Privacy policy

MenuYou is a multi-tenant platform, so several different groups hold data in it:

This distinction is the backbone of the whole document:

• MenuYou is the data controller for: the business owner’s account and technical information about site visitors. We decide why and how that data is processed.
• MenuYou is only a processor for: the end customers, staff and couriers of each business. The controller of that data is the business itself. We hold and process it on their instruction and on their behalf.

What does that mean? The legal responsibility for collecting customer and staff data correctly and with consent rests with the business, not with MenuYou. The full responsibility boundary is set out in section 11 of the terms of service.

3.1 Account and business — first and last name, mobile number, email, password (hashed, never stored in the clear), business name, address and phone, logo, social handles, opening hours, and the entire menu (categories, items, prices, photos, video).

3.2 End customers (controller: the business) — mobile number (identity key, verified by SMS), name, email, date of birth (for occasion campaigns), owner’s notes, SMS consent date, full order history, loyalty points and tier, coupons and prizes, review text and ratings, survey answers, spin-wheel and Hafez records, credit-ledger balances, and the display name and share of each person in a table group order.

What is publicly visible: a review a customer submits is published on the menu page after the business approves it and is then visible to everyone. In a table group order, each person’s display name and share is visible to the others at that table. Everything else in this section is visible only to that business.

3.3 Orders, delivery and couriers — from the recipient: name, phone, full delivery address, geographic coordinates, the coordinates and code captured at the moment of delivery, and the proof-of-delivery photo. From the courier: name, mobile, national ID, vehicle type and plate number, customer ratings, and location while their shift is switched on.

Exactly what is kept of a courier’s location: the moment-to-moment route is not stored. Only the last reported position is held on the courier’s own record and is overwritten on every update, plus the coordinates at each assignment status change (picked up, delivered). Location is sent only while the courier has switched their shift on in the panel; switching the shift off stops it. Delivery addresses and coordinates are visible only to that business and to the courier the assignment was given to. The courier’s last position is visible to that business, and to the order’s recipient on the tracking page only between pick-up and delivery of that order.

3.4 Staff — the HR plugin — clock-in and clock-out times, lateness and overtime, shift schedules, salary, benefits, deductions and payslips; all entered in the panel by the business manager.

✅ No biometric data is processed or stored. The attendance kiosk works with a hashed numeric PIN — not fingerprints, not faces.

3.5 Financial and payment — amount, order reference, transaction status and time, and subscription billing records. From payment-gateway activation: the transaction tracking code is also recorded. A customer’s payment to a business runs through that business’s own gateway and MenuYou does not receive the money; the gateway connection details the business enters in the panel (such as its merchant ID) are stored encrypted.

Every online payment — whether buying a subscription or plugin from MenuYou, or a customer paying a business — takes place on the payment gateway’s secure page. The full card number, PIN and CVV2 never reach MenuYou’s servers and are never stored there.

3.6 Contacting us — from a support ticket: the conversation text and any attachments. From the live site chat: we do not ask for or store your name, email or phone number; only the conversation text, any attachments and the technical data needed to continue that conversation (IP address, browser details, page address and referring page). From the contact form: name, contact method, message text and IP address, to prevent spam.

3.7 Technical and statistical data:

• Signed-in sessions: IP address and browser details, for account security.
• IP address in anti-abuse limits (login, verification code, spin wheel, Hafez) — hashed only in the wheel and Hafez.
• Short-link clicks in SMS campaigns, to count unique clicks — with a hashed IP, with no raw IP retained.
• Menu view and QR scan statistics: aggregate, identity-free counters (date, hour, count). No individual behavioural profile of a menu visitor is built.
• Panel change history (which user changed what and when), for auditing and dispute resolution.

3.8 What we do not collect — biometric data · the full card number, PIN or CVV2 in online payments · an end customer’s location beyond the address they enter themselves · a courier’s location while their shift is off · any advertising tracking data.

MenuYou runs no advertising tracker — no pixels, no ad network, no session recording. All fonts are hosted on our own servers; no request is made to external font servers.

Visit statistics: only on the public MenuYou site (menuyou.app) and the business owner sign-up and login pages do we use a third-party visit-statistics service (outside Iran) to count visits and the path from visit to sign-up. That service receives the page address, the referring page, device and browser type and a random cookie identifier, and — like any internet request — sees your browser’s IP address. The panel, business menus and the personal customer account carry no third-party analytics at all.

Apart from the site visit-statistics cookies, the cookies below all exist to make the service work.

The menu_device cookie is HttpOnly and, like every cookie of our own, is encrypted and signed; it can neither be read by script nor forged. None of these cookies is used for advertising or for selling data.

What stays only in your browser: these live in your device’s localStorage and are never sent to the server — the shopping cart (until you place the order; a table group order’s shared cart lives on the server so everyone at the table sees it), the favourites list (per branch), light/dark mode, panel display preferences, the identifiers of surveys you have answered, and the live chat conversation id.

If you are signed in with a personal customer account and are a member of that business, your favourites are stored on your membership as well as in the browser, so you also see them in your personal account. Until you sign in, the list itself never leaves your browser; each like or unlike is only counted, with no identifier of you, in that item’s daily counter for the business dashboard.

We use data to deliver the service, show menus correctly to customers, process orders, compute statistics, provide support and improve the product. We never sell your data or your customers’ data, and we never hand it to anyone for independent third-party marketing.

5.1 Service SMS — verification codes (login and sign-up), order status updates, staff and courier invitations, and security alerts. These messages are a necessary part of the service and cannot be opted out of.

5.2 Marketing SMS and the loyalty club — marketing and occasion messages are sent only to customers whose consent has been recorded. This rule is locked into the system itself: a marketing message never goes out to a customer without recorded consent, even if the business wants it to. Every customer can withdraw consent at any moment through the unsubscribe link inside every message, and it takes effect immediately. The full text of sent messages, along with the recipient number and delivery status, is retained for dispute resolution (see section 8 for how long).

5.3 Personal customer account — a customer can sign in at account.menuyou.app with a verification code and see their own orders, coupons, prizes, reservations and favourites across every business they belong to, in one place.

That view is for the customer only. No business sees another business’s data; each business’s customer base stays separate and isolated. The only thing shared across businesses is the confirmation that “this number belongs to this person” — not the name, not the history, not the points.

5.4 Analytics and intelligent features — to keep improving MenuYou and to offer intelligent features (such as automatic product suggestions, purchase behaviour analysis, a review-reply assistant and sales trend forecasting), we may use data recorded on the platform — interactions, sales statistics, reviews and answers — to train, evaluate and develop machine learning and AI models.

Our commitment: all data used to train algorithms is fully anonymised before processing, so that no attributable identifying information — name, phone number, address or venue identifier — remains in it.

The only active AI transfer today: if you switch on the automatic menu translation plugin, the names and descriptions of your menu items are sent for translation to an AI service outside Iran. This happens only when you activate it, covers only public menu text, and contains no personal data, financial data or customer information. Manual translation sends nothing at all.

5.5 Our own aggregate reporting — for product planning and infrastructure capacity we use aggregate counters (number of active businesses, order volume, resource usage). These reports contain no individual data and nothing attributable to a single venue.

For part of the service we have to entrust the necessary data to a specialist supplier. In every case only the minimum required data is sent, never more:

• Map rendering happens in your browser, which means the map service receives your browser’s IP address. Search and coordinate-to-address conversion, however, go through our server and do not carry your IP.
• The e-commerce trust seal in the public site footer is loaded from its official issuing system, which therefore receives your browser’s IP address and the site address.
• Legal disclosure: where legally compelled and on the documented request of the competent authorities of the Islamic Republic of Iran, we are obliged to provide information. Otherwise your data is not given to any third party.
• If a supplier is added or replaced that would see a new category of data, it is announced in this document before it goes live.

• All traffic over HTTPS with a valid certificate.
• Passwords hashed with bcrypt; the raw password is never stored.
• Per-business data isolation at the application layer: every query is forcibly scoped to that business’s id, and cross-tenant access is not possible.
• Three layers of access control on every panel request: plan → plugin → role and user permission. Every lock you see in the interface has a mandatory server-side equivalent.
• Sensitive files on a private disk: expense invoice attachments, ticket and chat attachments, and proof-of-delivery photos — none of them readable from the internet by guessing a URL.
• Rate limiting on login, verification codes, staff and courier sign-in, the wheel and Hafez.
• Attendance uses a hashed numeric PIN, not biometrics.
• Session cookies carry Secure and SameSite flags in production.
• MenuYou support staff access to business data is limited, role-based and recorded in the audit trail.

No system is one hundred percent impenetrable; what we commit to is keeping these layers continuously up to date.

Account deletion: on a written deletion request through support, your identity and access data and your customers’ data are deleted or anonymised within a maximum of 14 working days.

What remains after deletion: mandatory financial records — invoices and payments — which we are legally and accountably required to keep; and aggregate anonymous data that cannot be attributed to any person or venue.

9.1 If you are a business owner:

• You can see and edit your account and business details in the panel at any time.
• You can take an Excel or CSV export from the main areas of the panel — customers, invoices, expenses, inventory and reports — within your active plan and plugins.
• You can request full deletion of your account (section 8).

9.2 If you are a customer of a business:

• Sign in at account.menuyou.app with a verification code to see and edit your details.
• Withdraw marketing SMS consent from there, or from the unsubscribe link inside any message, at any moment.
• To correct or delete your records held by a business, go to that business first — it is the controller of that data. If you get no answer, write to us; we follow up within 14 working days.
• To delete your personal account itself at account.menuyou.app, write to us directly.

9.3 If you are staff or a courier — you can see your data in your own panel. For correcting or deleting operational data (attendance, payroll, assignments) go to the employing business.

Creating a business account on MenuYou requires you to be 18 or older. Membership of a business’s loyalty club by customers under 18 requires the consent of a legal guardian, and responsibility for that rests with that business. If we find that data of a person under the legal age has been recorded without permission, we delete it.

All MenuYou data is held on servers located inside Iran. Data leaves Iran in only two cases: menu text sent to the AI translation service (section 5.4), which happens only if you activate it, and visit statistics from the public site and the sign-up and login pages (section 4). If the storage location ever changes, it will be announced in this document before the transfer.

If an incident or breach occurs that puts user information at risk, we commit to informing affected users within a maximum of 72 hours of detection, by SMS and panel notification — and by email where possible — together with an account of what happened and what they should do.

If a breach involves the data of a business’s customers, we notify that business as the data controller so that it can meet its own obligations.

In the event of a merger, acquisition or sale of part or all of MenuYou’s assets, user information may transfer to the new owner as part of those assets. In that case we inform you before the transfer, and the new owner will be bound by this same policy. If you do not agree to the transfer, you can request deletion of your account before it happens (section 8).

• Third-party links: business menus, the blog and our site may link to other websites or social networks. Their privacy policies are their own and we bear no responsibility for them.
• Thermal print bridge: if you use receipt printing, the receipt content goes from your browser to the print bridge application on your own computer and from there to the printer. That data does not leave your device and does not reach any third-party server; securing that computer is your responsibility.

Any change is announced on this page and the version number and date at the top are updated; previous versions stay archived and available. For a material change — a new category of data, a new supplier, or a change of storage location — we give at least 30 days’ notice through panel notifications and SMS. Continuing to use the service after the announcement constitutes acceptance of the new text.

Where an English or any other translation of this document exists, the Persian text governs interpretation.

Provider: Noavar Farayand Zharf (PJSC) · Website: menuyou.app

For any privacy question, request or complaint: support@menuyou.app — or write to us through the contact form.

Related documents: terms of service