Privacy Policy

1. Who we are

This privacy policy applies to food business websites built and maintained by JBIXI trading as MenuByte, a sole trader registered in the UK. The data controller for the processing described below is:

We are registered with the Information Commissioner's Office (ICO) under registration number [ICO Registration Number: pending].

Each food business website is operated on behalf of the individual client business named on that site. For questions about how a specific food business handles your data, please contact that business directly using the contact details on their website.

2. What data we collect and why

Table enquiry form

When you submit a table enquiry we collect: your name, phone number, preferred date and time, party size, and any special requests you provide. This information is used solely to respond to your enquiry and confirm your booking. It is transmitted securely to our own server (Cloudflare Workers) and forwarded by email to the restaurant via Resend, our email delivery provider.

Online orders (Pro plan restaurants)

If you place an order through a restaurant's website, your name, delivery address, and email address are collected and stored securely in our order database (Cloudflare D1). Payment is processed directly by Stripe — we do not store your card details at any point. Please review Stripe's privacy policy for full details.

Order alert contacts (restaurants on our Pro plan)

This subsection is for restaurant owners and their staff, not for people ordering food. Where a restaurant asks us to, we hold the mobile or landline numbers they give us so we can alert them when a paid order has not been accepted on their orders screen. We send those alerts by text message and, if the order is still unaccepted, by an automated voice call, using Twilio as our messaging provider.

Our lawful basis is performance of a contract — the alerts are part of the service the restaurant has asked us to provide. This is not marketing, and the numbers are never used for marketing or shared with anyone else.

The alerts contain no information about the customer who placed the order. They carry only the restaurant's own name and how long the order has been waiting, deliberately, so that no diner's name, address or order details ever reach our messaging provider. Restaurants can change their alert numbers or turn the alerts off at any time by contacting us.

Analytics

Restaurants that have opted in to analytics use Google Analytics to measure visitor numbers and behaviour. Google Analytics uses cookies to collect anonymised data about your visit. No personally identifiable information is collected through analytics. You can opt out via Google's opt-out tool.

Cookies

This site uses the following cookies:

• Cart (localStorage) — used to maintain your shopping cart across page views (Pro plan restaurants only; stored in your browser's localStorage, expires after 2 hours)
• Google Analytics cookies — used to measure site usage (restaurants with analytics enabled only)

No marketing or tracking cookies are set by us.

3. If you run a food business we have contacted

This section is for restaurant, takeaway and cafe owners — not for people ordering food. It explains data we hold that we did not get from you.

What we hold and where it came from

To find businesses that might want a MenuByte website, we compile a list of food businesses in a given town from publicly available sources, principally Google Maps business listings. For each business we may hold: the business name, its trading address, a publicly listed phone number, its website address, its public rating and review count, and a link to its listing. We also record our own sales notes — whether we have called or visited, what was said, and when to follow up.

Where a business is a sole trader or a partnership, this information can count as personal data about you, which is why this section exists.

Why we are allowed to do this

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — specifically, contacting food businesses about a service directly relevant to how they trade. We have weighed this against your interests: the data is limited to business contact details already published by you, we contact you in a business capacity only, and we stop immediately on request.

We contact businesses by post, by visiting in person, and — only after you have spoken to us or asked us to — by WhatsApp or phone. We do not send unsolicited marketing email or unsolicited WhatsApp messages to businesses we have never spoken to.

Your right to object

You can tell us to stop at any time, and we will — this is an absolute right where data is used for direct marketing. Email hello@menubyte.co.uk or message +44 7517 826279 and say you do not want to be contacted.

When you object we mark your record do not contact and never approach you again on any channel. We keep the minimum record needed to enforce that — your business name and listing reference — because deleting it entirely would mean our next search of your town simply found you again. If you would rather we erased the record completely, say so and we will, and we will explain that we may then re-collect it in future without knowing you had objected.

How long we keep it

Prospect records are reviewed periodically and deleted when a business is no longer a realistic prospect, other than the suppression records described above, which we keep for as long as we operate.

4. Who we share your data with

We use the following third-party services that may process personal data:

• Resend — delivers transactional emails (order confirmations, table enquiries). Privacy policy
• Stripe — processes online payments. Privacy policy
• Google Analytics — anonymised website usage analytics. Privacy policy
• Cloudflare — website hosting and DNS. Access logs may be retained for a limited period. Privacy policy
• Twilio — sends order alerts by text message and automated voice call to restaurant owners who have asked for them. Receives only the alert phone number and the restaurant's own name; no customer or order details. Privacy policy

We do not sell, rent, or share your personal data with any other third parties.

5. How long we keep your data

• Table enquiry emails — retained in the restaurant's email inbox. We recommend restaurants delete these after 6 months.
• Order records — retained in our order database for up to 2 years for accounting purposes.
• Analytics data — retained by Google for up to 14 months (default GA4 setting).
• Order alert contacts — held for as long as the restaurant is a client and asks us to alert them, and removed when they stop or ask us to. Records of alerts sent are kept alongside the order they relate to, for the same period.

6. Your rights (UK GDPR)

Under UK data protection law you have the right to:

• Request a copy of the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data ("right to be forgotten")
• Object to processing of your data
• Request restriction of processing

To exercise any of these rights, email hello@menubyte.co.uk. We will respond within 7 working days.

If you are unsatisfied with how we handle your request, you can complain to the Information Commissioner's Office (ICO).

7. Security

All data is transmitted over HTTPS. We do not store payment card details. Access to restaurant email inboxes and order management systems is restricted to the restaurant owner and MenuByte staff.

8. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of the site after changes constitutes acceptance of the updated policy.

9. Contact

For any privacy-related questions: