iMenu

Privacy Policy

Effective date: 8 September 2026 · Version 6

1. Who we are and what this policy covers

iMenu is a product of SSByte, a company based in the Hashemite Kingdom of Jordan ("we", "us"). iMenu lets restaurant and business owners build digital menus and publish them as public web pages.

This policy covers both the iMenu organization and menu-builder apps, where owners register accounts and manage their menus, and the public menu pages we serve at imenu.ssbyte.com/m/{slug}, which diners can view.

2. Data we collect

From business owners (account holders)

  • Account data: your email address and display name. Sign-in is handled by Firebase Authentication, including the option to sign in with Google; if you use Google sign-in, Google shares your basic profile (name and email) with us.
  • Business profile: business name, address, phone number, WhatsApp, Instagram, and website.
  • Menu content and images you upload. When you choose to publish a menu, the content and images you publish become publicly visible on the web.
  • Your referral code and referral balance. If you request a referral payout, we also store the payout method you choose and the payment details you enter — which may include a bank account number, an IBAN, a CliQ alias, or a PayPal address. We keep these to make and evidence the payment.
  • Acceptance records: when you accept our terms or policies, we record the timestamp, IP address, and browser user agent as proof of acceptance.
  • Support communications: messages you send us and our replies.
  • Subscription data: your plan (Free or Pro) and any paid add-ons. Payments are currently recorded manually and there is no online payment, so we do not collect card details.

From diners (visitors to public menu pages)

There are no diner accounts, no profiles, no advertising trackers, no advertising cookies, and we never build a profile of you across menus or across visits. Viewing a menu does involve a small amount of data, and we would rather describe it exactly than claim more than is true:

  • Aggregate counters of page views and clicks on contact links (such as phone or WhatsApp). These are totals per menu; they are not tied to a person.
  • A short-lived technical fingerprint. To count each visit once rather than every time a page reloads, our server takes your IP address and browser user-agent string and turns them into a one-way code. We store that code, not your IP address, and it is automatically deleted within about two days. It is specific to one menu, so the same visitor cannot be recognised across different restaurants.
  • A marker in your browser's sessionStorage (a value named imv- plus the menu's ID) so a reload does not count twice. It is deleted when you close the tab, and it stays on your device.
  • If you report a menu using the report link, we store your chosen reason, any note you write, and the same one-way code described above, so that the same person cannot flood us with reports. We do not store your IP address or user-agent. This evidence is deleted once an administrator reviews the report.
  • If you leave a review, we store your rating, any text you write, and the submission date — these are shown publicly on the menu page. We also store the same one-way technical code described above, so the same visitor cannot post unlimited reviews for one menu; we do not store your IP address or user agent. If a review is removed by moderation or at the business's request, it stops being shown but the record is kept for our own dispute/audit purposes.
  • If you enter a prize draw — a giveaway some businesses choose to run, only available on our Pro plan — we store the name, phone number or email address, and photo of your receipt that you submit, along with the date and your checked consent to be contacted if you win. Unlike the other diner data on this page, this is real, directly identifying information, not a one-way code — though we also use the same one-way code to stop one visitor entering the same business's draw more than once a day. Your receipt photo is kept private: it is shown only to the business you entered with (and to us, for support purposes), never published or shown to any other diner. Entries are automatically deleted, photo included, 90 days after submission, and a business can delete an individual entry sooner (for example once a winner is chosen).

Separately, and like every web service, our infrastructure provider keeps its own short-lived technical logs (which do include IP addresses) for security and operations. Those are Google's logs, kept under Google's retention rules, not something we build a profile from.

Public menu pages request nothing from any third-party advertiser, tracker, font service or content-delivery network. Everything a menu page loads — its images, its text, and the small requests described above — comes from iMenu and from Google, our infrastructure provider described in sections 4 and 5.

3. How we use data

  • To provide and operate iMenu, including publishing the menus you choose to make public and serving them quickly through a content delivery network (CDN).
  • To manage subscriptions and billing for Pro and paid add-ons.
  • To prevent abuse, fraud, and misuse of the service and to keep it secure.
  • To comply with legal obligations and keep records (for example, acceptance records as evidence that terms were agreed).
  • To understand overall usage through aggregate statistics so we can improve the product.

4. Where your data is stored

iMenu runs on Google Firebase (Firestore, Cloud Functions, Storage, and Hosting with CDN). Data is stored primarily in Google's us-central1 region in the United States. By using iMenu, you understand that your data is transferred to and processed in the United States, where data-protection rules may differ from those in your country. Copies of published menu pages may also be cached on CDN servers around the world so they load quickly.

5. Sharing

  • Google Cloud (Firebase) processes data on our behalf as our infrastructure provider, under its own privacy and security commitments. This includes Google Cloud Vision, which automatically checks images uploaded to iMenu for unsafe content before they are published.
  • Our email provider (Titan) delivers service email to account owners — for example a plan-expiry notice or a confirmation that you asked us to delete your account. It receives your email address and the content of that message. We do not send marketing email.
  • We do not sell personal data, and we do not share it with advertisers or ad networks.
  • Menu content and business contact details you publish are public by your own choice and can be seen by anyone with the link.
  • We may disclose information where required by law, by court order, or by a lawful request from competent authorities.

6. Retention

  • Account and business profile data: kept while your account is active.
  • Diner data: the technical fingerprint used to count visits is deleted automatically within about two days. Report evidence is deleted when an administrator reviews the report. A review's rating, text and date are kept until removed by moderation or at the business's request; the record itself is then kept for our own dispute/audit purposes rather than erased outright. Prize-draw entries (name, contact details, receipt photo) are kept for 90 days from submission and then permanently deleted, including the photo, unless the business deletes an entry sooner.
  • Images you upload: removing an image from a menu, or unpublishing a menu, removes it from the page but does not yet erase the stored file. It stays in our image store and remains reachable by anyone who already has its direct link. It is not indexed and is not shown on any page. Email legal@ssbyte.com to have a specific image erased, and we will do it by hand.
  • Published menus: publicly available until you unpublish them, delete them, or delete your account.
  • After deletion, residual copies may remain for a limited time in backups and CDN caches before they are cleared.
  • Acceptance records and billing records — including the payout details you gave us for a referral payment we have already made — may be kept longer where we need them to meet legal obligations, to evidence a payment, or to resolve disputes.

7. Your rights

If you are an account owner, you can:

  • See your account details, and view and edit your business profile and menu data, directly in the app. To correct your name or email address, email legal@ssbyte.com — we make these changes by hand so we can verify the request.
  • Delete individual menus at any time in the app.
  • Delete your entire account, from Settings in the app. Your menus and website are unpublished immediately, so their public pages — and any printed QR codes pointing at them — stop working straight away. Your account and its content are then permanently erased 30 days later. You can cancel during those 30 days by signing in; cancelling restores your account but does not republish your menus. Acceptance and billing records, and uploaded image files, are handled as described in Retention above.
  • Contact us at legal@ssbyte.com for any privacy request you cannot complete in the app.

Diners: we hold no account and build no profile of you. The only diner data we hold is described in section 2 — aggregate counters, a one-way technical code deleted within about two days, (if you report a menu) your reason and note, (if you leave a review) your rating, any text, and the date, which are shown publicly on the menu page, and (if you enter a prize draw) your name, contact details and receipt photo. Because the technical code is one-way and short-lived, we generally cannot connect it to you in order to act on an access or deletion request; a public review, however, is visible on the page itself, so email legal@ssbyte.com naming the menu and we can act on it directly. A prize-draw entry directly identifies you, so you can ask the business you entered with to delete it, or email legal@ssbyte.com naming the business and we will do it.

8. Security

We use industry-standard safeguards, including encryption in transit and the access controls provided by the Firebase platform, and we limit who at SSByte can access owner data. However, no online service can guarantee absolute security, so we cannot promise that data will never be accessed or disclosed without authorization.

9. Children

iMenu accounts are intended for business owners and are not directed to children. You must be at least 16 years old to create an account. Public menu pages may be viewed by anyone; we build no profile of viewers of any age, and the limited data a visit involves is described in section 2.

10. Changes to this policy

We may update this policy from time to time. When we do, we will post the new version with a new effective date, and we will notify account owners of material changes in the app or by email. Continuing to use iMenu after a change takes effect means the updated policy applies to you.

11. Contact

SSByte, the Hashemite Kingdom of Jordan. Email: legal@ssbyte.com. This policy is governed by the laws of the Hashemite Kingdom of Jordan.