Privacy Policy.

Who is responsible

NextEra, poslovne dejavnosti in storitve, d.o.o., Bantanova ulica 2, 2000 Maribor, Slovenia, registration number 9885552000, is the controller of your personal data. For anything about your data, write to info@yumenu.app.

What we collect and why

• Account: your email address, and your name and profile picture if you sign in with Google. We need these to create your account and sign you in (to provide the service: GDPR Article 6(1)(b)).
• Your restaurant and menus: restaurant name, address, country and logo, dishes, prices, photos, and the settings you choose. This is the service itself (Article 6(1)(b)).
• Photos and files you import: we keep them with the menu so you can compare the result with the original. If you throw an import away, its photos are deleted straight away.
• Billing (paid plans): company name, address and VAT ID, needed for invoices. We have to keep invoices for 10 years under Slovenian tax law (Article 6(1)(c)).
• Messages you send us: your email and what you write, to answer you.
• Technical data: our hosting provider records IP addresses, browser type and the pages requested in short-term server logs, to keep the service secure and working (our legitimate interest: Article 6(1)(f)).

Guests who scan your QR code

When a guest opens your QR menu, we set no cookies and use no tracking or analytics scripts. We only count how many times each menu was opened per day and in which language, as plain numbers without any personal data. You see these numbers in your dashboard. Like every website, our host briefly records the request in its server logs (see above).

Photo import and AI translation

When you import a menu or ask for a translation, the photos and text are sent to Anthropic's AI service, which reads or translates them and sends the result back. Under its commercial terms, Anthropic doesn't use this content to train its models. The AI only turns your menu into text and translations. It doesn't make decisions about you.

If you ask us to finish a difficult import for you, a person on our team looks at your photos and fixes the menu in your account.

Who else handles your data

We use these providers to run the service. Each one handles data only on our instructions, under a data processing agreement:

• Vercel: hosting and file storage (photos, logos). Servers in Frankfurt, Germany.
• Neon: our database. Servers in Frankfurt, Germany.
• Clerk: sign-in and accounts. It also sends the sign-in codes by email.
• Anthropic: reads imported photos and translates menu text.
• Google: only if you choose to sign in with Google.

Vercel, Neon, Clerk and Anthropic are US companies, so some data may be handled in the United States. Those transfers are protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

We don't sell your data, and we don't share it for advertising. We disclose it to authorities only when the law requires it.

Cookies

We only use cookies the site needs to work, so we don't ask for consent and don't show a cookie banner. There are no advertising or analytics cookies.

• Sign-in cookies (set by Clerk, names start with __session and __client): keep you signed in.
• menu-draft: links a menu you haven't saved yet to your browser. Kept for 30 days.
• ui_locale: remembers the language of the interface. Kept for 1 year.
• home-dismissed: remembers which tips on your dashboard you've closed. Kept for 1 year.

How long we keep data

• Account, restaurant and menus: for as long as you have an account. When you delete your account, we delete them within 30 days, including from backups.
• A menu you started but never saved: 30 days.
• Invoices: 10 years, as Slovenian tax law requires.
• Emails with us: as long as we need them to help you, at most 2 years after our last message.
• Server logs: a few days.
• QR scan counts: these are plain numbers without personal data, so we keep them with your menu.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, or to give it to you in a format you can take elsewhere. You can also object to processing based on our legitimate interest. Write to info@yumenu.app from the email address on your account. We answer within one month.

If you think we handle your data wrongly, you can complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si), or to the data protection authority in your own country.

Security

Data travels encrypted (HTTPS) and is stored with providers that encrypt it at rest. Only the people who need it to run the service can reach it. Published menus are public by design. Everything else in your account is visible only to you and the people you invite.

Changes to this policy

When we add a new provider or use data in a new way, we update this page first. If a change matters for you, we also tell you by email or in the app.