Privacy Policy

Welcome to Menuly ("Company", "we", "our", or "us"). This Privacy Policy explains how Menuly collects, utilizes, discloses, stores, and protects information when you access or use our website (menuly.app), our cloud-based restaurant administrative console, our digital menu viewers, and our QR table stand ordering solutions (collectively, the "Services").

This policy applies to both:

• Restaurant Partners ("Merchants" or "Owners"): Food establishments, cafe managers, hoteliers, and cloud kitchen operators who register an account to build and host menus.
• Dining Customers ("Diners" or "Visitors"): End-users who scan a Menuly QR code or open a public menu link on their mobile devices.

By creating an account, accessing our platform, or scanning our QR codes, you acknowledge that you have read, understood, and agree to the data handling practices described in this Privacy Policy.

We collect only the minimum information necessary to provide an ultra-fast, reliable, and secure contactless dining platform.

A. Information Provided by Restaurant Partners

• Account Credentials: Full name, registered email address, encrypted authentication password, and contact phone number.
• Restaurant Profile Information: Business name, unique restaurant slug (e.g., /menu/royal-spice), physical street address, operational business hours, currency, and WhatsApp ordering phone number.
• Menu Data & Media Assets: Dish titles, descriptions, pricing, dietary indicators (Veg, Non-Veg, Egg, Vegan, Gluten-Free), dish imagery, and restaurant logo graphics.
• Billing & Transaction Records: Subscription plan tier, invoice records, and shipping addresses for physical QR table stands, NFC pucks, and posters ordered via our Print Shop. We do not store raw credit/debit card numbers; all payments are processed through PCI-DSS Level 1 certified payment gateways.

B. Information Collected from Diners & QR Visitors

• Contactless Scan Telemetry: An anonymous timestamp of when a QR code or menu link was accessed, the requested table number (if applicable), and aggregated scan counts to help restaurant managers track footfall.
• Device & Technical Telemetry: Browser type, operating system version, screen resolution, preferred language, and approximate network location (derived from IP address). We do not record precise GPS coordinates.
• Zero Forced Signups: Unlike traditional ordering apps, Menuly does not mandate customer name, phone number, or app download for viewing menus.

C. Direct WhatsApp Ordering Data

When a customer builds a cart on Menuly and clicks "Order via WhatsApp", our platform generates a formatted text message and redirects the user directly to the restaurant's WhatsApp phone number using Meta's official wa.me protocol.Menuly acts solely as a client-side message formatter; we do not read, intercept, or store private conversation transcripts between diners and restaurant staff.

We process personal data in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, the Information Technology Act, 2000, and international principles such as the General Data Protection Regulation (GDPR) on the following lawful bases:

• Contractual Necessity: To fulfill our contractual obligations to restaurant partners, including menu hosting, QR code rendering, authentication, and dispatch of shop merchandise.
• Legitimate Business Interests: To detect malicious scanning activity, prevent fraud, optimize server performance, and ensure 99.9% menu availability during peak dining hours.
• Consent: Where explicit consent has been provided, such as opting into product update bulletins or uploading proprietary brand logos.
• Statutory Compliance: To adhere to applicable tax reporting, accounting laws, and lawful law enforcement requests.

We use the collected information for the following specific purposes:

Menuly utilizes browser localStorage and lightweight, strictly essential cookies to maintain system security and session persistence:

• menuly_token: Secure authentication token stored in an encrypted cookie / localStorage to preserve your login session.
• menuly_user: Minimal profile caching to eliminate redundant database queries and ensure lightning-fast dashboard navigation.
• Zero Invasive Tracking: We do not deploy third-party advertising cookies, cross-site trackers, or surveillance pixels that follow users across the internet.

For more details, please review our comprehensive Cookie Policy.

We do not sell, rent, or lease your personal data. We disclose information only to vetted third-party service providers bound by strict confidentiality and data protection agreements:

• Cloud Infrastructure: High-performance server hosting and database persistence with automated encrypted backups.
• Transactional Email & OTP Delivery: Trusted SMTP relays and email delivery networks for one-time passcodes and password recovery.
• Payment Gateways: Regulated payment aggregators (e.g., Razorpay, Stripe) for handling subscription invoices and merchandise checkout.
• Logistics & Printing Partners: Third-party print shops and courier services (e.g., Blue Dart, Delhivery) strictly to fabricate and deliver physical QR acrylic stands and stickers.
• Legal Requirements: Where required by valid subpoenas, court orders, or statutory legal obligations under Indian law.

We retain restaurant partner data for as long as your account remains active and in good standing. If you choose to close your account:

• Your public digital menu (/menu/[slug]) is immediately unpublished and unindexed.
• Uploaded food photographs and brand logos are queued for permanent deletion from our storage buckets.
• Account credentials and profile records are expunged within thirty (30) days, except where retention is mandated by financial, tax, or corporate recordkeeping laws.

We employ state-of-the-art administrative, technical, and physical safeguards to prevent unauthorized access, alteration, disclosure, or destruction of data:

• Transport Layer Security: All client-to-server traffic is encrypted using 256-bit TLS 1.3 cryptographic protocols.
• Password Hashing: Passwords are cryptographically salted and hashed using industry-standard irreversible algorithms before database insertion.
• Ephemeral OTPs: Single-use authentication codes expire automatically after ten (10) minutes and cannot be reused.
• Restricted Access: Production database access is tightly restricted via role-based access controls and monitored by continuous audit logs.

Under the Digital Personal Data Protection Act, 2023, and global data privacy standards, you hold the following rights:

To exercise any of these rights, please email us directly at menulyofficial@gmail.com. We acknowledge all statutory data requests within 48 hours.

The Services are designed and intended exclusively for legal business operators, restaurateurs, and adult dining patrons. We do not knowingly solicit or collect personal information from individuals under the age of eighteen (18). If we become aware that a child has provided us with personal information without parental verification, we will promptly delete such records from our servers.

Our cloud servers and delivery nodes are distributed across reputable, secure Tier-4 data centers. While primary processing conforms with Indian statutory provisions, your data may be processed on servers located internationally where our cloud hosting providers maintain infrastructure. All international transfers are safeguarded by standard contractual clauses and rigorous enterprise encryption.

We may revise this Privacy Policy periodically to reflect technological advances, platform upgrades, or regulatory mandates. When modifications occur, we will update the "Last Updated" timestamp at the top of this document. We encourage restaurant partners to review this page regularly. Continued use of Menuly following notification of changes constitutes acceptance of the revised terms.

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the name and contact details of our designated Grievance Officer are set forth below: