Privacy Policy

1. Who we are

This privacy policy applies to food business websites built and maintained by JBIXI trading as MenuByte, a sole trader registered in the UK. Each website is run for the restaurant named on it.

• If you order food or send a table enquiry, that restaurant is the data controller. It decides how your details are used. We process them on its behalf, as its data processor, only to run its website and ordering service. For anything about your order, contact the restaurant using the details on its site.
• We are the data controller only for our own business records: the restaurants we work with, people we contact about our services (section 3), the contacts restaurants give us for order alerts, and partners who introduce businesses to us (section 2).

Our details:

Each food business website is operated on behalf of the individual client business named on that site. For questions about how a specific food business handles your data, please contact that business directly using the contact details on their website.

2. What data we collect and why

Table enquiry form

When you submit a table enquiry we collect: your name, phone number, your email address if you give it, preferred date and time, party size, and any special requests you provide. This information is used solely to respond to your enquiry and confirm your booking. It is transmitted securely to our own server (Cloudflare Workers) and forwarded by email to the restaurant via Resend, our email delivery provider.

Online orders (Pro plan restaurants)

When you place an order, we collect your name, phone number and email address, your delivery address (for delivery orders), what you ordered, and any notes you add, including any about allergies or dietary needs. We also collect a table number if you order at your table. These are stored securely in our order database (Cloudflare D1) and shown to the restaurant so it can prepare and deliver your order. Payment is handled by Stripe; we never see or store your card details. Please review Stripe's privacy policy for full details.

Order alert contacts (restaurants on our Pro plan)

This subsection is for restaurant owners and their staff, not for people ordering food. Where a restaurant asks us to, we hold the mobile or landline numbers they give us so we can alert them when a paid order has not been accepted on their orders screen. We send those alerts by text message and, if the order is still unaccepted, by an automated voice call, using Twilio as our messaging provider.

Our lawful basis is performance of a contract — the alerts are part of the service the restaurant has asked us to provide. This is not marketing, and the numbers are never used for marketing or shared with anyone else.

The alerts contain no information about the customer who placed the order. They carry only the restaurant's own name and how long the order has been waiting, deliberately, so that no diner's name, address or order details ever reach our messaging provider. Restaurants can change their alert numbers or turn the alerts off at any time by contacting us.

Partners who introduce businesses to us

This subsection is for suppliers, reps and installers who introduce food businesses to us in return for an introduction fee. We hold your name, the company you work for, your phone or WhatsApp number, your email address if you give it, your partner code, which businesses signed up with your code, the bank details we need to pay you, your invoices or notes, and a record of what we told your employer.

Our lawful basis is performance of a contract (the partner terms, so that we can track introductions and pay you, including the steps you ask us to take before you join, such as telling your employer) and legal obligation (keeping payment records for tax). Because a payment to someone who works for another company must never be secret, we tell your employer that the arrangement exists, with your name, before we give you a code. A business you introduce is told that we pay introducers, but not your bank details. Your details are never used for marketing.

Analytics

Restaurants that have opted in to analytics use Google Analytics to measure visitor numbers and behaviour. Google Analytics uses cookies to collect anonymised data about your visit. No personally identifiable information is collected through analytics. You can opt out via Google's opt-out tool.

Cookies

This site uses the following cookies:

• Cart (localStorage) — used to maintain your shopping cart across page views (Pro plan restaurants only; stored in your browser's localStorage, expires after 2 hours)
• Google Analytics cookies — used to measure site usage (restaurants with analytics enabled only)
• Google Maps cookies — only if you tap "Show map" on a restaurant's page, Google may set its own cookies inside the map, under its own privacy policy

No marketing or tracking cookies are set by us.

3. If you run a food business we have contacted

This section is for restaurant, takeaway and cafe owners — not for people ordering food. It explains data we hold that we did not get from you.

What we hold and where it came from

To find businesses that might want a MenuByte website, we compile a list of food businesses in a given town from publicly available sources, principally Google Maps business listings. For each business we may hold: the business name, its trading address, a publicly listed phone number, its website address, its public rating and review count, and a link to its listing. We also record our own sales notes — whether we have called or visited, what was said, and when to follow up.

Where a business is a sole trader or a partnership, this information can count as personal data about you, which is why this section exists.

Why we are allowed to do this

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — specifically, contacting food businesses about a service directly relevant to how they trade. We have weighed this against your interests: the data is limited to business contact details already published by you, we contact you in a business capacity only, and we stop immediately on request.

We contact businesses by post, by visiting in person, and — only after you have spoken to us or asked us to — by WhatsApp or phone. We do not send unsolicited marketing email or unsolicited WhatsApp messages to businesses we have never spoken to.

Your right to object

You can tell us to stop at any time, and we will — this is an absolute right where data is used for direct marketing. Email hello@menubyte.co.uk or message +44 7517 826279 and say you do not want to be contacted.

When you object we mark your record do not contact and never approach you again on any channel. We keep the minimum record needed to enforce that — your business name and listing reference — because deleting it entirely would mean our next search of your town simply found you again. If you would rather we erased the record completely, say so and we will, and we will explain that we may then re-collect it in future without knowing you had objected.

How long we keep it

Prospect records are reviewed periodically and deleted when a business is no longer a realistic prospect, other than the suppression records described above, which we keep for as long as we operate.

4. Who we share your data with

We use the following third-party services that may process personal data:

• Resend — delivers transactional emails (order confirmations, table enquiries). Privacy policy
• Stripe — processes online payments. Privacy policy
• Google Analytics — anonymised website usage analytics. Privacy policy
• Cloudflare — website hosting and DNS. Access logs may be retained for a limited period. Privacy policy
• Twilio — sends order alerts by text message and automated voice call to restaurant owners who have asked for them. Receives only the alert phone number and the restaurant's own name; no customer or order details. Privacy policy
• Discord — receives automatic error reports from our systems so we can fix faults quickly. These can include the web address you were on and, rarely, a postcode you typed into the delivery search. Phone numbers and email addresses are automatically masked where detected before a report is sent, reports never include card details, and we do not use them for any other purpose. Privacy policy
• Google Maps — shows a restaurant's location, but only if you tap "Show map" on its page. Until you do, nothing is sent to Google; once you tap, Google receives your IP address and the map request, under its own privacy policy. Privacy policy
• postcodes.io — checks that a delivery postcode you type is a real UK postcode. It receives only the postcode, sent from our server, so it does not see your IP address. postcodes.io

The typefaces on our pages are served from our own website, so loading a page does not send your details to a font provider.

We do not sell, rent, or share your personal data with any other third parties, except that we tell a partner's employer about their introduction arrangement (see "Partners who introduce businesses to us" in section 2), and we would share data where the law requires it.

5. How long we keep your data

• Table enquiry emails — retained in the restaurant's email inbox. We recommend restaurants delete these after 6 months.
• Order records — your personal details (name, contact details, address and notes) are kept for 2 years from the date of the order and then permanently removed from our order database. The date, items and amounts are kept for the restaurant's accounts. Two copies are the restaurant's own records and are not affected: the payment record in its Stripe account (which includes your name, contact details, address, order and notes), and the new-order alert emailed to it.
• Abuse protection — when you send a form on our sites, or your browser reports an error on one of our pages, we briefly record your IP address to stop repeated or automated submissions. These records are deleted within a few hours.
• Analytics data — retained by Google for up to 14 months (default GA4 setting).
• Partners — held while you introduce businesses to us. Records of introductions and payments are kept for as long as UK tax law requires us to keep business records, then deleted.
• Order alert contacts — held for as long as the restaurant is a client and asks us to alert them, and removed when they stop or ask us to. Records of alerts sent are kept alongside the order they relate to, for the same period.

6. Your rights (UK GDPR)

Under UK data protection law you have the right to:

• Request a copy of the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data ("right to be forgotten")
• Object to processing of your data
• Request restriction of processing

To exercise any of these rights, email hello@menubyte.co.uk. We will respond within 7 working days.

If you are unsatisfied with how we handle your request, you can complain to the Information Commissioner's Office (ICO).

7. Security

All data is transmitted over HTTPS. We do not store payment card details. Access to restaurant email inboxes and order management systems is restricted to the restaurant owner and MenuByte staff.

8. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will reflect any changes. Continued use of the site after changes constitutes acceptance of the updated policy.

9. Contact

For any privacy-related questions: