Privacy Policy
Effective for all tenant storefronts on this platform.
What we collect
When you visit a tenant's public menu or scan one of their QR codes, we record an anonymous event containing:
- The tenant id
- Event type (view, scan, share, product_view, locale_switch)
- Locale at event time
- Device class (mobile / tablet / desktop), derived from your User-Agent
- Session id (a UUID stored in your browser's cookies)
- IP hash (one-way, never your raw IP)
- Your User-Agent string (kept for re-classification)
- Referer header
What we do NOT collect
- Names, emails, phone numbers, or any account-like identifiers
- Geolocation
- Browsing history outside the menu page
- Cart contents, payment methods, or checkout signals
- Cookies other than the per-tenant session cookie
How long we keep it
90 days. The platform runs a daily job that removes older rows. The 90-day window matches typical session-life assumptions.
Per-tenant salt
Each tenant has its own random salt mixed into the IP hash. A leaked platform key without the salt cannot de-anonymize. The salt is generated automatically on the tenant's first settings write and never changes.
Opt-out
Tenants can disable analytics entirely in their settings. When disabled, no events are recorded from their storefront.