Who we are
QuickMenuQR ("QuickMenuQR", "we", "us") provides cloud software for restaurants: QR code menus and ordering, point of sale, kitchen display, table reservations, inventory, customer and loyalty records, analytics and AI-assisted menu tools (the "Service").
This policy explains what personal data we handle when you visit our website, run a restaurant on QuickMenuQR, or order from or book with a restaurant that uses QuickMenuQR.
Restaurants and their guests
We handle two kinds of data, and our role is different for each:
- Restaurant account data. When a restaurant (a "merchant") signs up, we decide how that account data is used. For this data, we are the data controller.
- Guest data. When a diner orders from a QR menu, makes a reservation or joins a loyalty program, that data belongs to the restaurant. The restaurant is the controller and we process the data on its behalf, only to run the Service for it. If you are a guest, contact the restaurant first about your data; we will help the restaurant answer your request.
Data we collect
Restaurant owners and staff
- Account details: restaurant name, owner name, email address, phone number and business settings such as currency and time zone.
- Staff accounts: names, email addresses, roles and login PINs or passwords. Passwords are stored only as one-way hashes.
- Business content you enter: menus, prices, photos, tables, inventory, promotions and settings.
- Subscription and billing records: plan, status, amounts and payment references. Card and bank details are entered on our payment providers' pages; we never receive or store full card numbers.
- Activity and security logs: sign-ins, important account changes, IP address and browser type, used to keep accounts secure.
Restaurant guests
- Orders: items, table number, notes, totals and order status.
- Contact details the guest chooses to give: name and phone number (and email if the restaurant asks for it), used for the order, receipts, reservations and loyalty points.
- Reservations: date, time, party size and special requests.
- Loyalty and customer history kept by the restaurant: visits, spend and points balance.
Website visitors
- Technical data such as IP address, browser, device type and pages requested, recorded in standard server logs.
- Anything you send us, such as support emails.
We do not use advertising trackers and we do not sell personal data.
How we use data
- To provide the Service: show menus, pass orders to the kitchen, take payments, manage reservations and keep restaurant records.
- To create and secure accounts, prevent fraud and abuse, and enforce our Terms of Service and Acceptable Use Policy.
- To bill subscriptions and keep financial records required by law.
- To send service messages, such as payment receipts, security notices and important changes. We do not send marketing email to restaurant guests on our own behalf.
- To provide support and fix problems.
Our legal bases are performing our contract with the restaurant, our legitimate interest in running a secure and reliable service, compliance with legal obligations, and consent where the law requires it.
AI features
Some optional features use artificial intelligence: writing menu descriptions, translating menu items, reading a photo of a printed menu, generating dish images, and giving sales insights and forecasts.
- These features run only when a restaurant user starts them.
- To produce a result, we send the needed content to our AI provider, OpenAI. For menu tools that is the dish name, category, description or menu photo. For insights it is summarised sales and order data.
- We do not deliberately send guests' names, phone numbers or email addresses to the AI provider.
- Under OpenAI's API terms, data sent through the API is not used to train their models by default.
- AI output can be wrong. Restaurants must review it before publishing, especially allergen and dietary information.
Use of AI features is governed by our Acceptable Use Policy.
How long we keep data
- Restaurant account data is kept while the account is active. If an account is closed, or stays locked because its free trial or paid plan ended without payment, it may be deleted or anonymised after 90 days, unless the law requires us to keep it longer.
- We may keep aggregated statistics that cannot identify a restaurant, person or guest, and use them to run and improve the Service.
- Billing and tax records are kept for as long as accounting laws require.
- Guest data is kept for as long as the restaurant keeps its account, or until the restaurant deletes it.
- Security logs are kept for a limited period and then deleted.
Security
We protect data with:
- Encrypted connections (HTTPS).
- Hashed passwords.
- Role-based access for staff.
- Strict separation between restaurants' data.
- Signed payment notifications.
- Audit logging of sensitive actions.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.
Your rights
Depending on where you live, you may have the right to:
- access your personal data
- correct or delete it
- object to or restrict how it is used
- receive a copy in a portable format
- withdraw consent
- complain to your local data protection authority.
Restaurant users can update most account data in Settings, or email us. Guests should contact the restaurant, which controls their data; you may also email us and we will pass the request on.
Children
The Service is for businesses and is not directed at children under 16. We do not knowingly collect children's data for our own purposes. A restaurant may take an order from a guest of any age, as its own customer.
Changes to this policy
We may update this policy as the Service changes. We will post the new version here with a new "Last updated" date. For significant changes, we will also notify restaurant account owners by email or in the app.
Contact us
For privacy questions or requests, email support@quickmenuqr.com.
Questions about this policy? Email us at support@quickmenuqr.com and we'll get back to you.