Privacy Policy

We care about your privacy. Here we explain how we collect, process, and protect your personal data in accordance with GDPR.

Data collection & purpose

When you create an account, we collect personal data such as your name, email address, and any other information you choose to share. This data is used to provide our services, improve the user experience, and communicate with you.

We also collect technical information about the website you connect to Menju, for example to check that our embed script is correctly installed and active.

Legal basis for processing

We process your personal data on different legal bases depending on the purpose: account registration and providing the service are done to perform our contract with you; payment information is processed both for the contract and to meet the requirements of the Swedish Bookkeeping Act (bokföringslagen); and certain processing — for example to prevent misuse, protect the service, and check that the embed script is active on your website — is based on our legitimate interest. If we were ever to ask for your consent, for example for marketing, you can withdraw it at any time.

Retention period

We keep your personal data for as long as you have an active account or an active restaurant with us. If an account or restaurant is deleted, we retain the associated data for a further 30 days before it's permanently deleted from our systems — among other reasons, so we can recover data in case of mistakes and handle any support requests.

Your rights

You have the right to request access to, correction of, or deletion of your data, to withdraw your consent, and to request data portability — that is, to receive your data in a machine-readable format. We process your data in accordance with GDPR and don't share it with third parties outside the EU/EEA without a legal basis.

Deleting your account

If you choose to delete your account, all data linked to your account is permanently deleted.

Cookies

We use Firebase Authentication for sign-in, which means necessary cookies and local storage are used to keep you signed in and identify your session. These are strictly necessary for the service to work and aren't used for marketing or third-party tracking, which is why they don't require your consent under the Swedish Electronic Communications Act (lagen om elektronisk kommunikation).

Subprocessors

Our payment solution is provided by Stripe, which handles card details and other payment information in accordance with its own privacy policy.

We use Google Cloud/Firebase as our infrastructure and hosting provider — including for our database, serverless backend (Cloud Functions), and deploying the application (Firebase Hosting). Your data is stored on servers within the EU/EEA (Frankfurt, Germany).

To check that our embed script is active on your website, we use Firecrawl, a third-party service that reads publicly available information on your website. Firecrawl's infrastructure may be located outside the EU/EEA.

Internally, we use Google Workspace for email and office tools, which means that, for example, email you send us may be processed there.

Where data needs to be transferred outside the EU/EEA, we ensure this happens with appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

Security measures

Your data is protected by Google Cloud's security infrastructure, including encryption both in transit (TLS) and at rest, along with strict access control and continuous security monitoring. Google Cloud is certified under, among others, ISO 27001, ISO 27017, and ISO 27018. In addition, we internally limit access to your data to the people who need it to deliver the service, and all sign-in happens through secure authentication.

Complaints to IMY

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) if you believe our processing of your personal data violates GDPR. More information is available at imy.se.

Contact

For more information about how we handle personal data, contact us at info@menju.se.