Privacy Policy

Effective date: 23 August 2026 · Version: 1.0

This Privacy Policy explains how Alexander Panayi of [Address to be added on incorporation], Cyprus ("we", "us"), operating the Menufolk platform (the "Service"), collects and uses personal data. We are the data controller for the data described in section 3, and a data processor acting on the Venue's behalf for the data described in section 4.

Contact for privacy matters: support@menufolk.com.

1. Who this applies to

Venue owners and staff who use the Service.
Diners who place orders through a Venue using the Service.
People who contact us or submit the "talk to us" form on our website.

2. Summary of what we collect

Venue account data: name, email, venue details, and login credentials.
Diner data: order details, and — only if the Diner chooses — an email address to receive a receipt.
Payment data: processed by Stripe; we do not store full card details.
Website enquiry data: name, venue, email, phone (optional), and message.
Technical data: basic logs needed to run and secure the Service.

3. Data we control (Venues and enquiries)

For Venue accounts and website enquiries, we are the controller. We use this data to:

Create and manage Venue accounts and provide the Service.
Bill the subscription and Platform Fee, issue VAT invoices, and keep records required by law.
Respond to enquiries and provide support.
Secure the Service and prevent misuse.

Lawful bases: performance of our contract with the Venue; our legitimate interests in running and securing the Service; and compliance with legal obligations (e.g. tax record-keeping).

4. Data we process on the Venue's behalf (Diners)

When Diners order through a Venue, that Venue is the controller of the Diner's personal data, and we act as its processor — we process Diner data only to provide the Service to that Venue. This includes order details and, where the Diner opts in, an email address for a receipt.

We use Diner email addresses solely to send the requested order confirmation/receipt; we do not use them for marketing.
The order confirmation email we send the Diner is a non-fiscal courtesy document; the Venue issues any legally required fiscal receipt through its own systems.
Where required, the terms of this processing are set out in a Data Processing Agreement between us and the Venue.

5. Payment processing

Payments are processed by Stripe. When a Diner pays, their payment is made to the Venue's own Stripe account (the Venue is the merchant of record). Stripe processes card data under its own privacy terms; we do not receive or store full card numbers. See Stripe's privacy policy for how Stripe handles payment data.

6. Who we share data with

We share data only as needed to run the Service, with providers acting on our instructions:

Stripe — payment processing.
Our email provider — to send receipts, account, and transactional emails.
Our hosting and database providers — to run the Service.
Authorities or advisers where required by law.

We do not sell personal data.

7. International transfers

Some of our providers (for example, payment, email, hosting, and infrastructure services) may process data outside Cyprus, including in the EU/EEA and other countries. Where data is transferred outside the EEA, we rely on appropriate safeguards (such as the providers' standard contractual clauses).

8. How long we keep data

Venue account data: for as long as the account is active, and afterwards as needed for legal/accounting purposes.
Order and payment records: as required by Cyprus tax and accounting law (records are generally kept for several years).
Diner receipt emails: kept only as long as needed for the receipt purpose.
Enquiry data: kept only as long as needed to deal with your enquiry.

9. Your rights

Under the GDPR you have rights to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability, subject to legal limits. To exercise these rights, contact us using the details below. For Diner data that a Venue controls, we will pass requests to the relevant Venue or assist it as its processor. You also have the right to complain to the Office of the Commissioner for Personal Data Protection in Cyprus.

10. Security

We use appropriate technical and organisational measures to protect personal data, including access controls and restricting who can see sensitive information (for example, only Venue owners can see financial figures; staff accounts cannot). No system is completely secure, but we take reasonable steps to protect your data and to limit and respond to any breach.

11. Changes to this policy

We may update this policy from time to time and will post the updated version with a new effective date. Where changes are material, we will take reasonable steps to notify affected users.

12. Contact

For any privacy question or to exercise your rights: support@menufolk.com · Alexander Panayi, [Address to be added on incorporation], Cyprus.