Privacy Policy for QR Code and Digital Menus

1. Who is responsible

Digmenu (“we”, “us”, or “our”) provides digital-menu tools for restaurants and other hospitality businesses. For privacy questions, contact info@digmenu.app.

This policy covers our website, business dashboard, public digital menus, and support. We are responsible for the purposes and means of processing account, billing-administration, support, and platform-security information. Businesses decide which information they upload and publish on their menus. Where we process personal data solely on a business’s instructions, our processing role and obligations must be covered by the applicable data-processing agreement. For information a restaurant publishes, you may contact that restaurant or ask us to help route your request.

We follow applicable data-protection law, including Kosovo’s Law No. 06/L-082 and the GDPR where it applies. This policy explains processing; reading it or accepting our Terms is not blanket consent to optional tracking or marketing.

2. Information we process

We receive information from you, the business administering an account, your use of our services, and payment-status information from Paddle:

Account and access: contact details, account identifiers, password hashes, and relevant employee roles or permissions. If you sign in with Google, we receive your name, email address, profile picture, and a Google account identifier. We do not receive your Google password.
Business and menu content: business details, descriptions, images, menu files, translations, domain settings, and any contact or guest Wi-Fi details you choose to publish.
Trial and billing administration: trial dates, plan status, subscription and transaction references, payment amounts/status, and refund records needed to administer access. Paddle collects checkout and payment information; we do not store full card details.
Support: information you send through email or Contact forms and our replies. We do not offer live chat.
Technical information: IP addresses, browser/device details, requests, usage events, and diagnostic/security logs generated when you use the service.
Guest preferences: language selections and the product IDs used by My Picks, stored in the guest’s browser as explained in Section 7.
Guest feedback (optional): when a guest chooses to rate their visit on a restaurant's public menu, we store their food and service ratings, an optional short comment (up to 500 characters), the menu language they were viewing, and the time of submission. This is shared only with that restaurant's account holders. We do not store guest accounts, names, email addresses, or IP addresses in the feedback record; IP addresses may be used briefly and only in memory to apply abuse limits. We retain feedback for up to twelve months, then delete it automatically unless the restaurant removes it sooner.

Some fields are needed to create an account, provide a requested feature, or process a purchase; without them we may be unable to provide that function. Optional publication fields and AI uploads are your choice. Guests can browse public menus without registering.

3. Why we process information

Processing purposes and legal bases where applicable
Purpose	Basis where applicable
Provide accounts, menus, selected AI tools, and subscription access	Performance of our contract with an individual customer; legitimate interests in serving a business customer for its authorized representatives’ data
Answer enquiries and provide support	Steps requested before a contract, performance of a contract, or legitimate interests in responding and resolving issues, as applicable
Operate security, prevent abuse, enforce usage limits, and diagnose faults	Legitimate interests in protecting users and running a reliable service; legal obligations where applicable
Maintain accounting records and handle lawful requests	Applicable legal obligations; legitimate interests in resolving disputes where appropriate
Produce menu-usage statistics and improve functionality	Legitimate interests only where justified following assessment; consent for tracking where required
Optional promotional communication, if offered	Consent where required, or another specifically applicable lawful basis with an available opt-out

Our local 14-day Pro trial is administered by Digmenu. Paddle handles paid purchases; starting a no-card trial does not itself submit payment details to Paddle.

Service messages, such as billing or security notices, are distinct from optional marketing. Where we rely on legitimate interests, we balance those interests against individuals’ rights. Where consent is required, we obtain it separately and allow withdrawal.

4. Public menus and external links

Published menus and the information a business chooses to include can be viewed by anyone with access to the URL, QR code, or NFC link. Other people may copy public information; removing it from Digmenu cannot guarantee removal of copies held independently elsewhere.

Select public contact details and Wi-Fi information carefully. When you follow an external link, such as a restaurant’s WhatsApp link, the destination provider’s privacy practices apply to that interaction.

5. Providers and recipients

We disclose information needed to provide the relevant function:

Providers and their functions
Provider	Function
Hetzner	Production hosting
Cloudflare	DNS and related infrastructure; Turnstile checks on signup, password reset, and contact forms; Workers AI for enabled image-enhancement requests
Resend	Delivery of account and service emails
Sentry	Error diagnostics
Upstash	Rate limiting and caching
Google (sign-in)	Optional sign-in when you choose Google; identity only (name, email, profile picture, account identifier)
Google Gemini	Requested AI menu import and translation
Paddle	Checkout, payments, invoices, transaction taxes, and subscription administration

Providers processing on our behalf must be governed by appropriate data-protection arrangements. Some recipients have their own legal responsibilities: Paddle acts as a separate controller for its Merchant-of-Record processing, described in its Privacy Policy. Not every recipient acts solely on Digmenu’s instructions.

Authorized personnel may access information as needed for support, administration, security, and legal obligations. We may disclose information where law requires it or where necessary and lawful to establish or defend legal claims. We do not sell your personal data.

6. AI processing

When you use Digmenu’s menu import or translation features, Digmenu sends the relevant menu files or text to Google’s Gemini API. Under Google’s Gemini API terms for unpaid services, Google may use that content to provide, improve, and develop its products and machine learning, and human reviewers may read it (except where Google’s terms apply paid-service data handling, for example for users in the EEA, Switzerland, or the UK). Do not include personal or sensitive information in uploaded menus. See Google’s Gemini API terms: https://ai.google.dev/gemini-api/terms.

When you use Digmenu’s optional product-image enhancement, Digmenu sends the image and instructions to Cloudflare Workers AI; Cloudflare states that Workers AI customer content is not used to train Workers AI models or to improve Cloudflare or third-party services without explicit consent, and is stored by Cloudflare only if you also use a Cloudflare storage product with that workload. See Cloudflare Workers AI data usage.

Review AI results before publishing. AI processing involves a provider, not only your device.

7. Cookies, browser storage, and analytics

Digmenu does not use advertising cookies or third-party trackers. When you choose Google sign-in, short-lived OAuth state cookies may be set during the redirect flow so Digmenu can complete sign-in securely. Signup, password reset, and contact forms may use Cloudflare Turnstile (challenges.cloudflare.com) so Digmenu can tell a person from an automated submission; Digmenu verifies that result on its own server, and the check is not used for advertising. Public menus may load flag images from flagcdn.com (a content delivery network for display only).

Preferences and account access: guest menu language cookie skanom_guest_locale_<menu-slug> (up to about 365 days); My Picks and menu language in local storage (skanom:my-picks:<business-id>, skanom:menu-locale:<business-id>); marketing site language cookie digmenu-marketing-locale when you change language on the marketing site; active business cookie skanom-active-business when signed in; and session authentication cookies after login (provider-managed lifetime).

First-party analytics: tab-scoped session storage keys dm-analytics-sid, dm-analytics-mv:*, dm-site-analytics-sid, and dm-site-analytics-pv:* help deduplicate menu and marketing page views before events are sent to Digmenu. Raw menu analytics events are stored on Digmenu’s servers for 400 days and raw marketing site page-view events for 90 days, then removed under our analytics maintenance schedule. Request IP addresses are used for rate limiting and are not written into those analytics event rows. To show restaurants which countries their menu visitors come from, Digmenu looks up the visitor's country from the request IP address on our own server using a local database. Only the two-letter country code is stored; the IP address used for the lookup is not stored or logged for analytics.

IP geolocation by DB-IP (IP to Country Lite), licensed under CC BY 4.0.

Browser controls can remove or block stored data, but blocking necessary storage may affect functionality.

8. Retention and account deletion

We retain information for its stated purpose, not indefinitely:

Active accounts: information necessary to provide the service remains while the account is active, subject to deletion requests and legal duties. Linked Google sign-in identifiers stored in your account are removed when your Digmenu account is deleted.
After trial or paid access ends: Digmenu may restrict dashboard access and unpublish public menus. That does not by itself delete saved menu content. Digmenu is not an archival service and does not promise indefinite retention of accounts or menus. Specific retention periods for inactive accounts and menus are not yet published and remain under internal review.
Support and disputes: records remain for handling the enquiry and any related, applicable claims period; unrelated data should be removed when no longer needed.
Billing records: information necessary for accounting and legal compliance remains for the applicable statutory period. Paddle independently determines retention for records it controls.
First-party analytics (menu and site): raw menu analytics events are retained for 400 days and marketing site page-view analytics for 90 days, then removed under Digmenu’s scheduled analytics maintenance process.
Menu-import temporary sources: unfinished menu-import source files are configured to expire after about 48 hours and are removed by a scheduled cleanup process. This applies to temporary upload sources, not menu content you have committed to your account.
AI image-enhancement temporary files: abandoned enhancement candidate files expire on a short window (about 36 hours by default) and are removed by a scheduled cleanup process. Product images you save to your menu are not removed by that process.
Provider-side logs and AI retention: see Section 6 for Gemini and Cloudflare Workers AI. Email, payment, and diagnostics providers may retain information under their own terms for delivery, abuse prevention, billing, and legal compliance.
Backups: Digmenu’s documented backup policy targets a minimum recoverable history of 30 days and a rolling daily window of 45 days when prune is approved; lifecycle pruning is currently deferred and backups are retained until prune is enabled. After restoration, deletion or reapplication of customer-requested erasures must follow the applicable support process.

Account deletion is requested through Profile or support and is reviewed before completion. We may retain specific records where law requires or permits this, explaining the applicable reason. A paid-access restriction is not account deletion. Browser-stored guest preferences are controlled separately on the visitor’s device.

9. International processing

Digmenu’s application servers run in Nuremberg, Germany (Hetzner). Digmenu is operated from the Republic of Kosovo, which is not an EU/EEA member state. Providing the service also involves other providers. For example Cloudflare (DNS and, when you use image enhancement, Workers AI), Google (Gemini for requested menu import/translation), Paddle (paid checkout as merchant of record), Resend (email), Sentry (error diagnostics; Digmenu’s event ingest uses Sentry’s EU/de endpoint), and Upstash (rate limiting and caching). Those providers may process information in the EU, the UK, the United States, or other countries where they or their subprocessors operate. Public menus may load flag images from flagcdn.com as a content delivery network.

Where a transfer needs a specific safeguard under the law that applies to Digmenu or to a customer, Digmenu relies on the provider’s data-processing terms, including Standard Contractual Clauses and, where a provider participates, frameworks such as the EU–US Data Privacy Framework. A German or EU hosting location for Digmenu’s own servers does not by itself mean every provider keeps all data only in the EU.

10. Security

We use safeguards appropriate to the risks of processing and applicable law. Passwords are stored as hashes, not as readable passwords. No online service can guarantee absolute security. We will assess security incidents and notify affected parties and authorities where required by law.

Please protect your account credentials and report suspected unauthorized access to info@digmenu.app. This policy does not waive your statutory rights or our legal responsibilities.

11. Your rights and complaints

Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent without affecting the lawfulness of earlier processing. You may object to direct marketing at any time.

Contact info@digmenu.app. We may request proportionate information to verify identity. Where GDPR applies, we respond without undue delay and within one month, subject to lawful extensions explained within that month. We follow applicable deadlines for other requests. A response deadline is not a promise that every record can be immediately erased.

You may complain directly to Kosovo’s Information and Privacy Agency, or another competent supervisory authority, including one available to you under applicable EU law. You do not have to complain to us first.

12. Children, changes, and contact

Digmenu business accounts are for people aged 18 or over who are acting for a restaurant or other hospitality business (or who otherwise have legal capacity and authority to bind that business). Guests who only view a public digital menu do not create a Digmenu account. Digmenu’s AI tools are business features and are not directed at children. If you believe a child has provided personal information that should not have been collected, contact us so we can assess and address it.

We will update this policy when practices change, show the revision date, and provide notice of material changes as required. A revised notice does not itself create consent for a new purpose.

Digmenu · Republic of Kosovo
Email: info@digmenu.app
Contact form: https://www.digmenu.app/contact