Privacy
Policy

At EasyMenus, privacy is a fundamental right, not an afterthought. This policy explains what data we collect, how we use it, and the controls you have. We never sell your personal information to third parties.

EasyMenus is operated by Arcane Systems (Pty) Ltd (Registration No. 2026/488331/07), trading as EasyMenus, which is the "responsible party" for your personal information under the Protection of Personal Information Act (POPIA). Contact our Privacy Team at privacy@easymenus.co.za.

We are equally committed to fee transparency. Any charge applied to a transaction is disclosed before payment is confirmed, not embedded in food prices or revealed after the fact. Customers pay the menu price plus any delivery and optional tip; any platform commission is borne by the Business User, never added to the Customer's bill.

By using EasyMenus you agree to the practices described here. If you have questions, our Privacy Team responds within 48 hours.

We collect only what is necessary to provide, operate, and improve our services. This includes data from both Business Users and Customers:

• Personal Information: Name, email address, phone number, and any optional profile details you choose to add (such as gender and year of birth, both of which offer "prefer not to say"). For Business User accounts: business name, business contact details, and billing plan selection. Your marketing consent choice is recorded with the date you made it, and you can change it on your profile at any time.
• Order & Transaction Data: Order history, items purchased, order totals, payment method type, delivery addresses (including any addresses you choose to save to your account for faster checkout, which you can remove at any time), and (for Business Users) the commission and settlement records for each order. This data is necessary to process orders and administer billing under both the Subscription Plan and the Free Plan.
• Billing & Plan Data: Your chosen billing plan (Subscription or Per Order), subscription renewal dates, and payment status. We do not store complete card numbers; payment card data is handled exclusively by Paystack.
• Business User Payout Details: Bank account details and the account holder's ID number, provided by Business Users so that EasyMenus can create their Paystack payout account. These are encrypted (AES-256) before storage, are never stored in plain text, and are not readable by EasyMenus staff through the application.
• Verification Documents (Business Users and Drivers): Compliance documents required by South African law (for example ID documents, business licences, tax clearance, driver documents). These are encrypted at rest, stored outside the web-accessible file space, and viewed only by authorised admins for verification, through an access-controlled and audit-logged channel.
• Verification Selfie (Biometric Information): Store owners and drivers completing verification take a live selfie so an admin can compare it with their ID document. This is special personal information under POPIA and is collected only with your explicit consent, encrypted like any other verification document, and used solely for identity verification.
• Device & Technical Information: IP address, browser type, operating system. Used to optimise performance and detect security threats.
• Location Data: GPS or approximate location, only with your permission. Used to help Customers find nearby stores and to apply delivery radius settings configured by Business Users.
• Usage Analytics: Pages visited, features used, QR code scan events. Helps us understand platform usage and improve features for all users.
• Support Tickets: Messages you send our support team through the in-app ticket system, kept with your account so we can resolve your queries and reference past issues.
• Menu Photos (AI Import): If a Business User uses the AI menu importer, the menu photo(s) they upload are processed to extract items and prices. These images are not stored after processing - see the "AI Menu Import" section below.

We use your information responsibly for the following purposes:

• Order Processing: To receive, route, and facilitate the fulfillment of orders placed through the Platform, including transmitting order details to the relevant Business User.
• Billing & Commission Administration: To administer Business User billing under the Subscription Plan, and to calculate and apply the commission retained from Business User settlements on Free Plan orders.
• Payment Facilitation: To initiate Paystack card transactions for orders and route each settlement to the correct Business User's Paystack subaccount, and to create that subaccount using the Business User's encrypted banking details.
• Identity and Compliance Verification: To review verification documents and the verification selfie so that stores and drivers can be verified, as required for card payments on the Platform and by applicable law.
• Account Management: To create and maintain your account and provide customer support.
• Personalisation: To surface relevant stores and items based on your preferences and order history, where you have consented to this.
• Platform Improvement: To analyse usage patterns, identify issues, and improve features and performance.
• Security & Fraud Prevention: To detect and prevent unauthorised access, account fraud, and fraudulent transactions.
• Communication: Order confirmations, delivery status updates, billing notifications, and promotional offers (with your consent). You may opt out of marketing communications at any time.
• Legal Compliance: To comply with applicable South African laws, regulations, and enforceable government requests, including obligations under POPIA, the ECT Act, and the CPA.

You have full control over your personal information at any time:

• Access: Request a copy of all personal information we hold in a portable format.
• Update: Correct or update your personal details and account settings at any time.
• Delete: Request permanent deletion of your account and associated data, subject to legal retention requirements (for example, transaction records required for tax compliance).
• Opt Out of Marketing: Unsubscribe from promotional communications at any time. Essential service and billing notifications will continue regardless.
• Location Control: Manage location permissions through your device settings at any time.
• Data Portability: Request your data in machine-readable format to transfer to another service.
• Object to Processing: Object to specific uses of your data while continuing to use core Platform services.

We never sell your personal data. We only share information in the following limited and specific circumstances:

• With Business Users and Their Drivers: When you place an order, we share necessary details (name, contact, delivery address, order contents) with the relevant Business User to fulfill your order. For delivery orders, the driver assigned by the business sees the delivery address and contact details needed to complete the delivery. Guest Customer emails are shared for order communication purposes only.
• With Paystack: Order payment data is transmitted to Paystack to process card transactions. This includes the transaction amount, order reference, and Customer contact details required by Paystack. For Business Users, banking details are shared with Paystack solely to create and operate their payout subaccount. EasyMenus does not store complete card numbers; card data is handled entirely by Paystack under their own privacy and security obligations.
• Subscription Billing: Business User billing for the Subscription Plan or Per Order Plan is administered within the Platform. Relevant billing data may be shared with our payment processing infrastructure solely for the purpose of collecting plan fees. This is separate from the Customer order payment flow.
• Service Providers: Trusted partners for hosting, analytics, and support who are bound by strict confidentiality agreements and may not use your data for any purpose other than providing services to EasyMenus.
• With OpenAI (AI Menu Import): When a Business User uses the AI menu importer, the uploaded menu photo is sent to OpenAI to extract the menu items and prices. OpenAI acts as our operator, does not use the image to train its models, and returns only the extracted text. See the "AI Menu Import" section for full details.
• Legal Requirements: When required by law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of EasyMenus, its users, or the public.

Business Users can build a menu by uploading a photo of their existing printed menu. To do this, we use a trusted third-party artificial-intelligence service to read the items and prices in the image and turn them into a draft menu you review before anything is published. This section explains exactly how that works and what happens to your photo.

• What is processed: Only the menu photo(s) a Business User chooses to upload. A menu photo is business content (item names and prices); it is not intended to contain personal information, and we ask that you do not include personal or sensitive information in a menu photo.
• Who processes it: The image is sent to OpenAI (OpenAI, L.L.C.), which acts as our operator (sub-processor) and extracts the menu items and prices on our behalf. OpenAI processes the image only to return the extracted text to EasyMenus.
• Cross-border transfer: OpenAI processes the image on servers outside South Africa. We rely on OpenAI's contractual data-protection commitments so that your information receives a level of protection consistent with POPIA when it is processed abroad.
• Not stored, not used for training: EasyMenus does not keep the uploaded photo after the menu is extracted - it is processed in memory and then discarded. Images sent through OpenAI's API are not used to train its models. Only the extracted menu text you review and confirm becomes part of your menu data.
• You stay in control: The AI produces a draft only. Nothing is created or published until the Business User reviews, edits and confirms it. This feature is optional - you can always build your menu manually instead.
• Fair-use limits: To prevent abuse and control costs, menu imports are rate-limited per account. These limits do not change how your data is handled.

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using industry-standard TLS/HTTPS protocols.
• Encrypted Storage: Sensitive data, including Business User banking details, verification documents, and verification selfies, is encrypted before being stored (AES-256). Documents live outside the web-accessible file space with no public URL, and are decrypted only for authorised admin review, which is audit-logged.
• Access Controls: Strict role-based permissions ensure only authorised personnel and system processes can access specific categories of data.
• Regular Audits: We conduct periodic internal security reviews and apply patches and updates promptly to address identified vulnerabilities.
• Breach Notification: In the event of a confirmed data breach, we will notify affected users and the Information Regulator as required under POPIA, and take all reasonable steps to mitigate harm.

We only keep your data as long as necessary to provide our services and comply with legal obligations:

• Active Accounts: Retained while your account is active and for a reasonable period thereafter to support account recovery and dispute resolution.
• Transaction Records: Order history, billing records, and commission and settlement data are retained for 7 years to comply with South African tax and financial record-keeping regulations.
• Support Interactions: Customer support logs retained for 2 years for quality assurance and dispute reference purposes.
• Deleted Accounts: Personal data is removed within 30 days of account deletion, except where legal retention obligations require us to keep specific records (such as transaction history for tax compliance).

• POPIA Compliant: We fully comply with South Africa's Protection of Personal Information Act, ensuring your data is processed lawfully, transparently, and with appropriate safeguards.
• International Standards: Our practices align with GDPR principles where applicable, particularly with respect to data minimisation, purpose limitation, and data subject rights.
• Lawful Basis for Processing: We process your data on legitimate legal grounds: consent, contractual necessity, legal obligation, or legitimate business interest, as appropriate in each context.
• Information Regulator: You have the right to lodge a complaint with the South African Information Regulator if you believe your privacy rights have been violated.
• Consumer Protection Act Alignment: All charges are disclosed before the Customer confirms payment, in alignment with the CPA's requirements for transparent pricing. Customers see the menu price, any delivery fee, optional tip, and the service fee on card orders, each itemised before paying; nothing is charged that is not shown on the payment screen.

• Age Restriction: Users must be 18 or older to create an account on EasyMenus. We do not knowingly collect personal information from minors.
• Data Removal: If we discover that personal data has been collected from a minor without parental or guardian consent, we will take immediate steps to delete that data.
• Parent or Guardian Contact: If you believe your child has provided personal information to EasyMenus, please contact us immediately at privacy@easymenus.co.za.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business model.

• Notification: We will notify you via email or in-app notice when we make material changes to this Policy.
• Review Period: You will have at least 30 days to review significant changes before they take effect.
• Continued Use: Your continued use of EasyMenus after the effective date of an updated Policy constitutes your acceptance of the revised terms.
• Version Dating: The "Last Updated" date at the top of this page reflects the most recent revision. You can contact us to request previous versions.

Our Privacy Team responds to all requests within 48 hours.

• Email: privacy@easymenus.co.za
• Call or WhatsApp: +27 66 267 1723
• General: info@easymenus.co.za