Privacy Notice

AmereGroup operates AmereMenu and acts as data controller for personal data processed to operate the platform. Restaurant owners decide what information to publish in their menus and are responsible for their own restaurant privacy obligations. This notice covers AmereMenu, not a restaurant's separate services.

Account data includes your name, email address, contact or verified phone number, authentication credentials and session information. We use it to create accounts, authenticate you, manage access, secure the service and send account communications.

Restaurant and content data includes contact details, address, social links, menu text, prices, images and uploaded menu photos or PDFs. We process it to host and publish your menu, create QR materials and perform AI-assisted menu extraction when requested. Published contact details and menu content are visible to visitors; avoid uploading unnecessary personal data.

Subscription and preference data includes plan, subscription status, billing identifiers, renewal dates and email or WhatsApp notification choices. We use it to provide paid access, maintain billing records and send eligible notifications. Support messages and communications, when provided, are used to respond to requests.

Usage records include menu-view time, menu identifier, language and referral source. Technical logs may include IP addresses, browser or device details, errors and security or sign-in events. We use these for menu statistics, troubleshooting, fraud prevention and service reliability. We do not receive full payment card details; Paddle handles payment information under its own privacy notice.

We process account, menu and subscription data to perform our contract with you. Security, basic service statistics and troubleshooting rely on legitimate interests, balanced against your rights. Recordkeeping required by law relies on legal obligation. Optional messaging and any non-essential marketing rely on consent where required; you may withdraw consent without affecting previous lawful processing. We do not currently use app-level advertising trackers or marketing cookies.

We share necessary data with hosting, authentication, database, storage, AI processing, email, messaging and scheduling providers, including Lovable Cloud, the AI services used for requested menu imports, Meta/WhatsApp for opted-in messages, and Inngest for renewal scheduling. Google receives technical connection data when Google Fonts load; optional Google sign-in uses Google's authentication service.

We share data with Paddle, our Merchant of Record, for product sales, subscriptions, payments, tax compliance and invoicing. Paddle processes data under its own notice: https://www.paddle.com/legal/privacy. We may share data with professional legal or accounting advisers and authorities when required by law. Public menu content is shared with the public as you direct; access to private account data is restricted.

We keep account and menu data while needed to provide the service and handle account requests. Subscription, transaction and audit records may be retained longer for legal, tax, security and dispute obligations. Verification codes expire after their verification window. Backups and service-provider records may persist for limited operational periods. When data is no longer needed, we delete or anonymize it, subject to lawful retention requirements. Deleting an account does not necessarily immediately delete legally required records or backups.

We use appropriate technical and organizational measures, including encrypted connections and access controls, to protect personal data. No system can guarantee absolute security. Providers may process data outside your country. Where UK/EEA data protection law applies, international transfers require applicable safeguards such as adequacy decisions or Standard Contractual Clauses.

Essential authentication storage and browser storage keep you signed in; language storage remembers your selected language. Hosting and checkout providers may use their own essential cookies. Basic menu-view statistics are recorded by the service without app-level analytics or marketing cookies. You can manage cookies and site storage in your browser; blocking essential storage may prevent sign-in. If non-essential cookies are introduced, we will provide required consent choices before using them.

Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing, and withdraw consent for optional notifications. You may complain to the competent data protection authority. Where GDPR applies, we normally respond within one month, subject to lawful extensions.

Address privacy requests to AmereGroup and identify your AmereMenu account and request. If you do not have AmereGroup's contact details, ask Paddle at https://paddle.net for the seller's contact information. We may need to verify your identity before handling a request. Notification preferences can also be changed in your account. We will update this notice when our practices materially change.