Privacy Policy
1. Controller
Controller within the meaning of the GDPR:
Villiart Media
Lehmbarg 39
27721 Ritterhude
Germany
Email: info@menu-check.com
2. Data we process
Account data: name, email address, optional company, password (stored as bcrypt hash only), chosen language.
Uploaded files: your menus (PDF/DOCX) are stored only temporarily for the duration of the analysis and are deleted automatically afterwards. Only the file name and the generated analysis reports are kept.
Chat data: conversations with the chat assistant are stored in anonymised form; email addresses, phone numbers and long numbers are redacted before storage.
Payment data: payments are processed entirely by Stripe; we do not store card data, only payment references (amount, currency, Stripe transaction ID).
Technical data: session cookie for login, language cookie, server logs (IP address, time, requested page).
3. Purposes and legal bases
Processing takes place for the performance of the contract and provision of the service (Art. 6(1)(b) GDPR), to comply with legal obligations such as commercial and tax retention duties (Art. 6(1)(c) GDPR) and based on our legitimate interest in security and abuse prevention, e.g. virus scanning of all uploads (Art. 6(1)(f) GDPR).
4. Disclosure to third parties
We use the following processors/providers:
Stripe Payments Europe, Ltd. (payment processing) – privacy: stripe.com/privacy
Mistral AI (text recognition/OCR of the uploaded menu, chat assistant and chat summaries)
OpenAI (AI-based allergen analysis of the extracted text)
Only the content required for the respective function is transmitted to AI providers, never account data. No further disclosure to third parties takes place.
5. Retention
Account data is stored until the account is deleted. Uploaded menus are not stored permanently: the file is deleted automatically right after the analysis is completed, at the latest after 24 hours. The generated reports remain available in your account. Payment-related data is subject to statutory retention periods (up to 10 years). Server logs are deleted after 30 days at the latest.
6. Cookies
We use technically necessary cookies (session cookie for login, language selection, storage of your cookie decision). In addition – only with your consent given via the cookie banner and separately per category – we set cookies from Google services (see the following sections). You can change your choice at any time via the "Cookie settings" link in the page footer.
Google Analytics
If you have given consent via the cookie banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies (including "_ga", "_ga_…") that enable an analysis of your use of the website (e.g. pages visited, session duration, approximate location). IP addresses are processed in truncated form (IP anonymisation); advertising features and personalised signals are disabled.
Legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German TDDDG). Without consent, Google Analytics is not loaded and no data is transmitted to Google. You can withdraw your consent at any time with effect for the future: click "Cookie settings" in the page footer and choose "Necessary only".
Data may also be transferred to servers of Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. A data processing agreement (Google Ads Data Processing Terms) is in place with Google. The retention period for analytics data at Google is set to 14 months.
Further information: policies.google.com/privacy · browser opt-out add-on: tools.google.com/dlpage/gaoptout
Google Ads
If you have consented to the "Marketing" category via the cookie banner, we use Google Ads conversion tracking, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). It lets us measure whether an action on our website (e.g. a completed purchase) results from a click on one of our ads. For this, Google sets cookies (including "_gcl_…"); what is transmitted is in particular that a conversion took place, along with amount and currency. Where marketing consent has been given, the Google tag may also transmit page-view signals that Google can use for advertising purposes (remarketing).
Enhanced conversions: To attribute conversions more accurately, we additionally use Google's "enhanced conversions" feature. The Google tag collects data you enter on the website – in particular your email address, e.g. when logging in or purchasing –, converts it into an irreversible hash value (SHA-256) in your browser and transmits only this hash to Google. Google matches it against hashed data of signed-in Google accounts to attribute conversions even when cookies are unavailable; Google does not receive your plain-text email address from us.
Legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German TDDDG). Without consent, Google Ads is not loaded and no data is transmitted to Google. You can withdraw your consent at any time with effect for the future: click "Cookie settings" in the page footer and disable "Marketing".
Data may also be transferred to servers of Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.
Further information: policies.google.com/privacy · policies.google.com/technologies/ads
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
8. Data security
Passwords are stored as hashes only. All uploads are scanned for malware with ClamAV before processing. The application's database access is restricted to the necessary minimum.