Privacy notice

Who we are

MenuBuddy is run by Scott Ninness, a sole trader based in the United Kingdom, who is the data controller for the personal data described in this notice. For anything privacy-related, email privacy@menubuddy.ai.

What we collect, and why

To build your menu we collect the photos of your current menu that you upload, the answers you give about your venue (cuisine, vibe, price range, dietary coverage), your email address, and any logo or branding you provide. We process this data to deliver the service you're asking us for — redesigning your menu and providing the print-ready file — which is our lawful basis under UK GDPR Article 6(1)(b), performance of a contract. Providing the photos is a requirement of that contract: if you don't upload them, we can't build your menu.

We also keep limited technical records (such as IP-based rate-limiting data and error logs) to keep the service secure and prevent abuse. Our lawful basis for that is legitimate interests, Article 6(1)(f).

We don't run advertising trackers, and we only use the storage your browser needs to keep you signed in. We won't send you marketing email unless you've asked for it.

Who processes your data for us

A small number of service providers process data on our behalf, each under a data-processing agreement: Anthropic PBC (US) reads your menu photos to extract the dishes, sections, and prices into a structured draft — its API terms exclude your content from being used to train its models; Cloudflare, Inc. (US) stores your uploaded photos encrypted at rest, accessible only via short-lived links; Fly.io, Inc. (US company, London data region) hosts the application; Stripe processes payments — we never see or store your card details; and Resend delivers our transactional emails (receipts and sign-in links).

Where a provider is US-headquartered, transfers are covered by the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK addendum.

How long we keep things

Your photos and menu data are kept while you're an active customer so you can re-download, reference, and update your menus. If your account is dormant for 12 months, your photos are deleted automatically — we aim to remind you by email before that happens. You can also delete the photos for any order, or everything at once, from your dashboard at any time.

Delivered menus and payment records are kept for 6 years, as UK tax law requires of sole traders. Your uploaded photos are not part of that — only the finished outputs and transaction records.

Your rights

Under UK GDPR you have the right to access your data, correct it, delete it, restrict or object to our processing of it, and receive a copy in a portable format. You also have the right not to be subject to a solely automated decision with legal or similarly significant effects — nothing MenuBuddy does works that way; your menu is a draft you review and approve. To exercise any of these rights, use your dashboard controls or email privacy@menubuddy.ai.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Photos of other people

Please ensure photos contain only your menu. Staff members, customers, and other identifiable third parties should not be visible without their explicit consent. By uploading, you confirm you have the right to provide these photos.