Menyu Privacy Policy

1. Scope of This Policy

This Policy applies to everyone who uses Menyu, wherever they are located. Menyu is built for travelers and residents who need to read a restaurant menu written in a language they do not know. It is used most often away from home.

If you choose, you can sign in with Apple or Google to create an account. This is optional and never required; declining or skipping it has no effect on what the App does. Signing in shares your email address and, once, your name with us (see Section 2.4).

2. Information We Collect

2.1 Information Created by Using the App

• Menu photos: the photographs you take of menus, or select from your photo library. These are uploaded to our storage and sent to our AI providers so the menu can be read and translated (see Section 5). A menu photo may incidentally capture other things in the frame, such as a table, a hand, or people nearby.
• The menus we produce from them: the dish names, prices, descriptions, translations, detected language, and restaurant name read out of your photo.
• Location, only if you allow it: when you grant location permission, we record the GPS coordinates and accuracy of where a menu was scanned, so we can label the scan with the restaurant and recognize the same menu if you or another user scans it again. Location is optional. Menyu works fully without it, and you can refuse or withdraw the permission at any time in your device settings.
• Venue details you enter or confirm: a restaurant's name, a link you save for it, and which venue you pick when the App offers you a choice of nearby places.
• Allergen and dietary selections: the allergens you ask Menyu to flag and any dietary preferences you set. These are stored on your device. They are sent to our servers only when you use the staff-acknowledgement feature, the screen you show to restaurant staff. That records which allergens were shown, at which venue, and when, so acknowledgements can be counted per restaurant.
• Feedback you give: ratings, tags, and any note you write when you tell us a translation was wrong, along with the scan it refers to. If you leave a note on a thumbs-down rating, that note is included in a daily internal digest posted to a private Discord channel our team uses.
• Feedback you send us: whether you use the feedback form on our website or the feedback screen inside the App, we receive the message you write, any photos you attach, and your email address if you choose to give one. If you report that a menu was wrong, the photographs from that scan are attached to the report as well. To help us troubleshoot reports, we also record some context automatically: your language setting in both cases, plus your browser's user-agent on the website, or the app version, the platform (iOS or Android), the screen you reported from and the scan it refers to, if any, in the App. Photos are stored privately and are not published. Giving an email address is optional; we use it only to reply to you.

2.2 Information Collected Automatically

• Device and app information: device model, operating system version, app build number, and network connectivity type.
• Identifiers: a randomly generated device identifier and a session identifier, used to group a single visit's events together and to distinguish one installation from another for troubleshooting and abuse prevention. The device identifier is stored in your device's secure keychain, so it survives deleting and reinstalling the App. That is deliberate, so quality problems can be traced across reinstalls. It is not linked to your name, email, or any advertising identifier.
• Usage events: records of actions such as starting a scan, a scan succeeding or failing, opening a menu, and adding a dish to an order, together with timing and quality measurements about how well the read performed.
• Diagnostics for scans that go wrong: when a scan fails or returns a partial result, we keep the raw text recognized on the device, image dimensions, and the failure reason, so the cause can be investigated. We do not keep photographs as part of that diagnostic record.
• Crash reports: the error, a stack trace, the app version, and the platform when the App crashes or hits an unexpected error.

2.3 Health-Related Information (要配慮個人情報)

Allergen selections may constitute "Special Care-Required Information" under Article 2(3) of the APPI, because they can indicate a health condition. We collect them only from your own explicit choice to set them, we keep them on your device by default, and we transmit them only in the narrow circumstance described in Section 2.1. Your allergen and dietary selections are never sent to either of our AI providers. Allergen matching against a menu happens on your device, after the translation comes back.

2.4 If You Sign In

Signing in with Apple or Google is optional; Menyu works fully as a guest without it, as described in Section 1. If you choose to sign in:

• Email address: the provider shares the email address on your Apple or Google account, or, if you use Apple's "Hide My Email," a private relay address that reaches you without revealing your real one. We store it as part of your account.
• Name: the first time you sign in with a given Apple ID or Google account, that provider also shares the name on it, and we store it as part of your account. Apple shares it only on that first authorization, never again on later sign-ins with the same Apple ID, so if it is not captured then, we have no way to receive it later unless you remove Menyu's access in your Apple or Google account settings and sign in again.
• Linking your existing scans: signing in attaches your account to the anonymous identifier that the App was already using, along with the scans and history already linked to it, so nothing you scanned as a guest is lost. Your identifier itself does not change. If that Apple or Google identity already belongs to a different Menyu account, we tell you how many local menus would stay behind before you confirm switching accounts, so you never lose them silently.

Signing out ends your account session and gives the App a fresh anonymous identifier; it does not delete anything you had while signed in (see Section 11).

3. What We Do Not Collect

Menyu does not collect any of the following:

• Your phone number, date of birth, or a password. We do not ask for your name or email address, with two exceptions: if you choose to sign in with Apple or Google, that provider shares your email address and (once) your name with us (see Section 2.4); and if you give us an email address when sending feedback, which we use solely to reply to you (see Section 2.1).
• Payment information. Menyu is free and has no purchases.
• Your contacts, calendar, microphone audio, or your photo library beyond the specific images you choose to import.
• Advertising identifiers. Menyu carries no advertising, no advertising SDKs, and no cross-app or cross-site tracking. That is why the App never asks for permission to track you.
• Your location in the background. Location is read only while you are actively scanning a menu, and only if you granted permission.

4. How We Use Your Information

• To read, translate, and display the menu you photographed, and to keep your own scan history available to you;
• If you choose to sign in, to identify you as the same person across sessions and keep the scan history you already had as a guest;
• To flag dishes that appear to contain allergens you asked us to watch for, and to produce the note you show to restaurant staff;
• To recognize when a menu you scan has been read before, so a known menu can load faster and more accurately;
• To measure and improve how accurately Menyu reads menus, including reviewing scans that failed or returned poor results (see Section 6);
• To investigate crashes, diagnose faults, and keep the service running;
• To detect and prevent abuse of the service, including automated use that would exhaust our AI providers' capacity; and
• To comply with our legal obligations and respond to lawful requests from public authorities.

5. AI Processing of Menu Photos and Feedback

When you scan a menu, the photograph is sent to our own server and then forwarded to a third-party large-language-model ("LLM") API provider, which reads the text in the image and produces the translated menu. We currently use two providers for this purpose. The menu is read first by the Google Gemini API (paid tier), running a Gemini model. If that request fails, the menu is read instead by the Alibaba Cloud Model Studio (DashScope) API, running a Qwen model, which also makes a second, background read of the same photograph to fill in details after you have your menu. Your photograph may therefore be transmitted to either provider, or to both, and is processed there to produce the result, under that provider's API terms. Google states that it does not use prompts or responses sent through the paid tier of the Gemini API to improve its products, and that it may log them for a limited period to detect abuse and violations of its policies. We may change which provider or model we use as the product develops; if we do, we will update this Policy to name the new provider.

When you scan a menu, alongside the photograph we send only what the model needs to read it well: the language you want the menu translated into, a count of the text lines our on-device text recognizer found, the language the text appears to be in, and the country you are in. Separately, each night we send a batch of recent usage statistics and feedback text to Alibaba Cloud Model Studio so it can summarize what has changed. Before it is sent, an automated pattern match replaces email addresses, links, ID-like strings and long runs of digits with placeholders, and the batch does not carry your account, your email address, or the scan a note refers to. That matching is automatic, so it catches the common shapes of these things rather than every one — please do not put personal details in a feedback note. We do not send your allergen selections, your GPS coordinates, your device identifier, or your scan history to either AI provider.

Our own servers, which handle the orchestration around the model, are hosted by a cloud infrastructure provider acting as our service provider for hosting and computing (an "entrustment" under Article 27, paragraph 5(i) of the APPI); that provider processes data on our behalf and does not use it for its own purposes. Each LLM API provider described above is a separate company that processes your photograph to generate the result.

6. Improving Menyu's Accuracy

Reading a photographed menu is error-prone, and the main way we make it better is by studying real scans that went wrong. We therefore retain menu photographs and the results produced from them, and we review them, including by hand, to find misread prices, missed dishes, and incorrect translations, and to check whether a change to the App or to the model actually helped.

We use this material to evaluate and improve Menyu itself. We do not sell it, and we do not supply it to third parties to train their own models. It is sent to our AI providers only in the ordinary course of producing your result, as described in Section 5.

7. Sharing a Menu

Menyu lets you create a link to a translated menu so you can send it to the people you are eating with. This only happens when you ask for it. When you do:

• We freeze a copy of that menu, and of the photographs it came from, and put it behind a long, randomly generated web address that cannot be guessed;
• Anyone holding that address can view it, so treat it as public and send it only to people you intend to share it with;
• The link stops working 24 hours after you create it, and creating a new link for the same menu revokes the previous one; and
• The frozen copy is deleted 30 days after the link expires.

Ordering together at a table. Menyu also lets a host start a table order from a scanned menu that other people join from their own phone's browser, by link, by QR code, or by typing a four-character table code. If you join a table order, the nickname, avatar and any allergies you enter are shared with everyone at that table and deleted within a day of the table closing; the host's phone and the table's staff page show who ordered what. A table closes three hours after it starts or three hours after staff last update its order, whichever is later; the host or staff can end it sooner. Joining a table does not create an account and is not linked to one. To learn how table orders are used, we also record what you do at the table from your browser: when you open it or its order and staff pages, join, change your profile or language, add or remove a dish, send a round or leave, and, while the page is open, a signal about once a minute that shows how long you stay. Each record carries the time, the menu's language, the language you read it in, your browser's language, and the kind of device and browser with its system version (for example, iPhone, Safari, iOS 26). A cookie holding a random number, kept for one year, lets us tell a returning visitor from a new one; it is not linked to any account. We do not record your IP address, your location, or your nickname or allergies for this.

Beyond shared links and table orders, Menyu has no user-to-user features. Nothing you scan is visible to another user unless you create a link or start a table.

8. How We Share Your Information

We do not sell your personal information. We share it only as described below.

• Service providers (entrustees): our cloud hosting, database and storage providers, and the LLM API providers described in Section 5, each bound by contractual confidentiality and security obligations or by the provider's API terms, consistent with the APPI.
• Place lookup: when you allow location, approximate coordinates are used to look up nearby restaurants through a third-party mapping provider so the App can suggest which venue you are at. We do not send your photographs or your allergen selections to that provider.
• Discord (feedback): if you send us feedback, or leave a note on a thumbs-down rating, the message and any photos are posted to a private channel in Discord, which our team uses to read and act on reports. If you report that a menu was wrong, the photographs from that scan are posted there too. Discord is operated by Discord Inc. in the United States. Your email address is never posted there — it stays in our database.
• Cloudflare (anti-spam): if you use the feedback form, its anti-spam check sends your IP address, browser user-agent, and other device signals to Cloudflare so it can confirm you are not a bot before we save your report. Cloudflare is operated by Cloudflare, Inc. in the United States. Your message and photos are never sent to Cloudflare.
• Other users: only through a share link you create yourself, as described in Section 7.
• Legal and safety purposes: to comply with applicable law, respond to valid legal process, or protect the rights, safety, or property of Sollo, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to continued protection of your information consistent with this Policy.

9. Cross-Border Data Transfers

Our hosting, storage and AI infrastructure run on servers located outside Japan, menu photographs are transmitted outside Japan to be read, feedback text — including a note left on a thumbs-down rating — is transmitted outside Japan for nightly analysis by Alibaba Cloud Model Studio (Section 5), feedback you send us or a note on a thumbs-down rating — including any photos — is transmitted outside Japan to be posted to our team's private Discord channel (Section 8), and the feedback form's anti-spam check transmits your IP address and device signals to Cloudflare outside Japan (Section 8). Where this is the case, we rely on one of the mechanisms recognized under Article 28 of the APPI: your consent, given after we disclose the destination country and the protections in place; confirmation that the recipient maintains a personal information protection system equivalent to the APPI, which we monitor at least once a year; or transfer to a country or region recognized by Japan's Personal Information Protection Commission as offering an adequate level of protection. You can ask us at any time, using the contact details in Section 16, which countries our current providers operate in and which of these mechanisms applies.

10. Data Retention

We keep different categories of information for different lengths of time. The table below reflects what our systems actually do today. You can end this early for most categories using the in-App delete control described in Section 11. But deleting does not mean the same thing for every category: some are removed outright, and others are kept, permanently disconnected from you, because we use them in aggregate to improve reading accuracy (Section 6). The table notes which applies; Section 11 explains why.

11. Your Rights and Deleting Your Data

Subject to identity verification and any applicable legal exceptions, you have the right to request disclosure of the personal information we hold about you and the purposes for which we use it; to request correction or deletion of it; to request that we stop using or providing it; to be informed of the categories of cross-border recipients and the protections in place; and to complain to us or to Japan's Personal Information Protection Commission (PPC). If you reside outside Japan you may have additional rights under your local law, such as the GDPR if you are in the EEA or UK, which we will honor to the extent they apply to our processing.

You can delete your data directly in the App, whether you signed in or not. Open Settings and tap Account, then Delete account (or Delete my data, if you never signed in). This is permanent and cannot be undone; there is no grace period. It deletes: your scan history, your feedback (including any email address attached to it), your shared-menu links, your allergen-acknowledgement records, every menu and feedback photograph tied to you, and, if you signed in, your account itself, including the email address and name a provider shared with us. It also clears the App's own local copy of your menus, preferences, and history on your device.

Because Menyu does not require an account, the information we hold about a guest is linked only to the anonymous identifier the App created on that device; deleting the App does not by itself delete that information, and reinstalling the App can reconnect you to the same records. If you would rather not use the in-App control, or want to confirm what we hold before deciding, contact us using the details in Section 16 and we will act on your request, subject to identity verification.

12. Data Security

Information is transmitted over encrypted connections (HTTPS/TLS). Menu photographs are held in private storage that is not publicly accessible, other than the deliberately shared, expiring copies described in Section 7. Database access is restricted per user so that one user's scans cannot be read by another. No system is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your rights or interests, we will notify you and the PPC as required by applicable law.

13. Children's Privacy

Menyu is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we learn that we have done so, we will delete it. If you are under the age of majority where you live, please use Menyu with the involvement of a parent or guardian.

14. International Users

Menyu is operated from Japan and is designed to be used while traveling. Wherever you use it, your information will be processed in Japan and, as described in Section 9, in other countries where our service providers operate.

15. Changes to This Policy

We may update this Policy from time to time. If we make a material change, we will provide notice through the App or by other reasonable means before the change takes effect.

16. Contact Us

Questions, requests, or complaints about this Policy or our handling of your personal information can be directed to: