Privacy Policy

This Privacy Policy explains what personal data Ementado collects, what it is for, and what your rights are, in line with the General Data Protection Regulation (GDPR). In case of doubt, the Portuguese version prevails.

1. Data controller

Guilherme Gomes, Portuguese tax number 249772175, contact ementado@ementado.pt, is the controller of the personal data collected through Ementado.

2. What data we collect

• Account data: email and password (the password is never accessible to us: it is managed in encrypted form by our authentication provider, Supabase). If you sign in with Google, we receive the email and name associated with that account.
• Menu data: business name, categories, dishes, prices, descriptions, logo and images you add.
• Payment data: processed directly by Stripe, which keeps the customer details: the billing name, email, address and tax number and, for a subscription, the card for renewals. We never see or store the card number: we keep the confirmation that the payment was completed, the amount, the tax number if you give one for the invoice, and the billing address you give Stripe, for the invoice. When you delete your account, the Stripe customer is deleted too (payments and invoices stay there, as the law requires).
• Table stickers: to produce and deliver them, we keep the order (the menu, the piece, the style, the finish, the colours, the name of the place and the tables) and the code of each table, plus the delivery name, address and phone number you give when ordering. The name, address and phone number are used only for delivery and the guarantee. Table codes do not identify who scans them: a visit through one of them counts only as a visit from the QR code, like any other.
• Visit statistics: when someone visits your public menu, we record the date and whether the visit came from a QR code or a direct link, to show you statistics in your dashboard. We do not link these visits to an identifiable person. We do not collect IP addresses or advertising identifiers. We also count how many times each dish was seen (a dish that stays on screen for two seconds or whose photo is opened), only as a total per dish per day.
• Site visits: to know how many people visit the Ementado site and how they get there, each page of the site that is opened (the home page, stickers, guides, the Ementado guide and the other pages, but not the places' menus, which are counted as explained above) adds one to a daily total, with three details only: the page, the source as a category only (Google, Instagram, Facebook, WhatsApp, another site or direct, without the address it came from) and the type of device (phone, tablet or computer). To count each person only once a day, the database works out an anonymous code from the IP address and the browser, mixed with a random value that changes every day; the code and that value are deleted when the day ends, and we never store the IP address or the browser. Only each day's totals remain, which identify no one. For this we use no cookies, store nothing in your browser and use no third-party analytics services.
• Weekly summary: if your menu had activity, we email you the week's numbers on Monday. Every summary has a link to stop receiving it in one tap.
• Local technical data: we use your browser's storage (localStorage and sessionStorage) to keep you signed in, keep the menu you are editing before you have an account, your language preference, the places you saved in the Ementado guide, the code of whoever recommended you and the 4-hour permission to review a place, and to avoid counting the same visit twice. The only cookies are Google Translate's, with the language you chose, if you ask for a translation, and Cloudflare's in the anti-bot check at sign-in. There are no advertising cookies or cross-site tracking.
• Files for the "Menu made by us" service: if you ask us to build the menu for you, we keep the form answers (business name and type, your name, email, phone if given, languages and notes) and the files you send, such as photos or the menu PDF. They sit in private storage only we can access, and serve only to build your menu. For services by professionals, the assigned professional can also access the job's files (see "Services and Ementadores").
• Photos of the paper menu: if you use the "Import from photo" feature, the photos you upload are sent to Google (Gemini API) only to extract categories, dishes and prices automatically. Google does not use them for other purposes and we do not keep them beyond what that extraction needs. Automatic menu translation uses the same service, with the menu text.
• Mesa a Mesa programme: if you recommend Ementado, we keep your code and the link between your account and the accounts that joined through your link. Whoever recommends sees only the date and status of each invitation, never the name or contact of whoever joined. This applies to places that recommend: the Ementador who brought a place sees more, as explained next.
• Services and Ementadores: if you buy a service by professionals, we keep the order, its status, the assigned professional, the session and delivery dates, the delivered files, the approvals and requests to redo (with the reasons) and the order history. The files sit in private storage that only the assigned professional and we can access; your account only sees the delivery once it reaches you, after our review, if there is one. Once approved, the photos move to your menu and become public, like the menu's other photos; if the dish already had a photo, the new one takes its place, and the old one is kept so that we can put it back if you ask. If your place is linked to an Ementador (because you created your account through their link, or because you signed in to your account through one of their links when your place had not yet been brought by anyone and had never had Ementado Pro), we keep that link and, if they prepared your sign-up, what they wrote in the invitation (the place's name, address, phone number, municipality and email). About your place, that Ementador sees the menu's name and link, whether it is published, the menu's phone number and municipality, whether you have Ementado Pro and on which plan, whether a payment failed, whether cancellation is scheduled, when you joined, when the menu was last changed and last visited (only to know whether it has gone quiet) and the commissions they earned from your place, with the amount of the payment each one came from and until when they receive them. They see this data to follow up on your place and help it, and can keep their own notes about it. If the Ementador leaves the network, they still see, for each place they brought, only the menu's name and link, whether it is published, when it joined, whether it has Ementado Pro and on which plan, and the commissions they earned from it and until when they receive them; they no longer see anything else, including their notes and invitations. If they leave for serious misconduct, they no longer see the places.
• Place suggestions: if you suggest a place for the Ementado guide, we keep its name, the town and, if you write it, your email, used only to tell you when the place joins. You can ask us to delete it at any time.
• Reviews: if you review a place, we keep the stars, the dishes you chose, the comment and name (if you write them), and a random identifier of the phone, hashed, used only to stop two reviews from the same phone for the same place. We do not ask for an email or an account. The permission to review is stored on the phone itself for 4 hours. Published reviews stay for as long as the place's menu exists; you can ask for yours to be deleted. Reviews removed or held back for breaking the rules are deleted 90 days later.
• Menu reports: if you report a menu, we keep the reason, what you write, your contact if you leave one and a daily code of your connection (not the IP address), so the same report is not counted several times. Ninety days after the report is handled, the text, the contact and the code are deleted; the reason and the decision stay.
• Ementador applications: if you apply to join the network of professionals, we keep your name, email, phone, municipality, specialities, portfolio and message, to assess the application. A rejected application is deleted 6 months after the decision, and an undecided one 12 months after it arrives. If it is approved, it becomes the Ementador record, with the tax number and IBAN for payments, while you are in the network.
• Proposals to places: Ementadores can send, through Ementado, a proposal to the public email of a place that is not yet on Ementado. We keep that email and the key of the unsubscribe link (180 days). If the place says it does not want more, we keep the email on an objection list, only so we never write to it again.
• Prospecting: Ementadores see a list of food and drink places taken from OpenStreetMap (public business data: the name, address and contact the place itself published) and the visits they log to each one.
• Location: when you put your place on the map, the address you type is looked up with OpenStreetMap's address service (Nominatim), which receives that address and your IP address. In «Near me», in the Ementado guide, your phone's location, if you share it, is used only to sort places by distance and is not stored.
• Errors and abuse protection: when a page fails, we keep the page, the error message and the browser (name and version), without personal data, for 60 days, to fix it. To stop bots and abuse (mass reviews, reports or payments), we count each connection's requests by a daily code, made from the IP address mixed with a secret value and the date, which does not reveal the address and is deleted after 2 days. Sign-in, sign-up and password recovery go through Cloudflare's check (Turnstile), which analyses the browser to tell people from bots.

3. What we use your data for

To create and maintain your account, publish your menu, process payments and invoices, produce, deliver and guarantee table stickers, show you visit statistics, count visits to the site, award the referral programme rewards, carry out, deliver and guarantee services by professionals, calculate and pay what Ementadores earn, and answer support requests. We do not sell your data to third parties or use it for advertising.

The legal basis for each use (Article 6 of the GDPR):

• Performance of the contract: the account, menus, payments, stickers, services, the Ementador network and support.
• Legal obligation: invoicing and accounting, and keeping the documents tax law requires.
• Legitimate interest: visit and site statistics (without identifying anyone), security and abuse protection, backups, the weekly summary to menu owners (with a link to stop it), proposals to places and the list of those who do not want them.
• Consent: the email you leave in a place suggestion or a report, an Ementador application, a review of a place and translation by Google Translate, which only happens when you choose it. You can withdraw consent at any time.

4. Who we share data with

Only with the providers strictly needed for the Service to work: Supabase (database and authentication, in Ireland), Stripe (payment processing), the site's hosting providers (Vercel and Cloudflare), Cloudflare also in the anti-bot check at sign-in (Turnstile), Resend (sending emails, such as sign-up confirmation) and Google: if you sign in with your Google account, for some menu fonts (Google Fonts, which receives the IP address of whoever opens the menu) and, only if you use photo import or automatic translation, the Gemini API. All are bound by data protection agreements compatible with the GDPR.

Some of these providers (Stripe, Vercel, Cloudflare, Resend and Google) are United States companies or process data outside the European Economic Area. These transfers rely on the EU-US Data Privacy Framework, for certified companies, or on the standard contractual clauses approved by the European Commission.

If you buy a service by professionals, we also share data with the assigned professional, who receives only what the job needs: the place's name, address and phone number, the account email and the menu. They are bound to use this data only for that job. Of the professional, your place sees only their name and phone number; of the Ementador who brought it, their name, phone number and area. Ementadores never see your payment details (card, invoices or tax number), only what is described in section 2.

If you order table stickers for postal delivery, the carrier receives the delivery name, address and phone number, only to deliver the order. The print shop that prints them receives only the print file (the design, the name of the place and the table numbers and codes), without your contact details.

On the site and in the Ementado guide, if you choose a language other than Portuguese or English (or English on a page that only exists in Portuguese), the page is translated by Google Translate, which receives the page text and stores a cookie with the chosen language. None of this happens before you choose.

The Ementado guide map and the "Where we are" map on menus use OpenStreetMap tiles: when a map appears, your browser requests the images from OpenStreetMap's servers, which receive your IP address, as with any request on the internet. We send them no other data.

5. How long we keep data

Account and menu data are kept while the account is active. The other periods, applied automatically by a daily task:

• "Menu made by us": the files, your name, phone, notes and the request's email are deleted 90 days after we deliver your menu (30 days after, if the request is cancelled), or earlier if you ask.
• Stickers: the delivery address and phone are deleted 13 months after the order ships (guarantee and returns). The name, email, tax number and amount stay with the order for the period tax law requires (usually 10 years).
• Payments: the name, email, tax number, billing address and amount of each payment stay with the order for the period tax law requires (usually 10 years), because they are part of the invoice.
• Services by professionals: the order and what was delivered are kept for as long as they are needed for the service and the guarantee; you can ask us to delete the deliveries at any time.
• Removed or held reviews: 90 days. Reports: the text, contact and code are deleted 90 days after they are handled. Place suggestions: the email is deleted when the place joins or is set aside, or after 90 days.
• Ementador applications: rejected, 6 months after the decision; undecided, 12 months. Proposals to places: the link key, 180 days.
• Commissions: the email of whoever bought through a referral is deleted 13 months after the commission is cancelled, or 25 months after it is paid.
• Technical records: page errors, 60 days; daily abuse codes, 2 days; emails that could not be sent, 30 days; the version history of each menu, 30 days.
• Backups: we keep copies of the database for up to 8 weeks, only to restore it if something fails. What you delete leaves them when the copy expires.

You can delete your account from the dashboard, under "Delete account": the account, menus, photos, statistics and codes are deleted immediately, and subscriptions are cancelled. What stays, for the period the law requires, are the orders and payments made; the Ementador record and the partner record stay, without your name or contact, for the commission accounts; and the menu address stays reserved, without your data, so a printed QR code never opens another place's menu. If you ask for deletion by email, we delete the account the same way within 30 days.

6. Your rights

Under the GDPR, you have the right to access, correct, export or delete your data, and to object to or restrict its processing. To exercise any of these rights, contact us at ementado@ementado.pt. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD), at www.cnpd.pt.

7. Minors

The Service is intended for business owners and is not directed at anyone under 18.

8. Changes to this policy

We may update this policy from time to time. Relevant changes will be flagged on the platform with the revised update date at the top of this page.