Esta página está em inglês. A versão em inglês é a que vale.
Privacy policy
We collect as little as we can: your email address and a password hash when you publish, the menus you make, and visit counts without cookies. We don’t sell data, show ads or use tracking cookies.
Last updated
Who we are
Tablemenu.Link (tablemenu.link) is a free digital menu maker for restaurants, cafés, bars and food trucks. In this policy, “we” and “us” mean the team that runs Tablemenu.Link. We decide how your data is used, and you can reach us about it at hello@tablemenu.link.
What we collect
When you create an account
- Your email address. It is how you log in, and how we know a message really comes from you (for example when you ask for a password reset). We email you only to reply to you, or when something affects your account or menus, for example before we act on a menu that breaks our terms. We don’t send newsletters or marketing email.
- Your password, as a scrypt hash only. A hash is a one-way scramble: we never store or see your password, and we can’t recover it for you.
- When your account was created and when you last logged in.
Your menus
- Everything you type into a menu (its name, dishes, prices, opening hours, address, phone number and so on) and its link (username). Links you renamed are kept so printed QR codes keep working.
- A published menu is a public web page. Anyone with the link can open it, and search engines may index it. Don’t put private information on a menu.
- Logos and dish photos are public files. They are stored in Cloudflare R2 and served directly from there, so anyone with an image’s address can open it. Don’t upload anything private.
While you build a menu
- Your draft is saved in your own browser (local storage) so it survives a reload. It is sent to us only when you publish.
- Photos you add are uploaded straight away. If they never end up on a published menu, we delete them after 14 days.
- Your browser also remembers the menus you opened there with an edit link (the “My menus” list). That list stays on your device.
To keep the service safe
- To stop abuse, such as password guessing or mass sign-ups, we keep short-lived counters keyed by your IP address (or its network range), by a hash of the email address you log in with, or by your account or menu. Each one counts for 15 minutes to a day. After that it is no longer used, and an automatic clean-up deletes it. The clean-up runs as people use the service, so this can take a while.
- Like every website, our hosting providers, Vercel and Cloudflare, see your IP address and browser details while they deliver pages and protect the service from attacks. They handle that data under their own privacy policies. We don’t keep IP addresses in our database apart from the counters above.
Visit counts without cookies
We count visits to this website and to menus with our own small script on Cloudflare, not a third-party analytics service. It sets no cookies and stores no IP addresses. For each visit it records the page (or the menu’s link), the domain of the website that sent you, your country (as Cloudflare reports it), a device type based on screen width, and a few events such as “menu published”.
To count each visitor once a day, it combines your IP address and browser details with a secret that changes every day and keeps only the scrambled result (a hash). The hashes can’t be turned back into an IP address and are deleted after 35 days.
If your browser sends a Do Not Track or Global Privacy Control signal, or looks like a bot, the visit isn’t counted at all. Visits from automated tools (such as test browsers) and from data-centre and cloud networks aren’t counted either, and our team can switch counting off for their own browsers. Restaurant owners see these totals as approximate menu views in their dashboard. They never see who viewed a menu.
Why we use your data
- To run your account and publish your menus, because that is the service you signed up for (in GDPR terms, to perform our agreement with you).
- To keep the service secure and to count visits in total, because we need to (our legitimate interests). We keep this light: no cookies and no IP addresses in our analytics.
- To answer you when you write to us.
We don’t sell or rent your data, use it for advertising or build profiles of you.
Who else handles it
We use a small number of providers to run the service. They process data on our behalf:
- Cloudflare: our database (D1), image storage (R2), the visit-count script, and network security.
- Vercel: hosts this website and the app’s servers.
We share data with anyone else only when the law requires us to.
Where it is stored
Your account and menus are stored with Cloudflare, with the main copy of our database in the Asia-Pacific region. The website and app servers run on Vercel. Both providers run global networks, so your requests may be handled in other countries, including countries outside India and outside the European Economic Area.
How long we keep it
- Your account and menus: until you delete them.
- Login sessions: 30 days, or until you log out. Password reset links: 24 hours, and they work once.
- Photos that never reach a published menu: 14 days.
- Daily visitor hashes: 35 days. Daily visit totals, which contain no personal data, are kept.
- Abuse-prevention counters: they count for 15 minutes to a day, then an automatic clean-up deletes them.
- Emails you send us: as long as we need them to help you.
Deleting your data
- One menu: delete it in the editor. Its content and images are erased, and its link shows a “gone” page for good. The link is never given to anyone else.
- Your whole account: in your dashboard, under Delete account (you’ll need your password). This deletes every menu as above, your login sessions and your account record.
- Or ask us: email hello@tablemenu.link from your account’s address and we’ll delete it for you.
Copies of public images that browsers or caching networks have already saved can stay reachable for a while after deletion, and search engines may show an old result until they next visit.
Your rights
Wherever you live, you can ask us to tell you what data we hold about you and give you a copy, correct it, delete it, or stop using it for a purpose you object to. Email hello@tablemenu.link from your account’s address, so we can check it’s you. We aim to reply within 30 days.
- In India, these are your rights as a Data Principal under the Digital Personal Data Protection Act, 2023, including grievance redressal and nominating someone to act for you. Send grievances to hello@tablemenu.link. If you aren’t satisfied with our answer, you can complain to the Data Protection Board of India.
- In the European Union, the EEA or the UK, these are your rights under the GDPR (including data portability and restriction), and you can complain to your local data protection authority.
Security
Every connection uses HTTPS. Passwords are stored only as scrypt hashes, login cookies can’t be read by page scripts, and we keep only hashes of login and edit tokens. No system is perfectly secure, so use a password you don’t use anywhere else; a password manager makes that easy. If a breach ever affects your data, we will tell you and the authorities as the law requires.
Children
Tablemenu.Link is a tool for businesses. Accounts are for people aged 18 or over, and we don’t knowingly collect data from children.
Changes to this policy
When we change this policy, we update the date at the top of this page. If a change is significant, we will make it clear on the site before it applies.
Contact
Questions about your data or this policy: hello@tablemenu.link. See also our terms of use.