with

    We use the following sub-processors. Each is bound by a data-processing agreement and only handles data on our instructions:

    • Lovable Cloud (Supabase) — hosting, database, authentication, file storage.
    • Stripe — payment processing for subscriptions.
    • Lovable (managed email, part of Lovable Cloud) — sending account and service emails from notify.instaqrmenu.com.
    • Lovable AI Gateway (Google Gemini models) — AI processing of menu content you submit for import, translation or suggestions.
    • Google Ads — measuring advertising conversions (such as sign-ups) when you accept marketing cookies. See Google's Business Data Responsibility site for how Google handles this data.

    We do not sell personal data. We may disclose data if required by law or to protect our rights.

    5. How long we keep data

    • Account and business data: while your account is active and for up to 12 months after closure (then deleted or anonymised).
    • Billing records: 7 years (legal obligation).
    • Support messages: up to 24 months.
    • Server logs: up to 90 days.

    6. International transfers

    Some sub-processors (e.g. Stripe, Google) may process data outside the UK / EEA. When this happens we rely on Standard Contractual Clauses, the UK IDTA, or an adequacy decision.

    7. Your rights

    You have the right to:

    • Access the personal data we hold about you.
    • Have it corrected or deleted.
    • Restrict or object to processing.
    • Receive a copy in a portable format.
    • Withdraw consent at any time (without affecting prior processing).
    • Lodge a complaint with your supervisory authority — in the UK, the ICO (ico.org.uk).

    To exercise any right, email privacy@instaqrmenu.com.

    8. Security

    We use TLS in transit, encryption at rest, role-based access control, and regular backups. No system is 100% secure — please use a strong, unique password and enable any available account-protection features.

    9. Children

    The Service is not directed at children under 16. We do not knowingly collect data from them.

    10. Changes to this policy

    We may update this policy from time to time. Material changes will be notified by email or in-app. The "Last updated" date at the top reflects the latest revision.

    11. Contact us

    Questions? Email privacy@instaqrmenu.com or write to us at the address in section 1.