Last updated: (version 2026-10c)

Privacy Policy

This policy explains what MenuBeacon collects, why, how long it is kept, and the choices you have. It covers restaurant owners and staff with MenuBeacon accounts, diners who scan a MenuBeacon QR code or place an order through a MenuBeacon menu, and visitors to this website, including people who use the contact form or chat with Zuzu.

Who is responsible for your data

For restaurant owner and staff accounts, and for visitors to this website, MenuBeacon is the controller. For diners, the restaurant you order from is the controller of your order and contact details and decides how they are used; MenuBeacon processes them on the restaurant's behalf to run its menu, ordering and receipts. The restaurant's name, address and contact details are shown before you place an order. Diner accounts (saved addresses and order history across restaurants) are run by MenuBeacon as controller.

Data we collect from restaurant accounts

When you create and use a MenuBeacon account we collect your email address, password (stored as a bcrypt hash, never in plain text), restaurant profile details, menu content, uploaded images, QR code records, staff PINs, and billing status. If you enable optional integrations we also store the configuration you provide, such as notification phone numbers or printer addresses.

Data we collect from diners

When a diner scans a menu QR code, MenuBeacon records scan analytics: an anonymized IP address, approximate location (city and country), browser, operating system, device type, referrer, timestamp, the table or QR code identifier, and a daily session hash used to estimate unique visitors. When a diner places an order, we collect the order contents plus any details the diner chooses to provide, such as a name, phone number, email for a receipt, or delivery address. Card details are processed by Stripe and never touch MenuBeacon servers.

Contact form

When you send a message through the contact form on this website, we collect your name, email address, the subject and message you write, your IP address and your browser's user agent. Since version 2026-10 of this policy (October 2026), the last part of your IP address is removed before a message is stored or emailed to us; messages we received before then, and the notification emails sent for them, may still contain the full IP address. We use these details to reply to you and to prevent spam and abuse. We keep them for as long as we need to handle your request and keep a record of our correspondence, and then delete them.

Website chat (Zuzu)

The chat assistant on this website, Zuzu, answers most questions from built-in answers. When those don't cover your question, what you type (with the earlier messages of the same chat) and the page you're on are sent to our AI provider, Anthropic, to generate a reply. We save each conversation (what you type, Zuzu's replies, the pages you chatted from and the times) so our team can see what visitors ask, check Zuzu's answers and improve them. If you type something that looks like a payment card number, our server removes it before the chat is saved or sent to Anthropic; other details, such as an expiry date or security code, aren't removed, and your browser's own copy of the chat still shows what you typed.

Our team doesn't reply inside the chat. If you want an answer from a person, you can leave your name and email in the chat (Zuzu offers this after its first answer, and after that the envelope button at the top of the chat opens it) or use the contact form. Leaving them is optional. Details you leave in the chat are stored as a message for our team, like a contact-form message, together with your first question and the page you were on, and are linked to your saved chat, so our team sees your name and email next to it; we may also be notified by email. We don't keep your IP address or browser details with them. We use your name and email only to reply about your question, never for marketing, on the basis of our legitimate interests in answering people who ask us to get in touch, and you can object at any time. We keep the message, including the copy of your first question, as described under Data retention; deleting a saved chat removes the link to your details but not the message itself, so if you ask us to delete your chat, tell us whether to delete your details too. To see, correct or delete them, email support@menubeacon.com from the address you left (or, if that address was wrong, use the contact form).

Saved chats are deleted automatically 12 months after the last message. We don't save your IP address with them or link them to cookies, analytics or a MenuBeacon account; each chat is stored under a random chat ID, which your browser also keeps until you close the tab. Our hosting provider's server logs, which record the IP address of every request to this website, are kept separately for a limited time. Nothing typed in the chat before October 13, 2026 was saved; until then, chats were deleted after 24 hours. We use and keep chats on the basis of our legitimate interests in answering visitors' questions about MenuBeacon and improving Zuzu's answers, and you can object at any time. Saved chats aren't linked to an account, and they're linked to an email address only if you left your details or typed one into the chat. If you left your details in the chat, just email us from the address you gave; otherwise, to object, get a copy of a chat or have it deleted sooner, contact us with the date and rough time you chatted, the page you were on and some of what you wrote; we use those details only to find the chat.

To prevent abuse we count messages per connection using a keyed hash of your IP address rather than the address itself, and our usage records hold only times and counts, not what you wrote. The chat does not set cookies; your browser keeps its own copy of the chat in session storage so it follows you between pages, and clears that copy when you close the tab (the copy saved on our server is kept as described above). Please don't type personal, payment or other sensitive details in your chat messages (the form for your name and email is separate); for questions about your account, contact us instead.

IP anonymization and geolocation

Raw IP addresses are anonymized by default before storage (the final octet is removed), and raw IPs are never exposed through analytics views or APIs. Approximate city/country geolocation is derived from the request IP using ipapi.co, a third-party geolocation service; the lookup is best-effort and processed according to ipapi.co's own privacy policy.

Age-restricted orders and marketing choices

When an order contains alcohol, tobacco or other age-restricted items, we record that you confirmed the legal minimum age and when; staff check ID when handing the order over. Marketing email and marketing text messages are separate choices, both off unless you tick them, and the restaurant records when consent was given or withdrawn. You can unsubscribe from email with the link in every message and from texts by replying STOP.

How we use data

MenuBeacon does not sell personal data and does not use diner data for advertising.

Third-party processors

Data retention

Data is kept for its purpose and then deleted. Scan analytics are retained for 365 days by default. Website chats with Zuzu are deleted automatically 12 months after their last message. Contact-form messages, and names and emails left in the chat (with the copy of your first question sent with them), aren't deleted automatically: our team deletes them once your request is handled and we no longer need a record of the correspondence, or sooner if you ask. Deleted data can remain in our hosting provider's backups until those backups are overwritten; we don't restore it from backups except to recover from a failure, and if we do, we delete it again. Contact details on orders, delivery addresses, customer profiles and marketing contacts are removed after the retention period configured for the service (two years by default), while orders stay as anonymised financial records that restaurants must keep for tax and accounting. Evidence of marketing consent is kept longer (six years by default) because it must outlast the contact details it covers. Account, restaurant, and menu data are kept while your account is active, then deleted on account deletion.

Cookies

The MenuBeacon app uses a single httpOnly session cookie (a JWT) to keep you signed in, plus a CSRF token cookie to protect authenticated requests. These are strictly necessary for the service to function. Public menu and ordering pages viewed by diners do not set tracking cookies; they may remember your dietary filters and basket on your device only.

This website uses Google Analytics cookies to understand how it is used only if you accept them in the cookie banner. Until you do, Google Analytics is not loaded. You can change your choice at any time with the “Cookie settings” link at the bottom of every page.

This website also uses a few strictly necessary items that are never used for tracking: the contact page sets a session cookie, deleted when you close your browser, that protects the form against forged submissions; if you choose the international site while in Pakistan, a region cookie (mb_region) remembers that choice for a year; and your browser’s local storage keeps your cookie choice and whether you have hidden the Pakistan edition suggestion. The website chat keeps its conversation in your browser’s session storage, which is cleared when you close the tab (a copy is also saved on our server; see Website chat above).

Your rights (GDPR / CCPA)

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office). California residents may request to know and delete their personal information and will not be discriminated against for doing so; we do not sell or share personal information for cross-context behavioural advertising. To exercise any of these rights, email support@menubeacon.com from the address associated with your account (for website chats, see Website chat above; if you left your name and email in the chat, email us from that address); we respond within one month. Diners should contact the restaurant they ordered from, which can export or erase their data with MenuBeacon's tools; you can also write to us with the restaurant name and approximate order date and we will pass your request on and help the restaurant answer it.

International transfers

Some of our processors are based outside the UK and the European Economic Area. Where personal data is transferred to them, we rely on adequacy decisions or standard contractual clauses (with the UK addendum where applicable).

Security

Passwords are hashed with bcrypt, sessions use httpOnly cookies, database access is credentialed and restricted, and uploads are validated before storage. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify affected accounts without undue delay.

Children

Restaurant accounts are only for people aged 18 or over. Diner accounts are only for people aged 16 or over, which we ask you to confirm when you create one. Ordering without an account is open to anyone, but age-restricted items require confirming the legal age and showing ID. We do not knowingly collect personal data from children under 13, and will delete it if we learn we have.

Changes to this policy

If we make material changes we will update the date at the top of this page and, for significant changes affecting account holders, notify you by email.

Contact

For privacy questions or data requests, contact support@menubeacon.com.