Privacy Policy
This policy explains how Modlocus Menu ("we", "us") handles personal data. We are an individual operator. Contact: support@modlocusmenu.com.
1. Our roles
For account holders (the people who register and pay) we are the controller of the account data described below. For the content you put into your menu and any personal data in it, we act as your processor under the Data Processing Addendum. We do not collect personal data from your menu's visitors beyond what is technically needed to serve the page.
2. Data we process
| Data | Why | Basis |
|---|---|---|
| Account: name, email, password (stored only as a salted hash), language preference | Create and secure your account, sign-in, notices about the Service | Contract |
| Business and menu content: business name, categories, products, prices, images, settings | Operate and publish your menu | Contract |
| Technical data: IP address and request details processed by the server and our hosting infrastructure (for example, to limit sign-in attempts and fix errors) | Security, abuse prevention, troubleshooting | Legitimate interests |
| Subscription status and plan (payment details are held by our payment provider, not by us) | Provide the plan you bought | Contract |
| Support emails you send us | Answer you | Legitimate interests / contract |
We do not sell personal data and do not use it for advertising or profiling.
3. Cookies
We use only strictly necessary cookies, so no cookie banner is shown:
- ml_session: keeps you signed in to the panel.
- ml_lang: remembers your panel language.
- ml_theme: remembers light/dark appearance.
- An anti-forgery cookie that protects forms against cross-site attacks.
We use no analytics or advertising cookies.
4. Who receives data
- our payment provider: payment processing, taxes and invoicing as merchant of record; it acts as an independent controller for payment data.
- Hosting and infrastructure provider: servers and database on which the Service runs.
- Email delivery provider: sends account and notice emails.
The current list is in the sub-processor list. We disclose data to authorities only when legally required.
5. International transfers
Our providers may process data in other countries. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.
6. Retention
- Account and menu data: kept while your account is active. You can ask us to delete it at any time (including after cancellation) and we will do so within 30 days.
- Technical data: we do not keep an application log of your activity in our database. Standard server and error logs kept by our hosting infrastructure are retained only for a short period and then deleted.
- Data we must keep by law (for example, records related to payments, held by our payment provider): kept for the legally required period.
7. Your rights
Depending on where you live (including under the GDPR), you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent where processing is based on it. Email support@modlocusmenu.com; we respond within 30 days. You may also complain to your local data protection authority.
8. Security
Passwords are stored as salted hashes; connections use HTTPS; sessions use secure, HttpOnly cookies; access to customer data is separated per business. No system is perfectly secure; we will notify affected customers of a personal-data breach without undue delay, aiming for within 72 hours of becoming aware.
9. Children
The Service is for businesses and is not directed at children under 16.
10. Changes
We will post updates here and notify account holders of material changes.