This policy explains what personal data we collect from menu owners and their diners, why we collect it, how we protect it, and the choices you have. If anything here is unclear, email [email protected] and we will explain in plain language.
1. Who this policy applies to
Two groups of people use PandaMenu:
- Menu owners — hotels and any other venue that signs up for an account, builds menus, prints QR codes, and receives orders.
- Diners — guests who scan an owner's QR code and interact with the public menu page.
Different sections below cover each group.
2. Data we collect from menu owners
- Account details: email address, password (stored only as a bcrypt hash — we never see the plaintext), full name, phone number (optional), and profile photo (optional).
- Staff logins you create: username, display name, profile photo (optional), and password (stored only as a bcrypt hash).
- Menu content: everything you type into the menu editor — property details, opening hours, categories, items, prices, item photos, logo, cover photo, allergens, dietary tags, contact numbers, social links, ordering spots, business identifiers you choose to add (GSTIN, FSSAI, CIN), and — if you turn on Razorpay for that menu — the credentials from your Razorpay account so we can confirm each payment on your behalf; sensitive values are stored encrypted and never returned to your browser.
- QR customization: shape, colours, logo, and any custom alias you set for your menu URL.
- Billing details (when you subscribe): we do not store card numbers ourselves. Payment is processed by our payment provider (Razorpay). We store only the customer identifier, subscription status, plan, billing cycle, and invoice history that Razorpay returns to us.
- Support conversations: anything you email us or type into a support form.
3. Data we collect from diners
- Order details: when a diner places an order, they pick where they are from the spots the owner set up, and may enter their name and that spot's number. The items, quantities and variants they chose travel with the order.
- Special instructions: any notes the diner writes for the kitchen.
- Remembering the diner's phone: the first time a phone opens a menu we give it a random ID in a cookie. It contains no name, number or account. Orders placed from that phone at the same hotel are linked through a code made from that ID and the hotel, which is different at every hotel, so no hotel can follow a diner to another hotel. This lets the diner see their past orders at that hotel, have their name filled in on the next order, and lets the hotel recognise a returning guest. The diner can tap Remove my orders from this phone in "Your orders" at any time; the hotel keeps its bills, but they are no longer linked to that phone.
- Online payments: if the owner turns on Razorpay, the diner pays on Razorpay's checkout. We store only the payment reference and method (for example UPI or card) that Razorpay returns — never card or bank details.
- Scan events: every QR scan writes a row in our scan log — the timestamp, a coarse device bucket (mobile / tablet / desktop, parsed from the standard User-Agent header), and the referring domain if the browser sent one. Powers the owner's reports dashboard (scan trend, peak hours, traffic source). We do not store IP addresses, device fingerprints, precise geolocation, or any diner identity.
Order details are visible only inside the owner's dashboard. We do not share or sell them.
4. Data collected automatically
- Server logs: standard access logs (IP address, browser user-agent, referrer, request path, response status, timestamp). Used for security, abuse detection, and troubleshooting. Rotated regularly and not correlated to individual accounts unless we are investigating abuse.
- Cookies: we use a small number of cookies — a session cookie to keep you logged in, an anti-bot cookie from reCAPTCHA on contact forms, and analytics cookies only if you consent via the cookie banner. See "Cookies" below.
- Analytics: we run no third-party analytics on this marketing site. Owner dashboards (scan trends, order stats) run entirely on our own database — no data leaves our server.
5. Why we use this data
- To run the service — display your menu to diners, save your changes, generate QR codes, deliver order details to your dashboard.
- To send you service emails (account confirmation, password reset, billing receipts, trial reminders).
- To keep the service secure — rate-limiting, abuse detection, fraud prevention.
- To improve the product — aggregate, non-identifying analytics on what features owners use.
- To respond to your support requests.
We do not use your data for advertising. We do not sell, trade, or rent it to anyone.
6. Who else touches your data (subprocessors)
To run the service we use a small number of trusted infrastructure providers. They only touch data as far as their specific role requires:
- Hetzner (Helsinki, Finland) — our server and database live here.
- Cloudflare — DNS, CDN, DDoS protection, and object storage (R2) for images you upload (logo, cover photo, item photos, profile photos).
- Amazon Web Services (SES) — sends transactional emails from
[email protected]. - Razorpay — processes subscription payments. Razorpay handles card, UPI, and net-banking payments. All card data is tokenised on Razorpay's PCI-compliant systems — we never see or store raw card numbers.
- Google reCAPTCHA — anti-bot check on the contact form only.
- Google Fonts — serves the Poppins typeface used across the marketing site.
- jsDelivr and the Tailwind CSS CDN — serve the open-source scripts, styles, and icons our pages load.
- OpenAI — only if you turn on AI suggestions for a menu: the AI service receives that menu's item names, descriptions, categories and veg / non-veg tags to work out which dishes go together. No diner data, prices or contact details are sent.
We do not add subprocessors casually. If we add or replace a subprocessor, we update this page.
7. Cookies
- Essential cookies — used for login sessions and CSRF protection. Cannot be disabled without breaking the service.
- Diner phone cookie — on menu pages: a random ID (no personal details) that links a diner's orders at the same hotel, as described in section 3. Kept for up to 400 days and renewed on each visit.
- Analytics cookies — only set if you accept them in the cookie banner. Not currently used — no analytics script is loaded.
- Marketing / Functional cookies — off by default. Not currently used, but the banner keeps the toggle for future use.
You can change your choice any time by clicking the cookie icon at the bottom-left corner of any page.
8. How long we keep data
- Active accounts — for as long as your account is active.
- Deleted menus — when you delete a menu, its content, its orders, and all uploaded images are removed immediately from our database and object storage.
- Deleted accounts — full removal within 30 days of your written request to
[email protected]. - Expired trials — if you don't subscribe, the account and all its data are deleted 60 days after the trial ends. We email you before that happens.
- Billing records — retained as long as required by tax and accounting law, even after account closure.
- Server logs — rotated automatically; older logs are discarded.
9. Your rights
Regardless of where you are, we treat every account the same way. You can:
- Access your account data any time via the dashboard.
- Correct any inaccuracy by editing your profile or menu content directly.
- Export your menu content and order history — email us to request an export.
- Delete individual menus (immediate) or your entire account (within 30 days of request).
- Withdraw consent for optional cookies via the cookie banner.
- Complain — email
[email protected]. We reply to every message.
10. Security
We keep the service secure in the following ways:
- Every page and API call is HTTPS.
- Passwords are stored only as bcrypt hashes.
- Payment card details are never seen by our server — they go straight to Razorpay.
- The database runs on a private network with a dedicated non-superuser role; no public database port is exposed.
- Uploaded images are stored in a dedicated object-storage bucket, isolated from other services.
- Only the operator (a small number of trusted people) has server or database access. All admin access is logged.
No online service is 100% secure. If we ever detect a breach affecting your account, we will notify you promptly by email at the address on file.
11. Children
PandaMenu is a business service — it is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has signed up, contact us and we will remove the account.
12. International data transfers
Our server is in Finland; Cloudflare's storage and CDN are global; AWS SES delivers email through global infrastructure; Razorpay operates in India and internationally; if AI suggestions are on, OpenAI processes that menu's item text outside India. If you sign up from India (or anywhere else outside the EU), your data may be stored or processed in these locations. By using the service, you agree to this transfer.
13. Changes to this policy
If we update this policy in a way that materially affects your rights, we will announce it via email and on the dashboard before it takes effect. The "Last updated" date at the top of the page always reflects the most recent revision.
14. Contact
For any privacy question, correction request, deletion request, or complaint, email [email protected]. We reply within a few working days.