Privacy Policy

1. Introduction & Scope

Menuvyn ("we", "our", or "us") operates the Menuvyn platform at menuvyn.com and its affiliated subdomains. We take your personal privacy seriously. This Privacy Policy describes how we collect, store, handle, and protect your information whether you are a restaurant owner, manager, chef ("Merchant User"), or a visiting restaurant diner viewing an interactive menu or placing an order ("Diner").

By accessing or using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Roles: Data Controller vs. Data Processor

It is important to understand our dual role in data processing:

• Menuvyn as Data Controller: When you register as a restaurant merchant, manage your account, subscribe to premium tiers, or communicate with our support, Menuvyn acts as the Data Controller of your account credentials, billing details, and platform telemetry.
• Menuvyn as Data Processor: When a diner browses a restaurant's digital menu, joins a group ordering tab, submits an order ticket, or opts in to receive promotional discounts via the restaurant's VIP lead capture form, the restaurant operator is the Data Controller, and Menuvyn acts strictly as a Data Processor storing and transmitting this data on the restaurant's behalf.

3. Information We Collect

We collect the following categories of information:

• Restaurant Merchant Account Data: Name, email address, password hash, business name, restaurant contact numbers, physical addresses, social media links, Wi-Fi credentials (voluntarily shared for diner convenience), tax identifiers, and logo/cover images.
• Diner & Guest Data: When ordering or opting into restaurant specials, we may collect customer names, phone numbers, email addresses, table numbers, dietary notes, and order histories. Diners browsing menus without ordering remain completely anonymous.
• Billing & Payment Data: For online subscriptions and SMS top-ups, payment transaction tokens and masked details are processed securely by authorized payment gateway partners. We do not store raw credit or debit card numbers on our servers. For manual bank deposits, we store submitted deposit slips, depositor names, and bank reference codes.
• Device & Telemetry Data: IP addresses, browser user-agents, device form factors, referral URLs, and menu interaction metrics to ensure optimal responsive layout delivery and protect against automated abuse.

4. How We Use Collected Information

We process your data for legitimate business purposes:

• To provision and host digital interactive restaurant menus.
• To relay real-time live order tickets to restaurant kitchen display systems (KDS).
• To facilitate authorized staff alerts via Telegram, WhatsApp, and email webhooks.
• To process subscription billing and verify manual bank transfer slips.
• To enable restaurants to dispatch promotional SMS messages and newsletters to diners who provided explicit affirmative opt-in consent.
• To monitor system health, detect fraudulent orders, and enforce platform security.

5. Third-Party Service Providers & Infrastructure

We partner with industry-leading infrastructure providers who maintain rigorous security certifications:

• Cloud Database & Identity Infrastructure: Encrypted cloud database and authentication infrastructure with automated backups and Row-Level Security (RLS) data isolation.
• Distributed Object Storage & CDN: High-performance object storage for fast, reliable delivery of restaurant menu photography, banner graphics, and brand assets.
• Regulated Payment Gateways: Licensed payment institutions and banking acquirers for LankaQR, debit, and credit card processing in compliance with Central Bank regulations.
• Application Hosting & Edge Network: Edge network hosting, automated SSL/TLS encryption, and DDoS protection.

We never sell, rent, or trade your personal data to data brokers or third-party marketing agencies.

6. Data Security & Encryption Standards

We implement robust technical and organizational security controls:

• All web traffic is encrypted in transit using TLS 1.3 encryption.
• Data at rest is secured with AES-256 bit encryption within our database clusters.
• Strict PostgreSQL Row Level Security (RLS) policies guarantee that restaurant data is isolated and accessible only by verified account owners and authorized staff.
• Group order secret tokens and host access keys are revoked from client inspection and verified only via secure server-side remote procedure calls (RPC).

7. Data Retention & Deletion

We retain restaurant account and menu data for as long as your account remains active. If you delete your restaurant account via the Admin or Dashboard portal, all associated menu items, categories, modifier groups, and customer leads are permanently removed from our active database.

Diners who wish to remove their contact details from a specific restaurant's VIP lead list may request immediate deletion by contacting the restaurant or emailing us atmniamatmarjan@gmail.com.

8. Your Privacy Rights

Depending on your jurisdiction, you possess statutory privacy rights including:

• The right to access and receive a portable copy of your personal data.
• The right to rectify inaccurate or incomplete records.
• The right to request erasure ("Right to be Forgotten").
• The right to withdraw marketing consent at any time.
• The right to lodge a complaint with a relevant supervisory data authority.

9. Contact Us

For inquiries or requests regarding your personal data or this Privacy Policy, please reach out to: