Legal

Privacy Policy

Menu.ly helps restaurants build, publish and print their menus. This policy explains what information we collect when you use the Menu.ly iOS app and website, why we collect it, and the choices you have.

Effective September 16, 2026

1. Who we are

Menu.ly is operated by Hiram Mendiola ("we", "us"). Menu.ly is a service for businesses: it is used by restaurant owners and their staff, not by diners. If you have questions about this policy, write to hirammch@icloud.com.

2. Information we collect

Account information

Your email address, your name if you add one, and your password. We store only a secure hash of your password, never the password itself.

Restaurant and menu content

Everything you add to your workspace: restaurant name, logo and branding, contact details (email, phone, address), social links, menus, dishes, prices, promotions and the footer printed on your PDFs. We also keep a history of menu changes (who changed what and when) so your team can review and restore edits, and any feedback you send to the Menu.ly team from the app.

Photos and camera

If you choose a logo or image, the app asks for access to your camera or photo library. Only the image you select is uploaded. We don't access the rest of your photos.

Face ID and saved sign-in

If you turn on "Save my credentials" or Face ID, the app keeps your session in the iOS Keychain on your device. Face ID is handled entirely by iOS: Menu.ly never receives or stores your face data, and only learns whether the check succeeded.

Payments on the website

Subscriptions are purchased on our website, not in the app. Card details are entered directly into Stripe and never reach our servers. We keep your Stripe customer and subscription identifiers and your plan, so we can manage your subscription.

Technical data

Our servers record standard request information (IP address, browser or app version, the address requested and the time) to keep the service secure and fix problems. When you request a password reset we record the IP address of the request to prevent abuse.

We don't use advertising, analytics or tracking tools, in the app or on the website, and we don't track you across other companies' apps or websites.

3. Voice dictation and AI writing

Menu.ly can transcribe dish names and descriptions you dictate, and can write, polish or translate menu text. These features are optional and are provided by OpenAI. The app asks for your permission before any of your data is sent to OpenAI, and you can withdraw that permission at any time in the app under Settings → Security & access.

• Voice dictation: while you are dictating, audio from your microphone is streamed through our servers to OpenAI to be transcribed. We don't record or store the audio. The resulting text appears in the editor, and is saved only if you save the dish.
• AI writing: the dish name and description you ask to polish or translate are sent to OpenAI, and the suggestion is returned to you.

Under OpenAI's API data policies, data sent through its API is not used to train OpenAI's models, and OpenAI may retain it for a limited time (up to 30 days) to monitor for abuse. Please don't dictate or type personal information that doesn't belong on a menu.

4. How we use information

• To provide Menu.ly: create and publish your menus, generate PDFs and host public menu pages.
• To keep you signed in, secure your account and send password reset emails.
• To manage subscriptions and plan limits.
• To provide the AI features you choose to use.
• To answer support requests and feedback.
• To prevent abuse, and to meet legal obligations.

We don't sell your personal information and we don't use it for advertising.

5. Service providers

We share information only with providers that help us run Menu.ly, and only what each needs to do its job:

• OpenAI — voice transcription and AI writing, when you allow it.
• Stripe — subscription payments on the website.
• Resend — sending account emails such as password resets.
• Our hosting provider — the servers that run Menu.ly and store its data.

We may also disclose information if required by law, or to protect the rights and safety of our users or the service.

6. Public menus

Menus you publish, together with your restaurant name, logo and the contact details you choose to show, are public: anyone with the link can see them, and they may appear on your own website. Menus saved as drafts are not public. People who view a public menu don't need an account, and we don't set cookies or run analytics on public menu pages.

7. How long we keep data

• Account, restaurant and menu data: while your account is active, and until you ask us to delete it.
• Server request logs: 14 days.
• Database backups: daily backups for 14 days and weekly backups for 8 weeks, after which they are deleted.
• Password reset links: they expire after one hour.
• Dictation audio: not stored by Menu.ly.

8. Your choices and rights

• Access and correction: you can view and edit your account and restaurant information in the app and on the website at any time.
• Deletion: to delete your account and your restaurant's data, email hirammch@icloud.com from the email address on your account. We'll confirm your request and delete the data within 30 days. Copies in backups are removed as those backups expire.
• AI features: withdraw your permission in the app under Settings → Security & access.
• Device permissions: you can turn off microphone, camera, photo and Face ID access for Menu.ly at any time in the iOS Settings app.

Depending on where you live, you may have additional rights, such as receiving a copy of your data or objecting to certain processing. Contact us and we'll respond as required by applicable law.

9. Security

All connections to Menu.ly are encrypted with HTTPS. Passwords are stored as secure hashes, sessions on your device are kept in the iOS Keychain, and changing your password signs out your other sessions. No method of storage or transmission is completely secure, but we work to protect your information.

10. Children

Menu.ly is a business tool and is not directed to children under 13. We don't knowingly collect information from children. If you believe a child has given us information, contact us and we'll delete it.

11. Changes to this policy

If we change this policy, we'll update the effective date above. If the changes are significant, we'll let account owners know by email or in the app before they take effect.

12. Contact