Privacy Policy

1. Who is responsible for your data

The data controller is Menutok ([Registered legal name — to be completed]), tax ID [NIF/CIF — to be completed], [Registered address — to be completed]. You can reach us at menutok@sandruci.com.

This policy explains how we handle personal data across menutok.sandruci.com and the digital menus we host for restaurants.

2. What data we process

• Restaurant owners/staff: name and email address from your Google account, plus the restaurant details and menu content you enter.
• Diners with an optional account: your email address and your order history, only if you opt in.
• Anonymous diners: a random device identifier (no name, no email) used to remember your cart and avoid duplicate ratings.
• Usage data: with your consent, first-party analytics on which dishes are viewed and ordered.

3. Why we process it and our legal basis

• To provide the service (menus, orders, dashboards) — performance of a contract.
• To remember a diner’s orders across visits — your consent, given on the account screen.
• To produce menu analytics for restaurants — your consent, given in the cookie banner.
• To keep the service secure and prevent abuse — our legitimate interest.

4. Who we share it with (processors)

We do not sell your data. We rely on carefully chosen providers who process data on our behalf under contract:

• Supabase — database, authentication and storage.
• Cloudflare — CDN, security and media storage (R2).
• Render — application hosting.
• Brevo — transactional email (e.g. login codes).
• Google — sign-in for restaurant accounts.

5. International transfers

Some providers may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.

6. How long we keep it

• Restaurant accounts and menus: for as long as the account is active.
• Diner accounts and order history: until you delete your data.
• Analytics events: retained in aggregate for menu insights.

7. Your rights

You can access, rectify, erase, restrict, object to, or port your data at any time by emailing menutok@sandruci.com. Diners can also delete their account and history instantly from the account screen.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).

8. Changes

We may update this policy. Material changes will be reflected here with a new “last updated” date.