This policy explains what personal data Restu Menu collects, why, and how you can control it. It is written to follow Saudi Arabia's Personal Data Protection Law (PDPL).
Who we are
Restu Menu ("we") provides digital menus, ordering and review tools for restaurants and cafés at restumenu.com. You can reach us at hello@restumenu.com.
What data we collect
Restaurant owners and staff: your email address, password (stored encrypted, never readable by us), restaurant name, city, menu content and settings.
Guests who order: the name you enter and, for pickup orders, your phone number. Your order details (items, table, time).
Guests who leave feedback: your rating and, if you choose, a private message and contact details.
Website visitors: what you send us through our forms (for example the contact, partner or waitlist forms) and, only if you allow analytics cookies, how you use the website (pages viewed, clicks, device and browser type, approximate location from your IP address).
Billing: when paid plans open, our payment provider Paddle collects payment details. We never see or store card numbers; we receive your plan, payment status and invoices.
Why we use it
- To provide the service: show menus, pass orders to the restaurant, send account emails.
- To keep the service safe: prevent abuse and fraud (for example, limiting repeated requests).
- To reply to you when you contact us.
- To improve the service, using totals and, with your consent, analytics.
- To run AI features you ask for (menu import, translation, review replies).
We do not sell personal data.
Legal basis
We process data to perform our agreement with restaurants, to provide a service you asked for (such as placing an order), with your consent where required (such as optional cookies), and to meet legal obligations.
Where your data is stored
Our database and files are hosted in Frankfurt, Germany (European Union), with encrypted connections. Some providers listed below may process data in other countries (for example the United States) under appropriate safeguards, as the PDPL requires.
Service providers
We use trusted providers to run Restu Menu. They only process data to provide their service to us:
- Supabase — database, files and sign-in
- Vercel — website hosting
- Resend — account emails
- Paddle — subscription payments and invoices (merchant of record)
- Anthropic — AI features (menu import, translation, review replies); we send menu or review text, not guests' contact details
- Google Analytics (through Google Tag Manager) — website analytics, only with your consent
- Microsoft Clarity — website heatmaps and session recordings, only with your consent
- Upstash — abuse protection; Inngest — background tasks; ImprovMX — email forwarding
For guests' data that we process for restaurants, see our Data Processing Terms.
How long we keep data
- Account data: while your account is open, and deleted within 30 days after you close it.
- Orders, feedback and customer lists: kept for the restaurant's records and deleted when the restaurant's account is deleted.
- Messages you send us: up to 2 years, so we can follow up.
- Analytics: up to 2 years, in the analytics tools.
- Backups: encrypted nightly backups are kept for a short period and then overwritten.
- Invoices and payment records: as long as tax law requires.
Your rights
Under the PDPL you can ask to know how we use your data, access it, correct it, delete it, get a copy of it, and withdraw consent you gave. You can also complain to the Saudi Data & AI Authority (SDAIA). Guests can also contact the restaurant directly. Email hello@restumenu.com and we will reply within the time the law requires.
Cookies
We use necessary cookies to remember your language, keep you signed in and remember a referral link for 60 days. Analytics and marketing cookies are only used if you switch them on. See our Cookie Policy, and change your choice anytime with Cookie settings at the bottom of every page.
Security
We use encrypted connections, access controls, two-factor sign-in for our staff, nightly encrypted backups and separation between restaurants' data. More on our Security page.
Children
Restu Menu is for businesses. We do not knowingly collect data from children.
Changes to this policy
We will post any changes on this page and update the date above.
Contact
Questions about privacy: hello@restumenu.com.