Privacy Policy

When you create an account: email, name (optional), and password (stored only as a cryptographic hash — never in plain text). When you set up your restaurant: name, public menu address (slug), description, country, WhatsApp number, social and delivery-app links, and the menu images you upload.

Payments are processed by Stripe. menulala never receives or stores card numbers — we keep only subscription identifiers (plan status and expiry).

When someone visits a public menu page we record view and click counts (for example on the WhatsApp button) together with the visitor's country, derived from the IP address. We do not store the IP address itself, and these counts do not identify the visitor.

We also use Vercel Analytics, an aggregate metrics tool that sets no cookies and does not track visitors across sites.

To provide the service (serving your menu, authenticating you, processing your subscription), to show you your own menu statistics, to send transactional email (password resets, payment notices), and to keep the platform secure. Legal bases: performance of contract and legitimate interest under the LGPD.

We use processors acting on our behalf: Vercel (hosting and analytics), Neon (database), Stripe (payments), and Resend (email delivery). These providers may process data on servers outside Brazil under their contractual safeguards. We never sell personal data.

We use essential cookies only: the session cookie that keeps you signed in to the dashboard and a language-preference cookie. No advertising or tracking cookies.

We keep your data for as long as your account exists. You can delete your account at any time from the dashboard ("Delete account" section) — this permanently removes your account, restaurant, menu images, and public page. Billing records may be retained by Stripe for tax purposes.

You may request confirmation of processing, access, correction, anonymization, portability, and deletion of your data, and information about sharing. To exercise any right, write to contato@menulala.com. We respond within the legally required period.

Passwords are stored with bcrypt hashing, traffic is encrypted with HTTPS, and database access is restricted. No system is infallible; in the event of a relevant security incident we will notify affected users and the Brazilian authority (ANPD) as required by law.

We may update this policy; the date above indicates the current version. Questions or requests: contato@menulala.com.