Privacy policy

The email address is optional: we only ask for it if you choose to attach your menus to an account. It is used to send you your sign-in link and, where relevant, a warning about your menus. It never appears on a public page, in the sitemap, in the structured data or in a share preview, and it is neither sold nor traded. Consent to receive commercial information is separate, unticked by default, and timestamped.

The restaurant name, the address, the phone number, the sections, the dishes, the prices and the photos are published: that is the whole point of the service. They can be read by anyone with the link, indexed by search engines once the menu is full enough, and read by AI answer engines. Do not put anything in a menu that has to stay private.

Audience measurement uses Matomo, which we host ourselves, in cookieless mode: no measurement cookie is set, no lasting identifier is written to your browser, and no consent banner is therefore needed. There is a single technical cookie, the session one, and only on the pages that sign you in or let you edit a menu. The public menu pages set none at all, not even that one.

Photos are re-encoded on arrival and served as derivatives. EXIF metadata is stripped along the way, including the GPS coordinates a phone camera writes into a file, and the original is never served as is. Files are kept in our object storage and delivered by our CDN.

The application and PostgreSQL database are hosted by Scaleway in France. Uploaded photos are stored by Hetzner in Germany, in the nbg1 region, and distributed by Cloudflare through cdn.lfmenu.fr. Sign-in emails are sent by Scaleway Transactional Email. Matomo runs on our own infrastructure and is therefore not a processor: the statistics never leave our servers, which is worth saying.

An account is kept until its deletion is requested. A menu is kept until its author deletes it, or until the abandonment rule set out in the terms of use applies. Audience data is kept for the period configured on our Matomo instance, then erased.

Under the GDPR, you can request access to your data, its correction, its deletion, its portability, and you can object to its processing. A full export of a restaurant, in JSON and in CSV, is available in one click from the editor anyway, without having to ask anyone for anything.

To exercise those rights, or for any question about this page, write to [email protected].