Privacy Policy
Last updated: August 28, 2026
1. Data Controller
Menuda.app is the data controller for your personal data. You can contact us to exercise your rights or for any query at the address given in the Contact section.
2. Information We Collect
We collect information that you provide directly to us, such as when you create an account, update your profile, or communicate with us.
- Contact information (name, email)
- Restaurant information (name, address, description)
- Content you upload (menus, images, descriptions)
- Usage and preference information
- Billing data when you subscribe to paid services
Table reservations (diners)
When you book a table on a restaurant’s public page powered by Menuda, we process the data needed to manage the reservation on the restaurant’s behalf (the restaurant is the data controller for your relationship as a diner):
| Data | Requirement |
|---|---|
| Name | Required |
| Phone (international E.164 format) | Required — identifies your guest profile at that restaurant |
| Party size | Required |
| Transactional consent | Required |
| Optional — only for email confirmations if you provide it | |
| Marketing consent | Optional and unchecked by default; chosen per channel (email, WhatsApp, SMS) |
Transactional messages (confirmation, reminders, changes, or cancellation) may be sent via WhatsApp or SMS to the phone number you provide. Email is only used if you voluntarily provide it. There is no “phone or email” mode: phone is always required.
If you visit without a prior booking (walk-in) or join the waitlist and provide a real phone number, the restaurant may keep an operational guest profile. Marketing is only enabled if you opt in (on the form or verbally to staff). An anonymous profile (no phone) is not used for campaigns.
You may exercise your rights of access, rectification, erasure, restriction, objection, and portability by contacting the restaurant or via our contact form.
3. Purposes and Legal Bases for Processing
We process your data for the following purposes and on the legal bases indicated (GDPR and, where applicable, Spanish data protection law):
| Purpose | Legal basis | Retention period |
|---|---|---|
| Provision of the service (account, menus, dashboard) | Performance of contract (Art. 6(1)(b) GDPR) | While you keep the account and, after closure, the time needed for claims (max. 5 years) |
| Communications about your account and the service | Performance of contract / legitimate interest | Same as service provision |
| Billing and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) | As required by tax law (minimum 4 years) |
| Web analytics (cookies) when you accept | Consent (Art. 6(1)(a) GDPR) | As per cookie duration (up to 2 years) or until you withdraw consent |
| Service improvement and user experience | Legitimate interest (Art. 6(1)(f) GDPR) | Aggregated or anonymized data without fixed period; identifiable data as per specific purpose |
| Customer support and complaints | Performance of contract / legal obligation | For the duration of the complaint and statutory limitation periods |
| Table reservations and diner profile (name, phone, visits) | Performance of contract / restaurant’s legitimate interest | 24 months from the last visit (booking, walk-in or waitlist). If you return, the period restarts. After that, data are anonymized, except for active bookings or legal duties |
| Compliance with legal obligations | Legal obligation | As required by applicable law |
For more detail on cookies and their duration, see our Cookie Policy.
4. How We Use Your Information
We use the collected information to:
- Provide and improve our services
- Communicate with you about your account
- Send important updates and notifications
- Personalize your experience on the platform
- Comply with legal and tax obligations
5. Sharing Information
We do not sell, rent, or share your personal information with third parties, except in the following circumstances:
- With your explicit consent
- To comply with legal obligations
- With service providers who help us operate the platform (hosting, payment gateways, analytics), under agreements that ensure protection of your data
- In case of merger, acquisition, or sale of assets
6. Minors
In line with applicable law (including Spanish Organic Law 3/2018 on data protection):
- Under 14: Minors under 14 cannot validly consent to the processing of their data in our services on their own. If a minor under 14 wishes to use the service, they must do so with the consent of their parents or legal guardians.
- 14 and over: Minors aged 14 and over may give their own consent for the processing of their personal data in the context of information society services.
We do not knowingly collect personal data from minors under 14 without the consent of the holder of parental responsibility or guardianship. If you become aware that we have collected data from a minor under 14 without such consent, please contact us so we can delete it.
7. Data Security
We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, in line with the GDPR and applicable regulations.
8. Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access to your personal data
- Right to rectification of inaccurate or incomplete data
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing
- Right not to be subject to automated individual decision-making with legal or similar effects
To exercise these rights, you may contact us at the address below. We will respond within one month of receiving your request, unless the complexity or number of requests requires an extension of up to two further months, in which case we will inform you.
You also have the right to lodge a complaint with a supervisory authority (e.g. in Spain, the AEPD: www.aepd.es).
9. Cookies and Similar Technologies
We use cookies and similar technologies to improve your experience, analyze site usage, and personalize content. You can manage your cookie preferences at any time via our cookie banner or preference center.
10. Data Retention
We retain your personal information for the periods set out in the table of purposes and legal bases (section 3), or as long as necessary to fulfill the purposes described in this policy, unless the law requires or allows a longer retention period.
For diners, the 24-month period is counted from the last visit to the restaurant. A new booking, walk-in or waitlist entry restarts that period.
11. Contact
If you have questions about this privacy policy or wish to exercise your rights, you may contact us via our contact form.
Menuda.app - Data Protection Officer
Response time for exercising rights: 1 month (extendable by 2 further months in exceptional cases, with notice).