Legal
Privacy policy
What QR Menu records, why, and who else sees it. Short, because the service collects little.
Last updated 7 August 2026
Placeholders in square brackets must be completed with the operator's registered details before this site is published. This text is not legal advice and should be reviewed by a qualified adviser.
Who is responsible
The controller of the data described here is [Company name], [registered address]. You can reach us at [contact e-mail].
If you are a restaurant owner
Creating an account stores your e-mail address and an encrypted form of your password. Setting up a restaurant stores what you type in: name, address, phone number, opening hours, a logo if you upload one, and a footer note if you write one. Uploading a menu stores the photograph or PDF itself, the text recognised in it, and the dishes, prices, allergens and translations produced from it.
If you are a guest reading a menu
No account, no sign-in, and no profile. The order you build stays in your browser's memory and is never sent anywhere — closing the tab discards it. The only thing stored on your device is a cookie remembering which language you chose.
Why we process it
To provide the service you asked for: reading your menu, translating it, publishing it and producing a QR code (performance of a contract, Art. 6(1)(b) GDPR). To keep accounts secure and the service running (legitimate interests, Art. 6(1)(f)). Where the law requires records to be kept, to comply with it (Art. 6(1)(c)).
Automated processing of your menu
The photograph you upload is sent to Google Cloud Vision for text recognition, and the recognised text is sent to Anthropic's Claude API to be sorted into dishes and translated. Neither is used to make a decision about a person. Both are steps you start deliberately, and the result is a draft you review before anything is published.
Who else processes it
Supabase (database, authentication and file storage), Google Cloud (text recognition), Anthropic (menu parsing and translation) and our hosting provider. Each acts on our instructions under a data processing agreement. We do not sell data, and we do not share it for advertising.
Where it is kept and for how long
Data is stored on servers in the European Union where our providers offer it; transfers outside the EEA rely on the European Commission's standard contractual clauses. Menus and their files are kept while your account exists. Delete a restaurant and its menus, items, translations, uploads and QR codes are deleted with it. Delete your account and everything under it goes.
Your rights
You can ask for a copy of your data, correct it, delete it, restrict or object to its processing, and receive it in a portable form. Write to [contact e-mail] and we will answer within one month. You also have the right to complain to your national data protection authority.