Scope and contact
This notice concerns Menuji, a brand owned and provided by Deburise Solutions, and distinguishes the marketing website, the help website and the restaurant application. Contact [email protected] with the subject Privacy request, or call +91 9071779997. Restaurant-specific questions should also be directed to the restaurant that collected your information. This notice is a review draft; the complete registered address, designated privacy and grievance contacts, deployed processors and retention particulars must be confirmed before publication.
Our different roles
For our sales enquiries, account administration, subscription billing and service security, Menuji determines the relevant purposes of processing. A restaurant usually decides why customer and staff information is entered into its workspace; in those workflows Menuji processes information to provide the restaurant's chosen service. The precise roles depend on the activity and applicable law. A restaurant's own privacy notice should explain its use of guest information.
Website visits and enquiries
A web server can receive your IP address, requested URL, browser information, time and error information when you load a page. Hosting or security infrastructure may keep access logs. The marketing contact page embeds an application-hosted enquiry form. Submitting it sends your name, email, optional phone and restaurant/company details, selected topic, message and permission to respond through Menuji's configured platform email provider to [email protected]. The sender address is Menuji's configured address; your email is used as the reply-to address. No separate lead database is created by this form. Submitted enquiries are processed by the application and email service and retained in the support mailbox according to the applicable retention policy. A short-lived submission marker and rate limits prevent duplicate sends and reduce spam; they do not contain the message text. Please avoid including passwords, API keys, card information or unnecessary guest records.
Account and restaurant information
Account workflows can involve names, work email addresses, phone numbers, credentials, role and branch assignments, restaurant details, support messages and subscription records. Depending on the enabled workflow, restaurant data can include menu items and images, table references, order details, reservations, delivery contact details, invoices, transaction references, receipt evidence and staff actions. Enter only information required for a legitimate operational purpose.
Payment information
Menuji subscription payments and restaurant customer payments use separate merchant arrangements. A payment provider may collect payment-instrument information under its own notice. The application can retain transaction references and status evidence needed for reconciliation. A restaurant-uploaded payment QR and a customer's uploaded bank receipt or screenshot may contain account identifiers or other personal information. Such evidence supports staff review; an upload alone does not establish a confirmed payment. Do not upload complete card credentials, PINs or one-time passwords.
Why information is processed
Information supports account access, restaurant operations, requested communications, subscription administration, customer support, fraud prevention, incident investigation and legally required records. Processing must have an applicable lawful basis; where consent is required it must be obtained before the relevant activity. Consent for an order update does not automatically authorise promotional messages. We do not describe every activity as consent-based simply because someone uses a website.
Restaurant messaging and integrations
Restaurant messaging uses the restaurant's own configured provider account where that integration is enabled. The restaurant chooses authorised events, recipients and templates and is responsible for the required permissions, opt-outs and provider rules. Contact details and message content may be sent to that selected provider to perform the instruction. Enabling an integration can bring additional data flows and terms; review them before supplying credentials or activating delivery.
AI features and sensitive information
AI functionality is subject to a separate enabled scope and provider review. Marketing references do not mean an AI service is active in your account. The intended provider arrangement is Menuji-managed OpenRouter access with free-only routing and no paid fallback; free routing is a cost restriction, not a privacy guarantee. Do not put secrets, payment evidence or identifiable customer records into any AI workflow unless its approved notice and processing terms expressly support that use. A provider notice and data-flow assessment are required before activation.
Who may receive information
Authorised restaurant users can access information permitted by their roles and workspace. Service providers may process information for hosting, email, support, security or a restaurant-selected integration. Payment providers process their own payment workflows. Information may also be disclosed when a valid legal requirement applies or to investigate misuse and protect lawful interests. Any disclosure should be limited to the relevant purpose. The final supplier list and their processing locations must be confirmed for the deployed service.
International processing
A supplier or restaurant-selected service may process information outside the visitor's or restaurant's country. Processing locations, onward transfers and any necessary contractual or legal safeguards depend on the actual provider arrangement. We do not promise India-only hosting or a particular international transfer mechanism through this draft. Request deployment and supplier details before using the service where residency or cross-border conditions apply.
Retention and deletion
Retention depends on the record's purpose, the restaurant's instructions, financial-record duties, security needs and any legal hold. Closing an account or deleting a visible record does not necessarily erase retained invoices, audit history or copies subject to a lawful retention requirement. Backups, if present in the deployed service, follow a separately confirmed lifecycle. The final policy must identify retention periods or meaningful criteria and the offboarding process; this draft does not promise immediate deletion or a verified backup schedule.
Requests and choices
You may contact us to ask about access, correction, deletion, consent withdrawal or another applicable right. Describe your relationship to the account and the information concerned. We may need proportionate identity or authority checks, and may route a restaurant customer's request to the restaurant responsible for it. Do not send identification documents until a secure method and necessity have been agreed. Legal retention, other people's rights and applicable exceptions can affect a request, and we will explain relevant limits.
Children and restaurant guests
Restaurant administration accounts are intended for adults authorised to represent a business. Restaurants must consider any special rules that apply to children's data and should avoid collecting children's details without a necessary lawful purpose and required permission. This website does not invite children to open business accounts. Contact us if you believe inappropriate children's information has been supplied.
Security and incident concerns
Keep individual staff accounts, remove access when staff leave and restrict exported records and uploaded receipts. Report suspected account misuse or data exposure to [email protected] with the subject Security concern. No online service can guarantee absolute security. Security controls, recovery arrangements and legal notification duties must be assessed against the actual deployment; a feature list is not evidence of a completed compliance audit.
Updates and complaints
A revised notice should identify its revision date and material changes. Where a new purpose or provider requires further notice or consent, a general website update alone is insufficient. You can raise a privacy complaint using the contact above and retain a copy of your request. This does not prevent contacting a competent authority or exercising any right available under applicable law.