Privacy Policy

1. Information we collect

We collect information that is needed to provide the service, secure accounts, operate menus and orders, and support restaurants.

• Account data such as name, email address, password credentials, role, and authentication provider identifiers.
• Restaurant and branch data such as names, addresses, phone numbers, public slugs, logos, settings, and team membership.
• Menu content such as sections, items, descriptions, prices, images, allergens, nutrition fields, print designs, and QR configuration.
• Operational data such as orders, table numbers, service calls, reservations, reviews, and status history.
• Consent-gated first-party menu analytics such as menu views and order interactions linked to an opaque browser token.
• Payment references from our payment provider and tax-invoice references from our accounting provider when billing is enabled. Nasj Menu does not store full card numbers.

2. How we use information

We use information for the purposes described below and for closely related operational purposes.

• To provide accounts, dashboards, public menus, QR links, ordering, print exports, and support.
• To process dine-in ordering, waiter calls, reservations, reviews, notifications, and restaurant operations.
• To provide restaurant insights when optional analytics consent is accepted.
• To authenticate users, authorize tenant access, detect abuse, protect against fraud, and maintain audit logs.
• To comply with legal obligations, enforce terms, respond to lawful requests, and manage deletion or export requests.

3. How information is shared

We do not sell personal information. We share information only where needed to operate the service or meet legal obligations.

• Service providers may process data for hosting, database operations, object storage, payments, email, monitoring, analytics, and AI-assisted menu import when those integrations are enabled.
• Published restaurant menu content is public by design and can be accessed by QR code, direct link, search engines, and social previews.
• We may disclose information when required by law, to protect rights and safety, or during a business transfer.
• Data may be processed across borders by hosting and vendor infrastructure. Production vendor records should document regions, contracts, and subprocessors.

4. Retention, export, and deletion

We keep information for as long as needed to provide the service, resolve disputes, meet legal obligations, and maintain security evidence.

• Authorized users can export restaurant data and platform admins can export operational packages where supported.
• Account deletion requests use a grace period before permanent purge, unless retention is required for legal or security reasons.
• Owner-created backup snapshots expire after a short retention window; infrastructure backups are managed by the production provider.
• Audit logs are retained for the configured retention period and can be cleaned by the scheduled retention job.

5. Security

Nasj Menu uses server-side authorization, tenant scoping, password hashing, CSRF checks, upload validation, structured audit logs, and HTTPS in production. No internet service can guarantee absolute security, so restaurants should keep account access limited to trusted users.

6. Your privacy choices

Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to certain processing.

• Request access to information associated with your account or restaurant.
• Correct inaccurate account, restaurant, branch, or menu information.
• Request deletion of your account and owned restaurant data, subject to operational and legal retention limits.
• Request an export of supported restaurant or account data.
• Reject or withdraw optional analytics consent at any time from the consent banner, the cookie settings on the Cookie Policy page, or browser site data.

7. Contact

For privacy questions, requests, or vendor evidence, contact [email protected].