Privacy Notice

1. Who we are

MenuVision AI is operated by Gavin McKinney (“we”, “us”, “our”), trading as MenuVision AI. We act as the data controller for the personal data described in this notice. You can contact us about privacy matters at support@menuvisionai.live or via our Contact page.

2. Categories of personal data we collect

• Menu photos and scans you upload, and the AI-generated analysis derived from them.
• Restaurant menu content you create or edit (dish names, descriptions, prices, images).
• Technical data such as IP address, browser type, device information, and basic request logs, collected automatically when you use the service.
• Billing and contact data (name, email, billing address, transaction reference) when you purchase a paid plan. Card details are collected and processed directly by Paddle and are never stored by us.
• Support communications if you contact us for help.

3. Purposes and legal bases

• Providing the service (analyzing menu photos, hosting menus you publish, generating dish images) — performance of a contract with you.
• Processing payments and managing subscriptions — performance of a contract, and compliance with our legal and tax obligations.
• Security, fraud prevention, and abuse detection — legitimate interests in protecting our service and users.
• Improving the product (aggregated usage analytics) — legitimate interests.
• Customer support — legitimate interests and, where applicable, performance of a contract.

4. How we share your data

We share personal data only with the following categories of recipients:

• Paddle.com Market Ltd (“Paddle”) — our Merchant of Record. Paddle processes all payments, manages subscriptions, handles tax compliance, issues invoices, and provides customer service for orders and refunds. See Paddle's privacy notice.
• Hosting and infrastructure providers that run our servers, database, and storage.
• AI providers that analyze menu photos and generate dish images on our behalf. Photos are sent for analysis only and are not retained on our servers afterwards.
• Professional advisers (legal, accounting) where necessary.
• Authorities where we are required to do so by law.

We do not sell your personal data.

5. Data retention

• Menu photos you upload for scanning are sent to our AI provider and are not retained on our servers after analysis is complete.
• Anonymous scan results live in your browser's session storage only and disappear when you close the tab.
• Published menus and dish images you create are retained for as long as the menu remains active, and are deleted on request from the menu owner.
• Billing and transaction records are retained by us and by Paddle for as long as required by applicable tax and accounting law (typically 6 to 10 years).
• Server logs are retained for a short period for security and troubleshooting purposes, then deleted or anonymized.

6. Your rights

Subject to applicable law (including the GDPR and UK GDPR where relevant), you have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data deleted; restrict or object to processing; request portability of data you provided; and withdraw any consent you previously gave. You also have the right to lodge a complaint with your local data protection supervisory authority. To exercise any of these rights, email support@menuvisionai.live. We aim to respond within one month.

7. International transfers

Our service providers (including Paddle and our AI and hosting providers) may process personal data outside your country of residence, including in the United States. Where required, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and least-privilege server-side access to sensitive data. No system is perfectly secure, but we work to keep your data safe.

9. Cookies

We do not use cookies for advertising or cross-site tracking. We use only strictly necessary storage (such as your browser's session storage) to make the service work.

10. Changes to this notice

We may update this notice from time to time. Material changes will be reflected by updating the “Last updated” date above.