Privacy Policy

1. Who We Are

Menuvoly is operated by Menuvoly Inc., registered at 106 Flowing Creek Cir, Ottawa ON K2M 0K1, Canada ("we", "our", or "us"). This Privacy Policy explains how we collect, use, and protect your personal information when you use our services.

2. Information We Collect

We collect the following information:

• Account information: Email address and display name
• Google OAuth profile: Name, email, and profile picture (when signing in with Google)
• Restaurant data: Information you enter about your restaurant, menu items, and settings
• Usage data: Log data such as IP address, browser type, and pages visited

3. How We Use Your Information

• To provide and maintain the Menuvoly service
• To authenticate you and manage your account
• To send account-related emails (verification, password reset)
• To improve and develop new features
• To comply with legal obligations

4. How We Store Your Data

Your data is stored in a PostgreSQL database hosted on secure servers. Authentication tokens are stored as hashed values using SHA-256. Session information is stored in HttpOnly cookies that are not accessible to JavaScript. Passwords are hashed using bcrypt before storage.

5. Data Retention

• Sessions: Automatically expire after 7 days
• Account data: Retained until you delete your account
• Cookie consent: Stored locally in your browser for 12 months

6. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing of your personal data

To exercise these rights, contact us at [email protected].

7. GDPR (European Union)

If you are located in the European Union, you have additional rights under the General Data Protection Regulation (GDPR). Our legal basis for processing your data is contract performance (providing the service you signed up for) and legitimate interests. You may lodge a complaint with your local data protection authority.

8. CCPA (California)

California residents have the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at [email protected].

9. PIPEDA (Canada)

If you are located in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). We collect only the information necessary to provide our service, obtain consent before collecting personal information, and allow individuals to access and correct their information.

10. Cookies

We use cookies for authentication and session management. For detailed information about the cookies we use, please see our Cookie Policy.

11. Contact Us

For any privacy-related questions or to exercise your rights, contact us at: [email protected]