Privacy Policy

1. Who this applies to

Menuko has two kinds of people interacting with it: Restaurant accounts — the owner and any kitchen/cashier staff the owner invites, who sign up for and manage the service — and Customers, who scan a table's QR code to order. Customers do not create an account or provide their name, email, or phone number to use Menuko.

2. Information we collect

From Restaurant accounts:

• Account email and password (handled by our authentication provider)
• Restaurant name, address, business type, and menu content (categories, items, prices, photos)
• Table setup and QR codes you generate
• A payment QR code or payment link you upload, if you choose to accept GCash/Maya or similar payments directly
• A logo or ad images you upload, if any
• Push notification device tokens, so we can alert your staff about new orders
• Your restaurant's address location, and — for owner accounts only — your device's precise location at the moment you set that address or approve/deny a customer's cancel/change request, used to confirm you're actually at the restaurant. We only request this while the app is open (never in the background), and a periodic "are you currently at the restaurant" check saves only a timestamp, not your coordinates

From Customers, at order time:

• The items and quantities in an order, which table it was placed from, and when
• A payment screenshot, only if the Customer chooses to upload one to help the cashier confirm payment

We do not ask Customers for their name, email, phone number, or location, and Menuko does not use cookies or third-party tracking/advertising scripts on the order page.

3. How we use information

• To operate the ordering, kitchen, cashier, and admin features of the service
• To send order and account-related notifications to Restaurant staff
• To show a Restaurant's own sales data back to its owner, including summaries and trends over time
• To improve Menuko and develop new features
• To provide cross-promotion: a headline/image a Restaurant creates as an ad may be shown to Customers of other Restaurants on the order confirmation screen

4. Sharing, disclosure, and sale of information

We may share, disclose, sell, or otherwise provide the following to third parties, now or in the future, for business purposes including analytics, research, partnerships, and business development:

• Restaurant account and business information (e.g. restaurant name, business type, menu content, and similar account-level data)
• Aggregated or de-identified usage and order-pattern data — for example, which items are frequently ordered together, order volume by time of day, or menu trends — including at the level of an individual table or ordering session, without identifying any Customer personally (Menuko does not collect a Customer's name, email, or phone number in the first place)

We do not share or sell payment screenshots uploaded by Customers — these are used only so your own cashier can confirm payment, and for nothing else.

We also use service providers — our hosting and database provider (Supabase), and our push notification provider (Expo / Expo Application Services, which relays your device's push token and a notification's title/body to deliver it) — to operate Menuko; they process data on our behalf under their own confidentiality obligations, not as independent third parties who can use it for their own purposes.

5. Data retention

We keep Restaurant account and order data for as long as the account is active, and for a reasonable period afterward for legal, accounting, or dispute-resolution purposes. You can request deletion of your Restaurant account and associated data at any time (see Section 7).

6. Security

We use industry-standard safeguards — including encryption in transit, access controls, and row-level authorization on our database — to protect the information Menuko holds. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your rights

If you are a Restaurant owner, you can delete your entire restaurant account and all associated data at any time directly in the Menuko Staff app (Settings → My Page → Delete account) — this permanently removes your restaurant, its menu and order data, and every staff login tied to it. Kitchen and cashier staff accounts are managed by the Restaurant owner and can be removed by the owner from the same screen; they do not currently have a separate self-service deletion option of their own.

For anything else — accessing, correcting, or exporting your account data, or a deletion request not covered above — contact us at hello@menuko.net. If you are a resident of the Philippines, you have rights under the Data Privacy Act of 2012 (RA 10173), including the right to be informed, to object, to access, to correct, to erase or block, to data portability, and to file a complaint with the National Privacy Commission.

8. Children

Menuko is intended for business use by adults operating a restaurant or cafe, and is not directed at children.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where required, notify Restaurant owners.

10. Contact

Questions about this policy? Contact us at hello@menuko.net.