Privacy Policy

1. Who is responsible

The data controller is CRISTALLPONT S.R.L., P.IVA 05863730650, registered office at Traversa Dragone 2, 84010 Atrani (SA), Italy. For privacy questions or to exercise your rights, write to support@menu.band.

2. Data we process

The data depends on how you interact with menu.band. We minimise it to what is needed for the relevant purpose.

• Technical and security data: IP address, request time, requested URL, browser or device information, response status and security events.
• Essential preferences: language, consent choice and session information stored in the browser.
• Analytics data, only after consent: page views, approximate location derived from IP, referrer, device/browser characteristics and interactions with the marketing site.
• Information you submit: name, email, messages, restaurant/menu files, account information and the content you create in the service.
• Transaction and billing records where you purchase a plan. Full payment card details are handled by the payment provider and are not stored by menu.band.

3. Why and on what legal basis

We process data only where a valid legal basis applies.

• To serve pages, keep the service secure and prevent abuse: our legitimate interests in operating and protecting the service (GDPR Art. 6(1)(f)).
• To answer enquiries, provide requested access and perform the service: steps before a contract and performance of a contract (Art. 6(1)(b)).
• To keep invoices and comply with legal duties: compliance with law (Art. 6(1)(c)).
• To measure and improve the marketing site with Google Analytics: your consent (Art. 6(1)(a)). You may withdraw it at any time without affecting earlier lawful processing.

4. Google Analytics

Google Analytics 4 (measurement ID G-QLQ0V35NW6) is not loaded until you actively accept analytics. We use Google Consent Mode v2 in basic mode. Analytics storage is denied by default; advertising storage, ad user data and ad personalisation remain denied even after analytics consent.

When enabled, Google may set _ga cookies and process usage data as our service provider. IP anonymisation is enabled and Google Signals and advertising-personalisation signals are disabled. You can change the choice at any time from Privacy choices.

5. Who receives data

Authorised staff and suppliers receive only the access needed for their work. Suppliers can include infrastructure, email, payment, image-processing and support providers. Google Ireland Limited acts as a provider for Analytics only after consent. We do not sell personal data and do not use the marketing-site analytics for advertising profiles.

6. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where this occurs, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, or another safeguard permitted by the GDPR, together with supplementary measures where appropriate.

7. How long we keep it

We keep data only as long as necessary for its purpose.

• Consent records: up to 6 months, then we ask again.
• Routine security and access logs: normally up to 30 days, longer only for an incident or legal need.
• Marketing enquiries: up to 24 months after the last meaningful contact.
• Account and menu data: while the account is active and for a limited period needed for backup, recovery or legal claims after closure.
• Invoices and accounting records: for the period required by Italian law, generally 10 years.
• Google Analytics event-level data: no longer than 14 months under our intended property settings; aggregated reports may remain longer.

8. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time. You also have the right to complain to the Garante per la protezione dei dati personali or the supervisory authority where you live or work.

Send a request to support@menu.band. We may need enough information to verify identity before acting.

9. Children and automated decisions

menu.band is a business service for restaurant operators and is not directed to children. We do not use website visitor data for decisions that produce legal or similarly significant effects.

10. Changes to this notice

We may update this notice when the product, providers or law changes. The current version and its effective date are always published here. Material changes affecting account holders will be communicated through an appropriate channel.