How MenuSmart handles personal data
This policy explains who is responsible for your personal data at www.menusmart.dev, what we do with it, how long we keep it, who receives it, and how to exercise your rights. It covers restaurant owners and their teams, guests who book through MenuSmart pages, and website visitors.
- Controller
- Edgar Hugo Cheverier Aguilar (MenuSmart)
- Contact
- support@menusmart.dev
- Supervisory authority
- AEPD (Spain)
- Updated
- October 31, 2026
Who is responsible
The controller is Edgar Hugo Cheverier Aguilar, a sole trader established in Spain who runs MenuSmart (tax ID 55644340A, Carrer de la Perdiu, 48, Urb. Can Regasol, 08415 Bigues i Riells del Fai (Barcelona), España).
For any privacy question or request, write to support@menusmart.dev. We have not appointed a data protection officer because the law does not require one for MenuSmart.
Full details of the owner are in the legal notice.
When MenuSmart is the controller and when it acts for a restaurant
MenuSmart is the controller for the accounts of restaurant owners and their collaborators, billing, support, the website and its cookies, the assistant on the home page, and the security of the service.
When a guest books a table, confirms or cancels a booking, receives a booking email, or leaves a review, the restaurant is the controller of that data, and MenuSmart processes it on the restaurant’s behalf and on its instructions, as a processor (Article 28 GDPR). The same applies to the table service that staff run from the dashboard.
If you are a guest, contact the restaurant to exercise your rights. If you write to us instead, we will forward your request to the restaurant without delay and help it answer.
The terms of that processing are in the data processing agreement.
What we process as controller, why, and for how long
The table lists each purpose, the data involved, the legal basis under Article 6 GDPR, and how long we keep the data. Fields marked as required in a form are needed to provide that service; without them we cannot create the account or handle the request.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Your account and the service | Name, email address, password (managed by Firebase Authentication), profile photo and sign-in method if you use Google, language, sign-up date, and the restaurants, menus, images, opening hours, booking settings, and collaborators you add | Contract (Art. 6(1)(b)) | While the account exists. Deleting the account from the dashboard deletes this data, images included. Accounts unused for 12 months and without an active subscription are deleted after an email warning 30 days ahead; billing records are kept as the next row says. Pending collaboration invitations expire after 30 days |
| Service emails | Name, email address, and the content of each email: verification, password reset, welcome, and purchase confirmation | Contract (Art. 6(1)(b)) | A record of the welcome and purchase emails sent is kept while the account exists |
| Pro subscription and billing | Stripe customer and subscription references, plan, subscription status, and payment history. Card details go directly to Stripe and never reach MenuSmart | Contract (Art. 6(1)(b)) and the legal obligation to keep accounts (Art. 6(1)(c)) | While the account exists; billing records for as long as accounting and tax law require (6 years under Article 30 of the Spanish Commercial Code) |
| Support | Your messages and email address, and the account details needed to help you | Contract (Art. 6(1)(b)), or our legitimate interest in answering people who write to us without an account (Art. 6(1)(f)) | Until the request is resolved, and afterwards while a related claim could still be brought |
| Dashboard AI assistant | The messages and files you send, and the account, menu, restaurant, and booking data the assistant reads to answer or act; guests’ email addresses and phone numbers only when you ask for them | Contract (Art. 6(1)(b)) | Conversations 30 days; request records 24 hours; menu and restaurant validation error records (account and menu or restaurant identifiers and the error found) 90 days. All of it goes earlier if the account is deleted, including collaborators’ conversations in that account |
| Home page AI assistant | The messages you send, and a code derived from your IP address with a key that changes every day, used for the daily message limit and as the safety identifier sent to Anthropic | Legitimate interest in answering visitors’ questions about MenuSmart and preventing abuse (Art. 6(1)(f)) | Messages are not stored in our database. The daily counter and each day’s key are deleted after 2 days |
| Security and abuse prevention | IP address (stored only as a hash in usage limits), browser and device data, App Check and reCAPTCHA signals, and technical logs | Legitimate interest in keeping the service secure and available and in preventing fraud and abuse (Art. 6(1)(f)) | Usage limits between 10 minutes and 2 days; server logs at Google Cloud 30 days |
| Visit counts | Only a time stamp in your browser for each restaurant page, blog post, or attribution link already counted; our database keeps aggregate totals with no visitor identifier | Consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI) | 24 hours in your browser |
| Advertising measurement | Ad click identifiers (gclid, gbraid, wbraid, oppref, and OpenAI’s __obref cookie), campaign parameters (utm), and the landing page; for OpenAI Ads, also a SHA-256 hash of your email address and of your account identifier when you sign up, start a checkout, or subscribe | Consent (Art. 6(1)(a)) | In your browser until you reject consent or clear your browser storage; on your account until you withdraw consent or delete the account; conversion records 90 days for Google Ads and 30 days for OpenAI Ads; the record of your cookie choice (version, purposes, and date) 3 years |
| Legal obligations and claims | The data needed in each case | Legal obligation (Art. 6(1)(c)) and legitimate interest in defending claims (Art. 6(1)(f)) | For the applicable limitation periods |
- We do not use your data for personalized advertising, and we do not sell it.
- We do not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you.
What we process for restaurants
For each restaurant, MenuSmart processes guest data only to provide the booking, review, and table service features the restaurant has turned on. The restaurant decides the legal basis, which is usually the booking contract with the guest.
| Processing | Data | Default retention |
|---|---|---|
| Bookings | Name, email address, phone number, party size, date, time, area and tables, language, and booking status (confirmed, reconfirmed, cancelled, attended) | Unconfirmed bookings are deleted 30 to 40 minutes after they are made; all others 30 days after the booking date |
| Booking emails | Name, email address, and booking details, to send the confirmation request, the confirmation, a reconfirmation request 24 hours before, and cancellation notices | Sending records 30 days; cancellation receipts 7 days |
| Reviews | After a visit marked as attended, the guest receives a review request by email, unless they refused it when booking or from an earlier email, or the restaurant turned requests off. A submitted review keeps the guest’s name, rating, comment, and visit details; the email address and phone number are removed when it is submitted. To honour an opt-out, a pseudonymous code derived from the email address and the restaurant is kept | Unanswered requests 30 days; submitted reviews without the guest’s name after 24 months, while the restaurant’s account exists, and the restaurant can delete them; opt-outs while the restaurant exists |
| Table service | Status of each table during the day, without guest contact details | 3 days |
Restaurant guests can read the booking privacy notice.
Where the data comes from
Most data comes from you. If you sign in with Google, Google gives us your name, email address, and profile photo. Stripe tells us the status of your subscription and payments. Guests give their booking details to the restaurant through its MenuSmart booking page.
Who receives the data and where
We use the providers in the table. Those acting for us process data only on our instructions, under a data processing agreement. When data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework (for certified US companies) or on the European Commission’s standard contractual clauses.
| Recipient | What for | Location | Safeguard |
|---|---|---|---|
| Google Cloud and Firebase | Database, file storage, server functions, and App Check | European Union (Firestore and Storage in the EU; functions in Belgium) | Google Cloud data processing terms; Data Privacy Framework and standard contractual clauses for any access from outside the EU |
| Firebase Authentication (Google) | Sign-in and account security | United States | Data Privacy Framework and standard contractual clauses |
| Google reCAPTCHA, Sign in with Google, and Google Maps | Protection against bots on sign-in, restaurant pages, search, bookings, payment, the dashboard, and the assistants; Google sign-in; the map on the restaurant search page when you choose to show it, and the address search in the dashboard when you turn it on (we remember each choice on your device for 12 months or until you hide the map or turn off the search) | United States and other countries where Google operates | Data Privacy Framework and standard contractual clauses |
| Vercel | Website hosting; server-rendered pages run in Paris, and Vercel may process logs and network data in the United States | European Union (France) and United States | Data Privacy Framework and standard contractual clauses (Vercel data processing addendum) |
| Amazon Web Services (Amazon SES) | Sending emails | European Union (Ireland) | AWS data processing addendum |
| Stripe | Checkout, subscriptions, invoices, and the customer portal; Stripe also acts as an independent controller for fraud prevention and its legal obligations | European Union and United States | Data Privacy Framework and standard contractual clauses |
| Anthropic | Generating the answers of both AI assistants. Anthropic does not train its models on this data and deletes it within 30 days, or within up to 2 years if its safety systems flag a conversation | United States and other countries where Anthropic operates | Standard contractual clauses (Anthropic Ireland data processing addendum) |
| Google Ads | Advertising measurement, with your consent; Google acts as an independent controller | United States and other countries | Data Privacy Framework and standard contractual clauses |
| OpenAI Ads | Measurement of ChatGPT ads, with your consent; OpenAI acts as an independent controller | United States | Standard contractual clauses |
| Restaurants and their teams | Bookings and reviews go to the restaurant the guest booked with, and collaborators see the data of the account they were invited to | Where the restaurant is | — |
| Authorities and advisers | Public authorities and courts when the law requires it, and professional advisers such as an accountant or tax adviser | Spain | — |
Your rights
You can ask for access to your data, its rectification or erasure, restriction of processing, and data portability, and you can object to processing based on legitimate interest. Where processing relies on your consent, you can withdraw it at any time without affecting earlier processing; for cookies, use the cookie settings on the site.
Write to support@menusmart.dev from your account’s email address, or tell us how we can identify you. We answer within one month, which we can extend by two months for complex requests, and we will tell you why. Owners can also download their data as JSON and delete their account at any time from the Account section of the dashboard.
If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency: AEPD.
Who MenuSmart is for
MenuSmart is a service for businesses and professionals aged 18 or over, and we do not knowingly create accounts for minors.
Security, breaches, and changes
We protect personal data with encryption in transit, access controls tied to each account, database security rules, protection against bots, usage limits, and server logs to detect errors and abuse. No system connected to the internet is completely secure.
If MenuSmart needs to access an account or its conversations with the assistant to give support or investigate a problem, we record who accessed it, when, and why, and keep that record for one year.
If a breach puts personal data at risk, we notify the AEPD within 72 hours where the law requires it, the people affected when the risk is high, and the restaurants affected without undue delay.
We publish any change to this policy on this page with its new date. If a change is significant, we will also tell account holders by email before it applies.