Privacy Policy

1. Introduction

KIRYL RAHULENKA individuali veikla ("we", "us", or "our") operates MenuCraft (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Service, in compliance with the General Data Protection Regulation (GDPR) and Lithuanian data protection laws.

Data Controller: KIRYL RAHULENKA individuali veikla, Registration No: 1483873, Paupio St. 50-86, Vilnius, Vilnius City 11341, Lithuania, [email protected]

2. Data We Collect

2.1 Account Information

• Email address (from Google OAuth)
• Name (from Google OAuth)
• Profile picture URL (from Google OAuth)
• User ID

2.2 Payment Information

• Stripe customer ID
• Payment transaction records
• Credit balance and usage history

We do not store credit card numbers or banking details. All payment processing is handled securely by Stripe.

2.3 User-Generated Content

• Photos, PDF, Word and text files of menus you upload
• Menu text recognized from them, including your corrections
• Generated menu designs (PDF and PNG files)

2.4 Technical Data

• IP address
• Browser type and version
• Device information
• Usage logs and timestamps

3. Legal Basis for Processing

• Contract Performance (Article 6(1)(b) GDPR): Processing necessary to provide you with our Service and fulfill our contractual obligations.
• Legal Obligations (Article 6(1)(c) GDPR): Processing required to comply with tax, accounting, and other legal requirements.
• Legitimate Interests (Article 6(1)(f) GDPR): Processing for fraud prevention, security, and service improvement, balanced against your rights.
• Consent (Article 6(1)(a) GDPR): Where you have given explicit consent for specific processing activities.

4. How We Use Your Data

• To provide and maintain our Service
• To process your payments and manage your account
• To recognize your menu's text and generate menu designs from it
• To communicate with you about your account or our Service
• To improve and optimize our Service
• To comply with legal obligations
• To prevent fraud and ensure security

5. Data Sharing and Third Parties

We share your data with the following third-party service providers:

• Supabase (database, authentication and file storage) stores user accounts, credits, uploaded menus and generated designs. Privacy Policy
• Stripe (payment processing) processes all payment transactions securely. Privacy Policy
• Anthropic (AI) processes uploaded menus to recognize their text and to generate designs with Claude. Privacy Policy
• Google (OAuth authentication) provides secure sign-in. Privacy Policy
• Railway (hosting) runs the Service's servers. Privacy Policy

6. International Data Transfers

Some of our service providers may process data outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place, including:

• EU-US Data Privacy Framework certifications
• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission

7. Data Retention

• Account Data: Until you request account deletion, plus any legally required retention period.
• Uploaded Menus and Generated Designs: Stored in your account until you delete them or close your account.
• Payment Records: 7 years from the date of transaction (legal requirement for tax purposes).
• Technical Logs: Up to 90 days for security and debugging purposes.

8. Your Rights Under GDPR

• Right of Access: Request a copy of your personal data we hold.
• Right to Rectification: Request correction of inaccurate personal data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Restrict Processing: Request limitation of how we process your data.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, please contact us at [email protected]. We will respond within 30 days.

9. Data Security

• Encryption of data in transit (TLS/SSL)
• Secure authentication via OAuth 2.0
• Private file storage accessible only to our servers
• Access controls and audit logging

10. Cookies and Local Storage

We use only what is necessary for the Service to work:

• Authentication session data and security tokens
• Your interface language and theme preferences, stored in your browser

These are strictly necessary for the Service and do not require consent.

11. Children's Privacy

Our Service is not directed to children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

13. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. In Lithuania, this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt.

14. Contact Us

For any questions about this Privacy Policy or your personal data, please contact us: