Privacy policy

menubags.com is operated by Exotic Creations Ltd (“we”, “us”), a company registered in England & Wales under company number 15988286. We are the data controller for the personal data described in this notice, and our registered office is 17 Stane Street, Codmore Hill, Pulborough, England, RH20 1BB.

For any privacy question, or to exercise any of the rights set out below, email hello@menubags.com.

• Launch list email address. If you ask to be told when we open, we store the address you give us and which page you gave it on. Basis: consent, which you may withdraw at any time.
• Contact messages. If you use the contact form we store your name, email address and the message itself, so that we can reply. Basis: our legitimate interest in answering people who write to us.
• Account and order data. If you create a design or place an order we store your account email, your design, and the order and its history. Basis: performance of our contract with you.
• A menu you send us. If you send your menu as a PDF or a photo, it is read either in your own browser, where it never leaves your device, or by an AI service we use for the purpose (see section 4). A menu read by the AI service is kept privately on our servers so the same file is never read twice, and deleted 30 days after it was last used. What is read from it — your dishes, and the address, phone numbers, opening hours, website and offers it prints — is used only to fill in your bag for you to check. Basis: performance of our contract with you.
• A picture you add. A drawing you upload is cleaned up for print and kept with your bag. If you ask us to turn a photo into a drawing, the photo — reduced in size on your device, which leaves its location and camera details behind — is sent to an AI service we use for the purpose (see section 4), and kept with the drawing only so it can be drawn again; it is deleted with the drawing. Basis: performance of our contract with you.
• Payment data. Card payments are processed by Stripe. Your card details are entered on Stripe’s systems and are never received or stored by us. We receive only the outcome of the payment and a reference for it.

We do not use advertising cookies, analytics cookies, tracking pixels or cross-site trackers, and we do not profile you. Because of that there is no cookie banner on this site and no separate cookie policy — there is nothing to consent to.

The only cookies this site may set are strictly necessary ones: cookies that keep you signed in to your own account, that keep a checkout session secure, and one that remembers a bag you started designing before you had an account, for 30 days, so you can come back to it. Strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations. Stripe may set its own cookies on its checkout pages for fraud prevention; those are governed by Stripe’s privacy policy.

We do not sell your personal data and we do not share it for anyone else’s marketing. We use a small number of processors who handle data on our instructions:

• Supabase — database, authentication and file storage.
• Vercel — website hosting and delivery, and telling people from automated abuse of our forms.
• Stripe — payment processing.
• Resend — sending the emails about your account and your orders.
• Google, through Vercel’s AI Gateway — only if a menu you import is read by AI: the menu itself, to read your dishes and the details it prints. We use only providers that do not train their models on what they are sent.
• ByteDance, through Vercel’s AI Gateway — only if you ask us to turn a photo into a drawing: the photo, to draw it, with training on it disallowed.
• Our manufacturer and carrier — where an order has been placed, the information needed to produce and deliver it.

We may also disclose data where we are required to by law, or to establish or defend legal claims.

Some of our processors operate outside the UK. Where personal data is transferred outside the UK we rely on UK adequacy regulations or on the International Data Transfer Agreement, or its addendum to the EU Standard Contractual Clauses, so that your data keeps an equivalent level of protection.

• Launch list addresses: until you ask to be removed, or until we have finished launching and no longer need the list.
• Contact messages: up to two years from your last correspondence with us.
• Order records: six years from the end of the financial year they fall in, because tax law requires it.
• Designs and account data: for as long as your account is open, and then for a short wind-down period.
• A design started without an account: your browser can find it again for 30 days from your last change; we keep the design itself until you ask us to delete it.

Under UK GDPR you have the right to ask us for a copy of your personal data; to have inaccurate data corrected; to have data erased; to restrict or object to how we use it; and to receive it in a portable form. Where we rely on consent, you may withdraw it at any time without affecting what we did before you withdrew it.

Email hello@menubags.com to exercise any of these. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

Access to personal data is restricted at the database level, so that one customer’s data cannot be read by another. Data is encrypted in transit. No system is perfectly secure, but we take the protection of your data seriously and design for it rather than adding it afterwards.

If we change this notice we will update the date at the top of this page. If a change materially affects how we use data you have already given us, we will tell you directly.