Cookie Policy
Effective date: September 22, 2026.
1. What cookies and similar technologies are
Cookies are small data files stored on a device by a website. Similar technologies can include local storage, pixels, tags, scripts, device identifiers and other technologies that store or access information on a device. MenuXYZ may use these technologies when necessary to operate the site, protect security, remember preferences, measure performance or support other functions.
2. Necessary technologies
Some technologies may be strictly necessary to provide a service requested by the user, maintain a session, protect against abuse, remember a security setting or support basic website functionality. Depending on jurisdiction, strictly necessary technologies may be used without consent. MenuXYZ should limit these technologies to what is reasonably necessary for the stated purpose.
3. Analytics and measurement
Analytics tools can help a website understand page performance, traffic sources, errors and general usage patterns. If MenuXYZ uses analytics that involve non-essential storage or access, consent may be required in some jurisdictions. Analytics providers may process information under their own terms. MenuXYZ should configure such tools to minimize unnecessary personal data and honor applicable consent signals.
4. Advertising and marketing technologies
If advertising, remarketing or similar technologies are used, additional disclosure and consent obligations may apply. Some U.S. state privacy laws regulate targeted advertising or the sharing of personal information. European and UK rules can impose consent requirements for non-essential cookies and similar technologies. MenuXYZ should not activate such technologies before obtaining required consent.
5. United States considerations
U.S. cookie regulation is not governed by one single comprehensive federal cookie statute. Instead, requirements can arise from consumer-protection law, state privacy laws, sector-specific rules, contractual commitments and the actual data practices. California privacy law can provide rights related to certain sharing or use of personal information, while other states may impose different requirements.
The Federal Trade Commission can take action against unfair or deceptive privacy and data-security practices. Accordingly, MenuXYZ should describe its actual cookie practices accurately and avoid promises it cannot keep.
6. European Union considerations
When the GDPR and ePrivacy rules apply, non-essential cookies and similar technologies generally require appropriate information and consent unless an exception applies. Consent should be freely given, specific, informed and unambiguous, and users should be able to withdraw consent as required.
The GDPR also requires transparency about processing, purpose limitation, data minimization, storage limitation, integrity and confidentiality, and accountability. If cookies collect personal data, the privacy notice should explain the relevant processing.
7. United Kingdom considerations
In the United Kingdom, PECR can apply to cookies and similar technologies. ICO guidance states that users should be told about storage and access technologies and, in general, consent should be obtained before non-exempt technologies are used. The UK GDPR may also apply when personal data is processed.
MenuXYZ should keep cookie notices clear, accessible and understandable. A user should not have to search through a long legal document to find the essential cookie choices. The consent mechanism should not pre-enable non-exempt technologies where the law prohibits that practice.
8. Cookie categories
MenuXYZ may organize technologies into categories such as necessary, preferences, analytics and marketing. The exact categories should match the technologies actually deployed. A category should not be used to hide multiple unrelated purposes. Third-party technologies should be identified where appropriate.
9. Third-party cookies
Third parties may set or access cookies when their services are embedded or linked. Examples can include analytics, maps, social media, video, support systems and advertising. MenuXYZ does not have legal control over independent third-party services. Those providers may have their own cookies, privacy notices and consent systems.
Where a user leaves MenuXYZ and visits a third-party website, the third party's rules govern that environment. Users should review the third party's information before continuing.
10. Consent choices
Where a consent mechanism is provided, users should be able to accept or reject non-essential categories without being forced to accept unnecessary tracking to use a basic menu page. Consent should be recorded where appropriate, and users should be able to change their choices where required.
11. Browser controls
Most browsers allow users to block or delete cookies. Blocking necessary cookies may cause some website functions to stop working. Browser settings do not always provide the same granular choices as a consent management tool, particularly for third-party technologies.
12. Retention
Cookies and similar technologies should not remain active longer than reasonably necessary for their purpose. Session technologies may expire when a session ends, while persistent technologies may remain for a defined period. MenuXYZ should review durations periodically and remove technologies that are no longer needed.
13. Do Not Track and privacy signals
Some browsers and devices provide privacy signals. Whether a particular signal creates a legal obligation depends on the applicable law and the technology being used. MenuXYZ should evaluate legally recognized signals and configure privacy tools accordingly where required.
14. Changes to this policy
Cookie technology changes over time. If MenuXYZ adds new tools, changes providers or changes the purposes of cookies, this policy and the consent experience may need to be updated. The effective date should be revised when a material change occurs.
15. Contact
Questions about cookies can be sent through the Contact MenuXYZ page. When contacting us, please describe the page and issue without sending unnecessary sensitive information.
16. Important implementation note
This document describes a framework rather than a promise that every possible cookie is currently installed or that every jurisdiction's consent standard is identical. The actual cookie inventory should be reviewed periodically. A technical scan alone is not enough; MenuXYZ should identify what each technology does, who receives the data, how long it lasts and what legal basis or consent requirement applies.
17. How cookie choices should be presented
A useful consent experience should be understandable before a person makes a choice. The user should be told which categories are necessary, which are optional, what the optional technologies do, whether third parties receive information, and how long the technologies may remain active. Buttons should not be designed to trick the user into accepting optional tracking. If a law requires a separate choice for different purposes, the interface should provide that choice.
18. Consent records
Where consent is legally required, MenuXYZ should maintain a reasonable record of the consent event, including the version of the notice or preference configuration, the time of the choice and the categories selected. The record should be retained only as long as reasonably necessary to demonstrate compliance or manage disputes. Consent should not be treated as permanent if the purposes or technologies materially change.
19. Withdrawal and changing preferences
Where a user can consent to non-essential technologies, the user should have a practical method to withdraw or change that choice. Withdrawal should be as easy as giving consent. Depending on the website implementation, this may be a privacy settings link, cookie preference control or another clearly identified method.
20. Storage technologies beyond cookies
Cookie rules may apply to more than traditional cookies. Local storage, pixels, device fingerprinting, scripts, tags, link decoration and similar technologies may fall within applicable electronic-communications rules. MenuXYZ therefore should periodically review the actual scripts and integrations used by the website rather than assuming that a cookie scan identifies every technology.
21. Third-party scripts
Third-party scripts can create additional privacy and security considerations. A script may send information to a provider even if the visible webpage does not appear to collect personal information. Before adding an analytics, advertising, chat, video, map or social-media script, MenuXYZ should identify what the script does, what data it receives and whether user consent is required.
22. Children's privacy
If a technology is used in a way that collects information from children, additional requirements may apply, including COPPA in the United States for certain online services directed to children or knowingly collecting information from children under 13. MenuXYZ is not designed as a child-directed service. If a future feature changes that status, the privacy and consent framework should be reviewed before launch.
23. Performance and accessibility
Cookie and consent banners should themselves be usable. They should be readable on mobile devices, navigable by keyboard and compatible with assistive technology to the extent reasonably possible. A privacy choice should not create a barrier that prevents a person with a disability from accessing essential menu information.
24. Periodic review
Cookie inventories can become inaccurate when website plugins, analytics tools, advertising providers or embedded services change. MenuXYZ should periodically scan and manually review the site, compare actual scripts with the policy, remove unnecessary technologies and update the consent mechanism when needed. A current inventory is more useful than a generic list that does not reflect the live site.
25. Consent and legitimate interest are not interchangeable
A website should not describe an optional tracking technology as “necessary” simply because it is useful to the business. The correct classification depends on what the technology actually does and the law that applies. Where prior consent is required, MenuXYZ should obtain it before activating the relevant technology. Where a lawful exception applies, the website should still provide the information required by the applicable privacy framework.
26. Cookie policy accuracy
The Cookie Policy should match the actual website. If a provider is removed, the policy should eventually be updated. If a new provider is added, the privacy team or website administrator should identify the technology, purpose, provider, duration and whether personal information is involved. This process is especially important when website plugins are installed by different people over time.
27. Third-party embedded content
Maps, videos, social posts, booking widgets and support tools can create third-party requests even when a visitor does not actively click a link. Depending on the technology and jurisdiction, those requests may involve cookies or other identifiers. MenuXYZ should evaluate whether an embed should load immediately or only after the user makes an appropriate choice.
28. Privacy-friendly defaults
Privacy-friendly design generally means limiting optional tracking, avoiding unnecessary identifiers and choosing settings that do not collect more information than needed. MenuXYZ may prefer aggregated or de-identified measurements where they can answer the business question without identifying individual visitors. Technical implementation should be reviewed to confirm that the chosen settings actually provide the intended privacy benefit.
29. Future technology
Technology can change faster than policy documents. New forms of analytics, artificial intelligence, advertising identifiers or browser storage may create different legal questions. MenuXYZ should treat this policy as a living document and review it before launching a new tracking or personalization feature.
30. Consent interfaces and equal access
Cookie preference tools should not prevent a visitor from reaching basic restaurant menu information simply because the visitor declines optional technologies. Where possible, essential content should remain available without unnecessary tracking. Preference controls should use readable text, clear labels and keyboard-accessible controls so that people using assistive technologies can understand and manage their choices.
31. Review after website changes
Whenever MenuXYZ changes analytics, advertising, embedded content, forms or support software, the cookie inventory should be reviewed. A small change to a plugin can introduce a new script or identifier. Reviewing the live website after changes helps keep this policy aligned with actual behavior.
Last reviewed: September 22, 2026. Because laws and technologies change, MenuXYZ should review this document periodically with qualified counsel.
Google Maps Platform
The MenuXYZ restaurant-finder feature uses Google Maps Platform technology. Loading the map and searching for places can involve requests to Google and may involve technical information, browser information, search terms and location information. Google’s own terms, privacy practices and service policies apply to Google services. Visitors may decline browser location permission and use text-based restaurant searches instead.