Privacy policy

1. Who is responsible

Nikola Veselinović, Belgrade, Serbia is responsible for your personal data in menuless. Contact: support@menuless.io.

2. What we collect

• Account: your email address and password (stored only as a secure hash).

• Venues: what you enter – name, link, logo, address, opening hours, Wi-Fi, phone numbers, social links, payment methods, languages, menus, prices and images.

• Subscription: its status and dates; card details are handled by the payment provider, not by us.

• Support: what you write to us by email.

• On your phone the app keeps the chosen app language, the selected venue and your sign-in session.

3. Why we use it

To run your account and sign you in, to show your venue's menu to customers, to send codes and important messages about the service by email, to answer support questions, and to keep the service secure. We use the data only to provide menuless (performance of the contract) and for security (legitimate interest). We do not sell your data, and the app has no ads and no tracking.

4. What is public

Your venue's menu page on menuless.io is public: everything you enter for customers – name, address, hours, menu, prices, images, phone numbers and links – can be seen by anyone with the link and by search engines. The Wi-Fi password is public only if you turn that on. Your email address is never shown.

5. Who processes it for us

Supabase (database, sign-in and image storage, servers in Europe), Vercel (the menuless.io website), the email provider that sends sign-in codes, and, once subscriptions start, the payment provider. They process data only on our behalf and under data protection agreements. Some of them are based outside your country; transfers use the safeguards the law requires.

6. How long we keep it

As long as your account exists. When you delete your account in Profile → Delete account, your account, venues, menus and images are deleted right away; backups are overwritten within 30 days. So that the free trial is given only once per email address, we keep a one-way hash of the address (not the address itself), which cannot be turned back into it. Records we must keep by law (for example invoices) are kept for the time the law requires. Without the app you can ask for deletion at menuless.io/delete-account. An account without an active subscription that nobody has signed in to for 12 months may be deleted, after a notice by email at least 30 days before. If we discontinue menuless, all data is deleted within 30 days after the end of the last paid period.

7. Guests of your venue

Guests who open a menu do not need an account, and we do not collect personal data about them. We count how many times a menu is opened each day – only the number, without the IP address or anything else about the customer – and show it to the venue. The website keeps two settings in the customer's browser (local storage): the chosen light or dark look, and that today's visit was already counted; they stay on the device, are not sent to us and are not used for tracking. The website uses no tracking cookies; the hosting provider briefly logs technical data such as the IP address to keep the site secure.

8. Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a common format, and you can object to processing. Most of it you can do yourself in the app. Write to support@menuless.io. You can also complain to the data protection authority in your country (in Serbia: the Commissioner for Information of Public Importance and Personal Data Protection).

9. Changes

If we change this policy in an important way, we will tell you in the app or by email. The date at the top shows the current version.