Privacy Policy

Owner account data: your email address, and the phone number you use when you contact us on WhatsApp.

If you request a private menu preview, we collect the email address you enter before creating an account so we can send its private link and help you return to that draft. We keep the business name with the draft or venue, not as your personal name.

If you speak with us on Instagram, Messenger, or WhatsApp about MenuAsk, we may keep your name, contact channel, conversation link, any email you give us, private sales notes, and the next follow-up action in our restricted contact list. We do not automatically import social inboxes.

Venue and menu content you provide or approve: business identity, menu text, prices, photos, and files you upload.

Google Place IDs and transient lookup results when you or we look up a venue. We keep only content Google permits us to retain; durable venue facts and media otherwise come from you or another permitted source, with required attribution.

If you upgrade to a paid plan, the billing provider shown at checkout records the subscription, billing contact, payment status, and transaction details needed to process and support the purchase. MenuAsk does not receive or store your full card details.

Usage and technical data: marketing and signed-in product/page analytics (PostHog, EU region), sanitized error and performance telemetry (Sentry when configured and Vercel Speed Insights), and standard server logs. Public menu hosts do not load implicit PostHog capture; Basic Insights stores only daily counts for visits, menu views, QR opens, broad source categories, and call, directions, or WhatsApp clicks. Guests browsing a menu do not create accounts.

Google Analytics receives cookie identifiers, safe page addresses, approved public source domains, campaign labels and confirmed menu-build, claim and first-publication events. Requests also expose standard connection information to Google. PostHog receives masked recordings of eligible visits.

If a venue enables AI menu help, MenuAsk temporarily stores the guest questions and assistant answers needed to continue that conversation, plus a signed essential session cookie that reconnects the same browser. The cookie is not an advertising identifier.

To create, host, and serve your menu site; to prepare a private preview before you save it to an account; to sign you in with one-time email codes; to answer you on WhatsApp or email; and to improve the product using aggregate analytics.

We send the requested preview result and other service emails through Resend. If you separately choose email tips and reminders, we use your email and basic progress to send relevant follow-ups through Customer.io. You can withdraw that choice in your account or through an unsubscribe link. Requesting a preview, registering, or a social conversation alone does not subscribe you.

Menu files and text you provide are processed by AI services to extract structured menu content. We do not use them to train our own models; third-party providers process them under their applicable terms and configuration.

When you use the MenuAsk AI assistant on the website, Telegram or WhatsApp, your chat text, including pasted menu text, may be processed to answer questions before you agree to import a menu. Downloading menu files, extracting their content and preparing a draft require the separate menu-processing permission and source review. Saving to an account and publishing still require their own confirmations.

For AI menu help, a guest question is processed only to answer about that venue’s current published menu and information. The provider route is required to use verified zero-data-retention and no-training settings.

We process data to perform our service for you, with your consent where required, and under our legitimate interest in operating and improving MenuAsk, in line with the Israeli Privacy Protection Law, 5741-1981, and, where applicable, the GDPR.

We use service providers to run MenuAsk: Vercel (hosting, performance, and AI Gateway), Supabase (database and authentication), Customer.io in the US (opted-in email follow-ups), Resend (service emails), PostHog EU (analytics and masked recordings), Google Analytics and Google Ads (visit and campaign measurement), Sentry when configured (error monitoring), Google Maps Platform (transient venue lookup and permitted attributed content), evaluated AI providers for menu extraction and AI menu help, and Polar as Merchant of Record for paid subscriptions. Each receives only what it needs to provide its function. Daily growth reports send PostHog opaque contact, venue, workspace, checkout and payment IDs; acquisition source, entry path, sales and venue states, milestone dates, aggregate menu-view counts and confirmed payment category or plan. They do not include email, phone, business names, menu content or conversation text.

We do not sell personal data.

When enabled, opening the menu-upload form after selecting a business on our homepage may send a conversion event to OpenAI through our server. We send the event name, event time, an opaque event ID, the public homepage address without other query values, and the OpenAI ad-click reference from that visit. The reference is used to match the action to an ad click.

This integration does not load the OpenAI browser Pixel, scan forms, create advertising cookies, or send your email, phone, business name, menu content, files, draft ID, IP address or browser details. We opt these events out of future user-level ad personalization. It only measures visits with an ad-click reference still present on the homepage; returning visits without that reference may not be counted.

The event is skipped for internal visits and supported analytics opt-outs, Global Privacy Control and Do Not Track. Ordinary session cookies still authorize your draft on our server. Accepting advertiser terms does not replace any visitor consent that is required.

When you connect an owner account, MenuAsk stores the connection, account and approved restaurant permissions needed to read menus and prepare changes. Each request checks current access. You can revoke a connection in MenuAsk. Menu data you request is shared with the host you connected, under that host’s terms and privacy policy.

The connector stores the menu text and structured menu data sent by the host, the exact choices you approve and the resulting save receipts. MenuAsk does not store a copy of the surrounding host chat. A private ChatGPT preview link proves possession of the link, not a host user’s identity. Email verification and a separate account and restaurant confirmation are required to save an owned Draft. Publication requires another owner confirmation.

Unsaved connector intakes expire after 24 hours and are removed by scheduled cleanup. Successful creation and claim intake receipts are kept for 30 days for retry and support. The saved restaurant and menus follow normal account retention. Content-free host, entry-journey and operation identifiers stay with an owned menu while it exists so we can measure saving, publication and later updates.

Private connector review pages exclude product recordings and page analytics. Essential short-lived cookies keep preview and claim sessions working. Operational and activation events contain fixed stages, host names and opaque IDs, without chat transcripts, menu text, preview secrets or private links.

MenuAsk uses Google Maps Platform content under the Google Maps Platform Terms of Service and Google Privacy Policy, which are incorporated into this policy by reference.

Essential cookies keep you signed in and secure sessions working. AI menu help uses a short-lived, signed, host-only session cookie so the same browser can continue or clear its temporary conversation. On marketing and signed-in routes, product analytics may use first-party browser storage or identifiers to measure use and diagnose problems. We use masked session recordings to understand visits to our marketing pages, owner setup before sign-in, and later owner editing. Recordings are kept for 30 days. Inputs, menu and account content, sensitive media and addresses are masked or blocked; only approved static interface labels are visible. Guest menus, admin and payment screens are excluded. Console, network payload and canvas recording are disabled. The Basic Insights recorder keeps aggregate daily visits, views and action counts rather than guest profiles or raw IP/device identifiers. First-party browser storage holds only the last menu activity time, without a guest identifier. Activity after 30 idle minutes starts a new visit; the stored timestamp itself remains until replaced or browser data is cleared. If storage is blocked, continuity is limited to the current page. An optional browser-exclusion cookie lasts one year; each browser needs its own choice, and private restaurant domains receive it when opened from the workspace. Google Analytics uses cookies to measure visits, menu creation and publication, including results from Google Ads. This measurement and masked recordings are enabled when an eligible page opens. We do not use personalized advertising or remarketing. We keep campaign labels attached to a requested draft for up to 30 days. Google reads permitted click identifiers from the first measured page address; we no longer add them to our draft records. Earlier stored copies expire within their original 30-day window. Private page addresses, form content, menu content and account details are not sent to Google Analytics.

Account and venue data is kept while your account is active. A private preview link expires after seven days. An automatically created contact that remains unverified and unclaimed is deleted after 30 days unless we manually qualify it. Each daily growth export rebuilds the latest 30 days of contact acquisition and 60 days of checkout and confirmed-payment history, plus venue summaries. Deleted contacts are excluded from later exports. An independently owned venue may remain in aggregate venue reports without the deleted contact’s attribution. Earlier analytics events follow PostHog’s retention and deletion process. AI menu-help conversations expire after 24 hours, and their message content is scheduled for deletion no later than 48 hours after creation; choosing Clear schedules the content for deletion immediately. Minimized operational and cost receipts may remain for 90 days, or 180 days for unresolved or above-limit cost incidents, without the message text or direct conversation, session, menu, or snapshot link. Other logs and analytics are retained for limited windows set by our providers.

You can prevent Google Analytics collection with the Google Analytics opt-out browser add-on where supported. It does not disable PostHog recordings. Browser content-blocking tools can block analytics requests; private browsing or blocking third-party cookies alone does not stop all collection. We honor supported provider opt-outs and do not turn them back on during navigation.

You may ask to access, correct, export, or delete your personal data at any time: hello@menuask.com. If your venue appears in a private preview you did not request, contact us and we will remove it.

Data is protected in transit and at rest by our providers; access to production data is restricted. No method is 100% secure, but we design for least access.

MenuAsk is a business tool and is not directed at children.

We will update this policy as the product evolves and note the date above. Material changes will be communicated on this page.