Privacy Policy
Effective date: September 22, 2026.
1. Scope and commitment
MenuXYZ respects the privacy of people who visit the website, browse restaurant listings, submit menu information, contact us, use support resources or otherwise interact with MenuXYZ. This Privacy Policy explains the categories of information we may collect, why we may use it, when we may disclose it, how we protect it, how long we may keep it, and the choices that may be available to individuals. The policy is intended to be understandable to users in the United States and, where applicable, to individuals in other jurisdictions.
Privacy obligations vary by jurisdiction. In the United States, federal and state laws can apply depending on the information and activity involved. California has comprehensive privacy requirements under the California Consumer Privacy Act as amended by the California Privacy Rights Act and implementing regulations. Other U.S. states may impose additional rights or obligations. For people in the European Economic Area, the General Data Protection Regulation may apply when its territorial requirements are met. For people in the United Kingdom, the UK GDPR and related electronic-communications rules may apply. This policy describes our intended practices but does not expand or limit rights that cannot lawfully be waived.
2. Information we may collect
We may collect information that a visitor voluntarily provides, such as name, email address, restaurant name, menu details, messages, corrections, service inquiries and other information included in a submission. We may also receive technical information automatically, such as IP address, browser type, operating system, device information, referring page, approximate location derived from network information, timestamps, pages viewed and diagnostic information. The exact data collected depends on the features actually enabled on the website.
Restaurants may provide menu files, photographs, logos, descriptions, prices, hours, location information and other business information. Restaurant owners are responsible for ensuring that they have appropriate rights to provide those materials and that they do not knowingly submit another person's confidential or unlawful information.
3. How we use information
We may use information to operate, maintain and secure MenuXYZ; respond to inquiries; process menu submissions; review or moderate content; publish restaurant and menu information; provide requested services; communicate about service requests; prevent abuse, fraud or security incidents; improve website performance; understand how visitors use the website; comply with legal obligations; enforce agreements; and protect rights, safety and property.
We aim to follow data-minimization principles. We do not intend to collect personal information simply because it is available. When a field is not necessary for a particular function, we may not request it. If we use analytics or similar technologies, the purpose should be limited to legitimate operational, measurement or improvement needs, subject to applicable consent requirements.
4. Legal bases where GDPR or similar laws apply
Where the GDPR or another law requires a legal basis, the appropriate basis may include performance of a contract or steps requested before a contract, compliance with a legal obligation, legitimate interests that are not overridden by an individual's rights, consent, or another basis recognized by applicable law. The basis depends on the activity. For example, responding to a service request may rely on steps requested by the individual, while certain non-essential analytics may require consent.
Individuals in jurisdictions that provide data-subject rights may have rights to access, correction, deletion, restriction, objection, portability or withdrawal of consent, subject to lawful exceptions. A person may also have a right to complain to a supervisory authority where applicable.
5. California privacy considerations
California law may provide qualifying consumers with rights relating to personal information, including rights to know or access certain information, delete information, correct inaccurate information, opt out of certain sales or sharing, limit certain uses of sensitive personal information where applicable, and avoid unlawful discrimination for exercising privacy rights. The availability and scope of each right depends on whether MenuXYZ is a covered business, the nature of the request, the information involved and applicable exemptions.
MenuXYZ should not represent that every CCPA or CPRA right applies to every visitor. When a request is received, we may need to verify the requester's identity and determine which legal rules apply. We may not be able to fulfill a request when an exception or legal requirement permits or requires us to retain or use the information.
6. International users and transfers
MenuXYZ may use service providers located in countries different from the visitor's country. Where personal information is transferred internationally, applicable laws may require specific safeguards, contractual protections, consent, adequacy mechanisms or other legal measures. We may use third-party hosting, email, analytics, security, support, form, storage and other providers as needed to operate the website.
Individuals in the EEA or United Kingdom should understand that their information may be processed outside their jurisdiction. Where applicable, MenuXYZ intends to use legally recognized transfer mechanisms and reasonable safeguards. Users should review the privacy terms of third-party services when they are redirected away from MenuXYZ.
7. Third-party services
The website may contain links, integrations or embedded features provided by third parties. Examples can include support systems, maps, social media, analytics, hosting, ordering, payment, reservation, communications and other services. Third parties operate under their own terms and privacy policies. MenuXYZ does not have legal control over independent third-party services and cannot guarantee their privacy practices.
When a customer follows a third-party link or submits information directly to a third-party provider, the third party may collect information under its own policies. Restaurants are responsible for reviewing the third-party services they choose to use and for providing any additional notices required by law.
8. Cookies and similar technologies
MenuXYZ may use cookies, local storage, pixels, scripts or similar technologies for necessary website functions, security, preferences, analytics or other purposes. Non-essential technologies may require consent depending on jurisdiction. Our Cookie Policy explains these technologies in more detail.
UK PECR and European privacy rules can impose requirements for cookies and similar technologies. The general principle is that users should receive clear information and, where required, provide valid consent before non-exempt technologies are used. The precise implementation must match the actual technologies deployed on the website.
9. Security
MenuXYZ uses reasonable administrative, technical and organizational measures appropriate to the nature of the information and risks. Measures may include access controls, secure connections, limited administrative access, software maintenance, monitoring, backups and security reviews. No online system can be guaranteed completely secure. Users should avoid submitting sensitive information that is not necessary for the requested service.
If a security incident occurs, notification obligations may depend on the information affected, the jurisdictions involved, contractual requirements and the facts of the incident. MenuXYZ will evaluate incidents and take steps required by applicable law.
10. Data retention
We retain information for as long as reasonably necessary for the purpose for which it was collected, to provide services, maintain records, resolve disputes, enforce agreements, prevent abuse, comply with legal requirements or protect legitimate interests. Retention periods can differ by data type. Menu submissions may remain available while the associated listing is active, while technical logs may be retained for shorter or longer periods based on security and operational needs.
11. Children
MenuXYZ is not directed at children for the purpose of collecting personal information. We do not knowingly request personal information from children where prohibited by law. If a parent or guardian believes a child has provided personal information improperly, they may contact MenuXYZ so the situation can be reviewed.
12. Marketing communications
If MenuXYZ sends commercial email, applicable requirements may include the CAN-SPAM Act in the United States and other anti-spam rules in relevant jurisdictions. Commercial messages should use accurate sender information, truthful subject lines, appropriate identification, a valid physical mailing address where required and a functional opt-out method. Consent may also be required by laws outside the United States.
13. Your choices
Depending on the applicable law, you may be able to request access, correction, deletion, restriction, objection, portability or withdrawal of consent. You may also control certain browser settings, cookie choices or marketing preferences. Requests should include enough information to identify the relevant interaction without sending unnecessary sensitive information.
14. Restaurant content and public information
Restaurant names, menu items, prices, photographs, addresses and similar information may be published because the restaurant or another authorized party provides it for directory purposes. Public business information is not necessarily personal information, but a business owner should still avoid submitting private residential details or personal information that is not needed.
15. Changes to this policy
MenuXYZ may update this Privacy Policy when its services, technology or legal requirements change. The effective date will be updated when a material revision is published. If a change requires additional notice or consent, MenuXYZ intends to provide it as required by applicable law.
16. Contact and complaints
Privacy questions, requests and concerns can be submitted through the Contact MenuXYZ page. Where a law provides a right to contact a data protection authority, individuals may do so. A complaint to an authority does not remove other rights or remedies provided by law.
17. Regulatory reference framework
This policy is designed with awareness of common requirements including the FTC Act's consumer-protection principles, California privacy requirements under the CCPA/CPRA and regulations, U.S. data-breach and communications requirements that may apply to specific activities, the GDPR, and UK data-protection and electronic-communications rules. These references are informational and do not mean every law applies to every user or activity.
For current requirements, users and businesses should consult official regulators and qualified legal counsel. MenuXYZ does not promise that this template alone satisfies every jurisdiction-specific requirement.
18. Data quality and user-provided information
People who submit information should provide information that is reasonably accurate and should correct it when it changes. Restaurant owners should pay particular attention to business contact details because inaccurate information can affect customers and can create privacy or consumer-protection concerns. If a restaurant submits a personal phone number, home address or personal email address instead of a business contact, the restaurant should understand that the information may be displayed as part of the public listing. MenuXYZ may request clarification or remove information that appears unnecessary or unsafe to publish.
MenuXYZ may receive information indirectly through a third party. When information is obtained from another source, applicable privacy law may require different notices or additional disclosures. Where those rules apply, MenuXYZ intends to provide the information required by law about the source, purpose, legal basis and rights. Users should understand that public business information can be copied or indexed by independent search engines and other services outside MenuXYZ's control.
19. Requests involving another person's information
A privacy request may concern information about a different person. MenuXYZ may need to determine whether the requester has authority to make the request. For example, a restaurant manager may request changes to a restaurant listing, while a person may request access to their own contact information. We may ask for reasonable verification and may reject requests that would improperly disclose another person's information.
Verification should not require the requester to provide more information than is reasonably necessary. MenuXYZ may use information already associated with the relevant request, account or business to verify identity. If additional information is requested, it should be limited to what is necessary for the legal and security purpose.
20. Deletion and archival limitations
Deletion does not necessarily mean that every copy can be erased immediately. Information may exist in backups, security logs, fraud-prevention records, legal records or third-party systems. Where law permits retention, MenuXYZ may retain information for those purposes and isolate it from ordinary use. Third parties may have their own retention schedules and must be contacted directly where they are the controller of the relevant information.
When a restaurant asks for a listing to be removed, MenuXYZ may remove the public listing while retaining limited records needed to document the request, comply with legal obligations, prevent abuse or resolve disputes. Public removal also cannot control copies that other websites, search engines or users have independently created.
21. Data protection by design
MenuXYZ intends to consider privacy when new features are designed. This can include collecting fewer fields, using role-based access, limiting administrative privileges, separating public business information from private communications, using secure connections and reviewing third-party integrations before deployment. Where a processing activity creates a high risk under applicable law, a formal assessment may be appropriate.
Privacy by design does not mean that a website can guarantee zero risk. It means that privacy and security are considered as part of the design process rather than added after a feature is launched.
22. Automated tools and analytics
If MenuXYZ uses automated tools for spam detection, security monitoring, content organization, search, analytics or other operational purposes, the tool may process technical or user-provided information. Where automated decision-making creates legal or similarly significant effects and a law applies, MenuXYZ should provide the notices and rights required by that law. Ordinary website security filtering should not be described as a form of legally significant automated decision-making unless it actually is.
23. Business transfers and corporate changes
If MenuXYZ is involved in a merger, acquisition, financing, reorganization, asset sale or similar transaction, information may be transferred as part of that transaction subject to applicable law and contractual protections. Any successor would be expected to honor applicable privacy commitments or provide legally required notice before materially changing how information is used.
24. Supervisory authorities and regional rights
Where the GDPR, UK GDPR or another privacy regime applies, individuals may have the right to contact a competent data protection authority. The relevant authority depends on the person's location and the nature of the processing. Nothing in this policy prevents a person from exercising a statutory right or filing a lawful complaint.
Last reviewed: September 22, 2026. Because laws and technologies change, MenuXYZ should review this document periodically with qualified counsel.
Google Maps and Restaurant Search
MenuXYZ provides a restaurant-finder feature using Google Maps Platform services. When a visitor uses the map, searches for restaurants, requests nearby results or uses the location feature, the browser may communicate with Google and Google may process technical information, search terms and location information as described in Google’s applicable policies and terms. MenuXYZ may display restaurant names, addresses, map locations and other information supplied by Google or other third parties. MenuXYZ does not control the information maintained by those third parties.
Visitors can choose whether to allow browser location access. If location access is denied, the restaurant finder can still be used by searching for a city, ZIP code, restaurant name or cuisine. Third-party map and place information may change without notice.