Privacy Policy

1. Data Controller

Epicurean Digital Consultants Ltd is the data controller for MenuMargin. Our company number is 16622200 and our registered address is 30 Durham Road, Wimbledon West, London SW20 0TW.

For privacy or data protection enquiries, contact hello@menumargin.co.uk.

2. What Personal Data We Collect

• Identity and contact data such as your name, email address, and business name.
• Account and profile data such as subscription tier, permissions, and service preferences.
• Payment and billing metadata provided through Stripe, such as customer and subscription identifiers.
• Menu content you upload or create, including item names, prices, descriptions, ingredients, and allergens.
• Founding venue applications: your name, venue name and type, town or city, email address, telephone or WhatsApp number, website, a link to your menu, an optional menu file, the challenge you describe, and whether you gave permission to be contacted and to have anonymised findings published.
• Audit reports you ask us to keep without an account: the email address you give for “Email me this report”, whether you asked to hear from us, the menu and result, and any weekly guest figure you entered.
• If you pay for the full audit before creating an account: the email address you pay with, which we use to set up your account.
• Ratings you give to audit findings (“Was this finding useful?”), with any optional comment.
• Support and communications data, including messages sent to us through forms, live chat, or email.
• Usage and technical data such as feature usage, device/browser information, IP address, and error logs.

3. Our Legal Basis for Processing

We process personal data under the following lawful bases under UK GDPR and GDPR where applicable:

• Contract performance, where processing is required to provide and operate MenuMargin.
• Legitimate interests, including product improvement, support, platform security, fraud prevention, and service monitoring.
• Consent, where you opt in to marketing communications or optional analytics/measurement features.
• Legal obligation, where retention or disclosure is required by tax, accounting, or other legal duties.

4. How We Use Your Data

• To create and manage your account and provide access to the MenuMargin platform.
• To process subscriptions, payments, renewals, cancellations, and billing support.
• To store, render, export, and otherwise process the menu content you create.
• To deliver customer support, troubleshoot issues, and respond to enquiries.
• To run AI features, including sending relevant menu item names and prices to our AI service for processing.
• To monitor performance, secure the platform, and improve product quality and reliability.
• To send essential service communications and, where you consent, limited marketing communications.

5. Third-Party Processors

We use carefully selected service providers to operate MenuMargin. These include:

• Supabase for database hosting and authentication, with project data hosted in the EU region (Ireland, eu-west-1).
• Stripe for payment processing, subscription billing, and payment-related fraud controls.
• Resend for transactional email delivery.
• Our AI service for AI-assisted processing of menu content, including item names and prices used in AI features.
• Vercel for infrastructure, deployment, and application hosting.

We do not sell your personal data. We disclose data only where necessary to provide the service, comply with law, or protect our legitimate interests.

6. International Transfers

Some providers supporting MenuMargin, including Supabase, Vercel, Stripe, Resend, and our AI service provider, may process or access data outside the EEA or UK. Where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or equivalent lawful transfer mechanisms.

7. Data Retention

We keep account and service data while your account remains active. If you request deletion, we aim to delete account data within 30 days of the verified deletion request, unless we must keep limited records for legal, tax, accounting, fraud prevention, or dispute resolution purposes.

If you run a menu audit without signing in, the menu is sent to our AI service to be read and is not saved to an account. To enforce usage limits we keep a salted, one-way hash of your IP address, which is deleted after seven days. Saved audits are kept with your account until you delete them or your account.

Founding venue applications are used only to assess and respond to the application. An uploaded menu file is stored privately and is never published. Applications that do not go ahead are deleted, with any file, 12 months after they were last updated; you can ask us to delete yours sooner at any time. Anonymised findings are only published where you gave that permission and approved the final wording.

A report you ask us to email or keep is sent to the address you gave, and the link in it works for 30 days. The report and the address are deleted 90 days after you asked. We email you nothing further unless you ticked the box to hear from us, and you can withdraw that at any time by replying to any email. The founder may reply personally to a report you asked for.

Billing records may be retained longer where required by law. Operational logs and support records are retained only for as long as reasonably necessary to run, secure, and improve the service.

8. Your Rights Under GDPR

You may have the right to request:

• Access to the personal data we hold about you.
• Correction of inaccurate or incomplete data.
• Erasure of your personal data.
• Restriction of processing in certain circumstances.
• Portability of your data in a usable electronic format.
• Objection to processing based on legitimate interests.
• Withdrawal of consent where processing relies on consent.

To exercise these rights, email hello@menumargin.co.uk.

9. Cookies and Similar Technologies

MenuMargin uses essential browser storage and related technologies to provide login, preferences, and service functionality. Please read our Cookie Policy for more detail.

10. Complaints

If you are unhappy with how we handle your data, please contact us first so we can try to resolve the issue. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.