— PRIVACY POLICY —

Your data, explained plainly.

Last updated: May 4, 2026. This policy applies to menuregistry.com and any related services operated by MenuRegistry.

Who we are

MenuRegistry is a software-as-a-service product operated at menuregistry.com. We provide automated allergen audit reports for restaurant operators.

Questions about this policy or your data? Email hello@menuregistry.com.

What we collect

Account data

Your email address, and optionally your name. We collect email when you sign in via magic-link. We do not collect passwords — authentication is email-only.

Payment data

Payment processing is handled entirely by Stripe. We do not store, transmit, or ever see your credit card number, CVV, or full card details. What we receive from Stripe is a Stripe customer ID, a subscription status, and billing metadata (plan tier, billing period, renewal date).

Audit data

When you run an audit, we receive: (a) the menu file or text you upload (PDF, image, or pasted text), (b) the audit results our AI generates, and (c) audit metadata — timestamps, content hashes (SHA-256), and the plan tier under which the audit was run. Audit data is associated with your account.

Usage data

Standard server logs: IP address, browser user-agent, request paths, and HTTP response codes. We retain server logs for approximately 90 days for fraud detection and reliability monitoring. We do not build individual behavioral profiles from this data.

How we use your data

We use your data to operate the service: to authenticate you, run allergen audits on the menu content you provide, generate audit reports, manage your subscription, and send you transactional emails (magic-link sign-in, billing receipts, policy change notices).

We do not:

  • ×Sell your data to any third party.
  • ×Share your menu content or audit results with advertisers.
  • ×Use your uploaded menus to train or fine-tune any AI or machine-learning model.
  • ×Send unsolicited marketing email (you can opt out of product announcements at any time).

Sub-processors

We use the following third-party services to operate MenuRegistry. Each is named explicitly — no hidden intermediaries.

VercelHosting and edge network

US-East 1 region. Your requests are served from Vercel's edge. Vercel's privacy policy applies to infrastructure-level processing. Vercel Privacy Policy

Vercel Postgres / NeonDatabase

US-East 1. Account data, audit metadata, and subscription records are stored here.

Vercel BlobFile storage

US-East 1. Menu files you upload (PDFs, images) and generated audit PDFs are stored here, subject to the retention schedule below.

AnthropicLLM inference for allergen audits

We send your menu content to Anthropic's API to generate allergen audit results. Anthropic's commercial API terms prohibit training on customer API data. Anthropic Commercial Terms

StripePayment processing

All billing flows — subscription creation, upgrades, cancellations, and receipt emails — are handled by Stripe. We never touch your card data. Stripe Privacy Policy

ResendTransactional email

Magic-link sign-in emails and billing notifications are sent via Resend. We do not use Resend for marketing email.

Data retention

Uploaded menu files

Deleted from Vercel Blob 90 days after upload, unless you have saved them to your account's audit history (Pro tier). Deleting your account removes all retained files.

Audit results

Retained in your audit log for the duration of your account (Pro tier). Free-tier audits are retained for 30 days. Deleting your account removes all audit records.

Account data

Retained until you delete your account. You can request deletion at any time by emailing hello@menuregistry.com.

Server logs

Approximately 90 days, after which they are purged automatically.

Payment records

Stripe retains billing history per their legal obligations. We retain a record of your plan tier and subscription status for as long as your account exists.

Your rights (GDPR + CCPA)

Whether you are in the EU, California, or anywhere else, we honor the following rights on request:

  • →Access: Request a copy of all personal data we hold about you.
  • →Correction: Ask us to correct inaccurate data (e.g., your name or email).
  • →Deletion: Request that we delete your account and all associated data. We will complete verified deletion requests within 30 days.
  • →Portability: Request a machine-readable export of your account data and audit history.
  • →Opt-out of sale: We do not sell personal data. If that ever changes, you will have the right to opt out before it takes effect.

To exercise any of these rights, email hello@menuregistry.com from the address associated with your account.

Cookies

We use a single session cookie to keep you signed in. This cookie is HttpOnly, Secure, and SameSite=Lax. It contains an encrypted session token — not your email or any personally identifiable information in plaintext.

We use no third-party tracking cookies. There is no Google Analytics, no Meta Pixel, no advertising SDK, and no behavioral tracking on this site. We do not participate in any cross-site tracking network.

Children

MenuRegistry is a professional tool for restaurant operators. It is not directed at children under 16 years of age, and we do not knowingly collect personal data from minors. If we become aware that we have collected data from someone under 16 without appropriate consent, we will delete it promptly.

Changes to this policy

We will email registered users at least 30 days beforeany material change to this privacy policy takes effect. Minor clarifications (fixing typos, adding sub-processor URLs, etc.) may be made without advance notice, but the “last updated” date at the top will always reflect the current version. Continued use of the service after the effective date of a material change constitutes acceptance of the updated policy.

Governing law

This policy is governed by the laws of the State of California, USA, without regard to conflict-of-law principles.

Questions? Email hello@menuregistry.com.