Restaurant as controller
A restaurant normally decides why and how guest reservation, loyalty, feedback, and menu-contact data is used when it enables those modules. Guests should contact that restaurant for restaurant-controlled data.
Privacy center · engineering notice
Privacy controls with receipts, not promises.
See how MenuFaro separates restaurant and platform responsibilities, limits local data, and records account-linked rights requests. This page does not claim automatic General Data Protection Regulation (GDPR) or worldwide legal certification.
Private by defaultNo cross-site profile. No raw full IP in analytics. No private dashboard cache.
Receipt ≠ completion Every consequential request keeps a review state.
Minimum data The request form does not ask for an email already supplied by trusted sign-in.
Responsibility map
The legal role follows the processing purpose.
One company can be controller for one purpose and processor for another. Contracts and the actual configuration determine the final role.
MenuFaro as processor
Where MenuFaro handles guest data only on a restaurant’s documented instructions, the restaurant needs a reviewed data-processing agreement and MenuFaro must follow the agreed scope.
MenuFaro operator as controller
The service operator may decide the purposes for account authentication, subscription administration, platform security, abuse prevention, support records, and its own legal obligations.
Account privacy center
Submit a request and keep its receipt.
MenuFaro records receipt before showing success and sets an initial response target one calendar month after receipt. Receipt starts review; it does not mean that access, correction, export, or erasure is complete.New request
Tell us what right you want to exercise
Your ledger
Request receipts and review status
Shows up to the 50 newest requests linked to this trusted signed-in identity. There is no cross-account search on this screen.
Checking the durable request ledger…
Data and retention
Keep only what a documented purpose needs.
Retention is a maximum, not a reason to keep data. A shorter legal, contractual, or user-selected period can apply.
Owner identity and memberships
Used for sign-in, permissions, tenant isolation, and security. Users can request access, correction, restriction, or account review.
Exact post-account retention: production schedule requiredMenu and brand content
Private drafts are restricted to authorized restaurant roles. Only an explicit immutable release becomes public.
Owner-controlled, subject to contract and legal holdsGuest engagement events
Allowlisted, privacy-safe metadata only. MenuFaro does not retain a raw full IP address for analytics or create cross-site profiles.
Free raw events: up to 30 days · Plus: up to 12 monthsBilling, audit, and security records
Access is restricted by role. Erasure is reviewed against accounting, fraud, security, dispute, and other applicable legal-retention duties.
Exact jurisdiction-specific term: production schedule requiredExports and signed links
Private exports and signed links must expire. A successful generation job does not make the result public.
Bounded lifetime; value must be configured and publishedBackups and deletion
Approved deletion must propagate through documented backup rotation. Deleted data must not be silently recreated from caches or analytics.
Rotation window: production schedule requiredProviders and international transfers
A vendor name is not a transfer assessment.
Before any production provider receives personal data, MenuFaro must record its purpose, data categories, role, region, retention, deletion path, subprocessors, security evidence, incident duties, and assistance with rights requests.
When data leaves the European Economic Area, the operator must document an applicable mechanism, such as an adequacy decision or approved safeguards including the European Commission’s Standard Contractual Clauses, plus any required transfer assessment.
Public subprocessor register
State: not verified for production. No complete provider contract register has been supplied, so this page does not invent vendor, region, or transfer claims.
- Vendor and service purpose
- Data categories and processing region
- Subprocessors and advance-change notice
- Retention, deletion, security, and transfer mechanism
No account or no access
A rights request must not depend on signing in.
Use the public contact route if you cannot access the account, you are a restaurant guest, or your trusted sign-in is not linked to a MenuFaro record. Do not email passwords, card data, or identity documents.
Official guidance used for this engineering notice
- European Commission: dealing with requests from individuals
- European Commission: controller and processor roles
- European Commission: Standard Contractual Clauses
- European Data Protection Board: privacy by design and by default
- EUR-Lex: ePrivacy Directive
These sources are general information. Product configuration, contracts, Member State law, and the facts of each request still require professional review.