Privacy

What MenuFit stores

MenuFit stores account identity and display settings, menu analyses, source provenance, translations, visual assets, read permissions and provider-cost records. Raw menu inputs are removed at terminal processing state; normalized content and exact-byte digests may remain so unchanged menus can reuse their analysis. Public menu snapshots are shared and checked for updates; private menus and caches are restricted to their owner.

Retired dietary profiles, preferences, context, favorites and visit history are removed from the active database. Historical purchases, receipts and payment events remain for reconciliation and accounting; they do not determine menu-reading access.

Business workspaces

For business accounts, MenuFit stores membership names and email addresses, roles, venue contact details, locations and hours, source links, menu drafts, publication history, uploaded and generated photos, report settings, newsletter preferences and delivery records. These records support authorized menu management, publishing, analytics, reports and account support. Only members with the required role and existing access may manage a workspace; published menu content is public.

How data is used

Menu content is sent to configured providers to perform requested analysis, English translation or representative illustration. Dietary profiles are not supplied. Generated images are not ingredient or allergen evidence. OAuth credentials and payment webhook secrets remain server-side.

Business menu content and selected photos may be processed by AI providers for requested preparation, translation or image operations. Hosting and storage providers hold application data; email providers deliver requested account and business messages; payment providers process website billing. The plugin does not initiate purchases. When you connect with OpenID Connect and grant email access, the client receives your email and its actual verification status to identify the account and apply workspace domain restrictions.

QR menu partner attribution

Registered business links and buttons measure menu-page views, button impressions and clicks using a random visit identifier. Reports are aggregate and do not expose account emails or historical dietary data. Existing payment attribution remains with its purchase record. Raw partner events are retained for up to 13 months; raw IP addresses and full user-agent strings are not stored.

On connected MenuFit menus, we also measure reader language, applied filters, category views, visible item impressions, detail opens and whether searches return results. A random identifier lasts for one page opening; these events are not joined to your account. Search text is not stored. Reader event records are retained for up to 90 days and hourly aggregate counts for up to 13 months.

Your choices

Business drafts, publication revisions, media and membership records have no automatic short-term expiry. They remain until removed through supported business controls or an operator-reviewed deletion request. Unpublishing withdraws the current public menu; it does not erase retained draft or publication history. Disconnecting OAuth revokes client access and does not delete workspace data. Financial and security records may be retained where needed for accounting, dispute resolution and abuse prevention.

You may update account display settings. Contact the MenuFit operator for account access or deletion requests; financial records may require retention. Menu-source owners may request removal through support.