How we handle your data.

Your privacy matters. This policy explains what we collect, why, and how we protect it.

Last updated: June 5, 2026 · Questions? Contact us at support@menulist.ai

Privacy & data use — short version

The practical promises behind this policy.

Core data onlyMenuList uses account, business, billing, content, security, reliability, and product-operation data.

No data resale flowThe product does not include advertising-sale or data-broker resale flows.

Main website analytics with consentGoogle Analytics and Microsoft Clarity load on the MenuList website only after analytics is accepted.

Customer menu identityPublic menu analytics do not ask visitors for names, emails, or payment details. Guest feedback may include details a visitor chooses to submit.

Owner requestsOwners can contact support@menulist.ai for account-data questions or requests.

Model-backed featuresSelected inputs are sent to configured AI providers only when a product feature needs that processing.

Information we collect

What data we gather and how it reaches us.

Information you provide

Data you voluntarily give us when you register and use our services.

Account information: Name, email address, and business details when you register
Staff account information: Staff name, email or phone number, Staff ID alias, role, store assignment, and account status when a business adds team access
Business content: Menus, price lists, images, and documents you upload
Public media prepared by MenuList removes original image metadata before storage
Payment information: Razorpay handles payment entry and payment method details; MenuList stores payment status and billing references needed for subscriptions

Generated and processed content

When you use extraction, description, translation, or image features, MenuList processes the selected content for that product action.

Generated descriptions, translations, images, and extracted menu data may be stored with your account or project
Model-backed features send the selected prompt, image, item, or menu content to the configured provider for that request
You should review generated or extracted output before publishing it

Automatically collected information

When you use our services, technical data may be processed for hosting, security, reliability, analytics, and support.

Technical request information such as IP address, browser type, and operating system
Device information and product reliability signals
Main MenuList website analytics only after you accept optional analytics
Authentication and security events, including access checks, reset requests, and session revocation metadata
Customer menu analytics are separate from the main website consent gate and do not ask visitors for names, emails, or payment details

How we use your information

The main purposes for account, product, security, support, and reliability data.

Provide servicesProcess your content and generate assets

Customer supportManage your account and assist you

CommunicationsSend important updates and policy changes

Staff access controlCreate staff access, apply roles, reset passcodes, and revoke sessions

Improve platformUse consented analytics and reliability signals to improve public pages and product quality

SecurityDetect and prevent fraud and abuse

Legal complianceComply with laws and regulations

How we share your information

Who may access data for product, payment, hosting, analytics, support, security, or legal reasons.

Service providers

We share data with trusted vendors who help us operate the platform.

Payment processing (Razorpay) — payment method details are handled by Razorpay, not MenuList card-entry forms
Cloud hosting and infrastructure such as Vercel, Google Cloud, and Firebase
Main website analytics (Google Analytics and Microsoft Clarity) — only after analytics consent
Configured AI providers such as Google Gemini — when extraction, translation, description, or image features need model processing

Legal requirements

We may disclose your information when legally required to comply with court orders, subpoenas, or applicable law.

We do not add product flows for selling personal data
Operational providers receive data only for the product, payment, hosting, analytics, support, security, or legal purpose they serve
Legal requests are reviewed against the account, business, and data involved

Authorized team access

Owners may give staff access to the business account. Staff can see only the areas their assigned role allows.

Staff access is controlled by the business owner
Role and store assignments limit what staff can access
Owners should remove, deactivate, or sign out staff when access is no longer needed

Data retention

We keep personal data only while it has a product, security, support, billing, or legal purpose.

Account dataKept while the account is active or needed to provide support, security, and account recovery.

Billing recordsKept for legally required tax, accounting, and dispute-resolution periods.

Product logs and analyticsKept only as long as needed for reliability, security, product reporting, and abuse prevention.

Support recordsKept while needed to resolve requests, maintain quality, and preserve an operational record.

Public mediaPrepared public media is kept until replaced, unpublished, or deleted through the relevant product flow.

Deletion requestsEligible data is deleted or anonymized unless account, billing, security, dispute, or legal obligations require retention.

Data security

Application controls and provider-backed infrastructure used by the product.

Application security controls

MenuList uses application-level checks around account, staff, store, and expensive product actions.

Protected API routes use session and role checks
Sensitive staff and AI actions use rate limits and validation

Infrastructure security

The product runs on managed infrastructure and keeps security-relevant application events visible to operators.

Security logging for authentication and critical access events
Provider-backed hosting, database, storage, auth, and payment services

Access controls

Owner and staff access is controlled through roles, store assignments, account status, and session checks.

Owners can assign staff roles and store access
Owners can reset staff passcodes or sign out staff sessions
MenuList does not store plain-text staff passcodes

Your privacy rights

Depending on your location, you may have the following rights under applicable data protection laws.

Right to accessRequest a copy of your personal data

Right to correctionUpdate inaccurate or incomplete data

Right to deletionRequest deletion of your personal data

Right to portabilityRequest portable data where applicable

Right to objectObject to certain data processing

Right to withdraw consentWithdraw consent for data processing

To exercise your rights, contact us at support@menulist.ai

Questions about your data?

We keep public privacy claims tied to the product behavior we can verify.

Upload your menu →