Startling menu ("we", "us") provides a QR-menu and ordering platform used by restaurants, cafés, and bars ("venues"). This policy explains what personal data we process, why, and what rights you have. It covers three groups of people: diners who scan a venue's menu, prospective venue owners who contact us, and venue staff who use our admin dashboard.
Data controller: Serhii Maistrenko (Сергій Вікторович Майстренко), sole proprietor, Individual entrepreneur (Фізична особа — підприємець / ФОП), Ukraine, 41 Artema St., apt. 2, village Yalyntsi, Kremenchuk district, Poltava region, 39721, Ukraine. Registration: 25690000000003120 (Unified State Register of Legal Entities, Individual Entrepreneurs and Public Organizations of Ukraine (ЄДР)). Contact: menu.service.eu@gmail.com.
Depending on which of the three groups above you're in, we act in one of two different roles under data protection law, and the difference matters for who you should contact:
When you view a venue's menu, we set a session cookie so your cart is remembered as you browse, and (only when you pick a language yourself) a language-preference cookie. Both are strictly necessary for the ordering feature to work and do not require consent — see our Cookie Policy for the full list. No analytics or tracking runs on a venue's menu, cart, order or feedback pages.
If you place a takeaway order, the venue asks for your name and phone number so it can contact you about pickup; this is stored against the order and is visible to that venue's staff. An optional note you add to your order or to individual dishes is stored the same way. We do not process payments ourselves — you pay the venue directly.
If you leave feedback after an order, your star rating and any comment are stored against that order and shared with the venue.
In every case here, the venue is the controller and we are the processor — see the section above.
If you submit a demo request or the contact form on our marketing site, we store the name, restaurant name, city, and contact details (email or phone) you provide, the page you came from, and a truncated version of your IP address, so we can follow up about our service. We are the controller for this data. The legal basis is our legitimate interest in responding to a business enquiry you initiated (and, once we're in discussion about a contract, taking pre-contractual steps at your request).
If a venue signs up, its owner and any staff they invite have an account with an email address, display name, and password (stored as a secure hash, never in plain text). A login session cookie keeps you signed in. The venue is the controller of staff account data; we process it as the venue's processor.
On our own marketing pages — not on any venue's menu or ordering pages, the sign-in pages, the admin dashboard or these legal pages — we use Cloudflare Web Analytics to see, in aggregate, how many visits each page gets, which site referred them, and how fast pages load. It does not use cookies or other identifiers stored on your device for analytics, and it does not identify or profile you. Cloudflare already handles your IP address and browser details to deliver the page at all; it states that, for this service, it does not use them to fingerprint visitors and does not log query strings. We are the controller for these statistics; the legal basis is our legitimate interest in understanding how our marketing site is used (Art. 6(1)(f)). Cloudflare, Inc. processes them on our behalf — see Sub-processors.
We use a small number of service providers ("sub-processors") to run the platform — infrastructure hosting, DNS/TLS, and cookie-free usage statistics for our marketing pages, currently. We do not use advertising networks, and we do not sell personal data to anyone. The full, named list, and what each one does, is published on our Sub-processors page.
We are based in Ukraine, which is not covered by an EU adequacy decision. For the limited personal data of prospective venues who contact us from the EU/EEA, the transfer to us is necessary in order to take steps at your request before entering into a contract (Art. 49(1)(b) GDPR). We do not currently rely on Standard Contractual Clauses. Where we take on a venue customer established in the EU, we will put appropriate Article 46 GDPR safeguards in place first. If you have any questions about international transfers, contact us at menu.service.eu@gmail.com.
Depending on where you live, you have the right to access, correct, delete, restrict, or export your personal data, and to object to how we use it. To exercise any of these rights, use our data request form or contact us at menu.service.eu@gmail.com. If your data is about an order or account at a specific venue, we may need to forward your request to that venue, since they are usually the controller — we'll tell you when that's the case. We aim to respond within 30 days.
If you are a diner at a venue we serve in Albania, the competent supervisory authority is Komisioneri për të Drejtën e Informimit dhe Mbrojtjen e të Dhënave Personale (IDP), Albania. If you are in the EU/EEA — for example, if you contacted us through our marketing site — you also have the right to lodge a complaint with your local data protection authority.
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.
We will update this page if what we do with your data changes, and update the version number and date shown at the top of this page.
Other documents