Who processes your data

The data controller is Adrenalina Marketing srl (referente: Antonino Melardi). For any question or request about your data, write to analytics@ewebite.it.

In short

• You can read menus without an account and without giving us personal data.
• Menu photos and PDFs are only used for reading: we don't keep them.
• We save allergies, intolerances and diets only with a separate consent, encrypted, and never use them for advertising.
• We only send menu content to the artificial intelligence, never your data.
• We don't sell data and we don't use profiling cookies.

The menus you read

When you read a menu from a link, a QR code, photos, a PDF or pasted text, its content is read by our artificial intelligence service. We keep the result (dishes, prices, ingredients, allergens) so that whoever reads the same menu finds it right away, without reading it again: this is why a menu you read can also be found by other users. A venue's menu is not personal data and we don't link it to you.

We don't keep photos and PDFs: we only keep a fingerprint (a code calculated from the file) to recognise the same menu. Photograph only the menu, without people.

Legal basis: performing the service you request (Art. 6(1)(b) GDPR).

What stays on your phone

Without an account, the allergens you choose, your recently read menus and the dishes you add to your selection stay in your phone's browser storage: they don't reach us. You can delete them from your browser settings or from the app.

Account and profile

An account is optional. If you sign in, we process your email (to send you the sign-in link, valid for 15 minutes), your session (60 days) and the profile data you choose: menu language, country and city.

With an account we also remember the menus you read (the venue, the number of items, the date, at most the last 50), so you find them on every device; those read on the phone before signing in are added to your account. You can remove them from the list whenever you like.

Legal basis: performing the service (Art. 6(1)(b) GDPR).

Allergies, intolerances and diets

Allergies, intolerances, their severity, diets (including religious ones) and aversions are special categories of data (Art. 9 GDPR). We save them in your profile only with your explicit and separate consent (Art. 9(2)(a)), which we record with the date and the version of the text.

They are used only to highlight dishes in the menus you open. We encrypt them with a key kept separate from the database, we don't send them to the artificial intelligence, we don't use them for advertising and we don't share them with anyone, not even with venues.

You can withdraw your consent at any time from your profile: the data is deleted immediately.

Error reports

If you report an error on a dish, we receive the type of error, the note you write (optional) and what you were seeing of that dish. The report is anonymous and never contains your allergens. Legal basis: our legitimate interest in correcting menus (Art. 6(1)(f)).

Usage statistics

We count some events anonymously (for example "menu read", "dish opened", "venue page opened", with the language), without accounts, device identifiers or IP addresses. They help us understand whether Mentu works and are not personal data.

Security and abuse limits

We record the app's technical errors (the error message, the page without parameters, the app version), without personal data or IP addresses, to fix them; an error that does not happen again disappears after 30 days.

To prevent abuse we limit the number of new menus read per hour and per day: with an account, per account; without an account you can read one per browser, and a few from the same network. This is why, if you use Mentu without an account, your IP address stays in the server's memory for a little over a day at most, without being saved. The server's technical logs are deleted on rotation within a few days. Legal basis: our legitimate interest in the security of the service (Art. 6(1)(f)).

Cookies and browser storage

We only use technical tools: the session cookie (to keep you signed in), the language cookie (one year), the text size cookie (one year), the cookie for the read without an account (one year: it only says that the new menu without an account has already been read from that browser, with no identifiers) and browser storage for the things described above. No profiling or third-party cookies: this is why we don't ask you for cookie consent.

Who helps us

We rely on a few providers, appointed as data processors and chosen with adequate safeguards:

• DigitalOcean: servers and database in Frankfurt (European Union).
• Anthropic: the artificial intelligence service that reads menus (United States). It only receives menu content, never your account or health data.
• Resend: sending sign-in emails (United States). It only receives your email address.
• Transfers outside the European Union rely on the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

Partner venues

A partner venue's QR code opens its menu on Mentu. The venue doesn't receive your data: at most it will see anonymous, aggregated statistics, such as the number of visits and the languages.

How long we keep data

• Account and profile: until you delete your account.
• Menus read with an account: until you remove them from the list or delete the account.
• Allergies, intolerances and diets: until you withdraw consent or delete your account.
• Menu photos and PDFs: not kept.
• Error reports: as long as needed to correct the menu, at most two years.
• Database backups: 14 days; after that, what you deleted disappears from them too.

Your rights

You can request access to your data, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. From your profile you can export your data, withdraw consent and delete your account on your own. For anything else, write to analytics@ewebite.it. If you believe your data is mishandled, you can contact the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Minors

Mentu is not meant for people under 14: below this age a parent is needed.

Changes

We publish every new version here with its date. If a change concerns the consent on health data, we'll ask you again.