How we handle your data.

Your privacy matters. This policy explains what we collect, why, and how we protect it.

Last updated: August 13, 2026 · Questions? Contact us at support@menulist.ai

Privacy & data use — short version

The practical promises behind this policy.

Core data onlyMenuList uses account, business, billing, content, security, reliability, and product-operation data.

No data resale flowThe product does not include advertising-sale or data-broker resale flows.

Main website analytics with consentPlausible, Google Analytics, and Microsoft Clarity load on the MenuList website only after analytics is accepted and the relevant tool is configured.

Customer menu identityPublic menu analytics do not ask visitors for names, emails, or payment details. Guest feedback may include details a visitor chooses to submit.

Owner requestsOwners can contact support@menulist.ai for account-data questions or requests.

Model-backed featuresSelected inputs are sent to configured AI providers only when a product feature needs that processing.

Information we collect

What data we gather and how it reaches us.

Information you provide

Data you voluntarily give us when you register and use our services.

Account information: Name, email address, and business details when you register
Staff account information: Staff name, email or phone number, Staff ID alias, role, store assignment, and account status when a business adds team access
Business content: Menus, price lists, images, and documents you upload
Public media prepared by MenuList removes original image metadata before storage
Payment information: Razorpay handles payment entry and payment method details; MenuList stores payment status and billing references needed for subscriptions
Optional discovery information: The closed-list source you select when asked where you first heard about MenuList

Generated and processed content

When you use extraction, description, translation, or image features, MenuList processes the selected content for that product action.

Generated descriptions, translations, images, and extracted menu data may be stored with your account or project
Model-backed features send the selected prompt, image, item, or menu content to the configured provider for that request
You should review generated or extracted output before publishing it

Automatically collected information

When you use our services, technical data may be processed for hosting, security, reliability, analytics, and support.

Technical request information such as IP address, browser type, and operating system
Device information and product reliability signals
Main MenuList website analytics, including Plausible, Google Analytics, and Microsoft Clarity when configured, only after you accept optional analytics
Authentication and security events, including access checks, reset requests, and session revocation metadata
Customer menu analytics are separate from the main website consent gate and do not ask visitors for names, emails, or payment details

Owner referral information

When a business accepts an owner referral, MenuList keeps the minimum attribution and reward record needed to issue credits and show a general status.

Business names and internal tenant/store references for the referring and referred businesses
Referral capture, paid-state, reward issue, and credit-ledger timestamps and references
The referring business can see the referred business name and a general waiting or credited status
The referring business cannot see the referred plan, price, payment method, contact details, or account activity

How we use your information

The main purposes for account, product, security, support, and reliability data.

Provide servicesProcess your content and generate assets

Customer supportManage your account and assist you

CommunicationsSend important updates and policy changes

Staff access controlCreate staff access, apply roles, reset passcodes, and revoke sessions

Improve platformUse consented analytics and reliability signals to improve public pages and product quality

Understand discoveryUse optional self-reported signup sources to compare broad acquisition channels without collecting free-text profiles

SecurityDetect and prevent fraud and abuse

Referral rewardsAttribute owner invitations, verify paid eligibility, issue credits, and maintain an auditable reward ledger

Legal complianceComply with laws and regulations

How we share your information

Who may access data for product, payment, hosting, analytics, support, security, or legal reasons.

Service providers

We share data with trusted vendors who help us operate the platform.

Payment processing (Razorpay) — payment method details are handled by Razorpay, not MenuList card-entry forms
Cloud hosting and infrastructure such as Vercel, Google Cloud, and Firebase
Main website analytics (Plausible, Google Analytics, and Microsoft Clarity when configured) — only after analytics consent
Configured AI providers such as Google Gemini — when extraction, translation, description, or image features need model processing

Legal requirements

We may disclose your information when legally required to comply with court orders, subpoenas, or applicable law.

We do not add product flows for selling personal data
Operational providers receive data only for the product, payment, hosting, analytics, support, security, or legal purpose they serve
Legal requests are reviewed against the account, business, and data involved

Authorized team access

Owners may give staff access to the business account. Staff can see only the areas their assigned role allows.

Staff access is controlled by the business owner
Role and store assignments limit what staff can access
Owners should remove, deactivate, or sign out staff when access is no longer needed

Where your data is kept

Storage and processing locations used by this product.

Application and customer dataFirestore, Authentication, and Storage run through Firebase in Google Cloud as configured for each environment/project.

Marketing site traffic dataOptional website analytics tools are configured through third-party services and run under their own privacy/retention settings.

PaymentsPayment processing details are handled by Razorpay as a separate card-payment and checkout provider.

Media processingGenerated and uploaded content is prepared in provider tools where needed and stored in MenuList storage buckets for delivery.

Data retention

We keep personal data only while it has a product, security, support, billing, or legal purpose.

Account dataKept while the account is active or needed to provide support, security, and account recovery.

Billing recordsKept for legally required tax, accounting, and dispute-resolution periods.

Referral reward recordsKept with billing and credit-ledger records while needed for accounting, support, security, and duplicate-issue prevention.

Product logs and analyticsKept only as long as needed for reliability, security, product reporting, and abuse prevention.

Support recordsKept while needed to resolve requests, maintain quality, and preserve an operational record.

Public mediaPrepared public media is kept until replaced, unpublished, or deleted through the relevant product flow.

Deletion requestsEligible data is deleted or anonymized unless account, billing, security, dispute, or legal obligations require retention.

Data security

Application controls and provider-backed infrastructure used by the product.

Application security controls

MenuList uses application-level checks around account, staff, store, and expensive product actions.

Protected API routes use session and role checks
Sensitive staff and AI actions use rate limits and validation

Infrastructure security

The product runs on managed infrastructure and keeps security-relevant application events visible to operators.

Security logging for authentication and critical access events
Provider-backed hosting, database, storage, auth, and payment services

Access controls

Owner and staff access is controlled through roles, store assignments, account status, and session checks.

Owners can assign staff roles and store access
Owners can reset staff passcodes or sign out staff sessions
MenuList does not store plain-text staff passcodes

Your privacy rights

Depending on your location, you may have the following rights under applicable data protection laws.

Right to accessRequest a reviewed copy of applicable personal data

Right to correctionUpdate inaccurate or incomplete data

Right to deletionRequest deletion of your personal data

Right to portabilityRequest portable data where legally applicable

Right to objectObject to certain data processing

Right to withdraw consentWithdraw consent for data processing

To exercise a right, contact support@menulist.ai from the account email where possible and state the business, account, and request type. We verify identity and business authority before disclosing, correcting, exporting, or deleting data. Account closure may require subscription, billing, dispute, security, shared-business access, and legal-retention checks.

Questions about your data?

Send an access, correction, portability, or deletion request to our support team.

Email privacy request