Privacy policy

1. Controller

The data controller is Mattia Mellone, Via Martin Luther King, 19 — 70124 Bari (BA), Italia. Privacy requests: privacy@menudetto.it.

2. Data we process

Account: email, optional name, password (stored only as a hash).

Restaurant content: venue name, city, menus (sections, dishes, prices, descriptions, allergens), uploaded photos, published versions and QR codes.

Assistant conversations: text messages and, if you use the microphone, the audio sent for transcription — used to perform the changes you ask for.

Technical data: server-side security and diagnostic logs (no profiling).

Diners viewing a public menu do NOT register and we collect no personal data about them; no tracking cookies, no client-side analytics.

3. Purposes and legal bases

Providing the service (art. 6.1.b GDPR): account management, menu creation/publication, transactional email (e.g. password reset).

Security and abuse prevention (art. 6.1.f): technical logs, rate limits.

Legal obligations (art. 6.1.c), where applicable.

4. Processors

Data is hosted on Microsoft Azure (West Europe). AI features (command interpretation, allergen proposals, translations, speech transcription) use Azure OpenAI Service: your content is NOT used to train models. Transactional email is sent via Azure Communication Services.

5. Retention

Data is kept while the account is active. Deleting the account in-app (Settings → Delete account) immediately and permanently removes everything you own — menus, versions, QR codes. Technical logs are kept for at most 90 days.

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (arts. 15–22 GDPR). In-app you can export your data (Settings → Export data) and delete the account yourself. For anything else write to privacy@menudetto.it. You may also lodge a complaint with your supervisory authority.