Privacy Policy
Last updated
qriz.ai is a QR menu platform for restaurants, cafés and bars. Restaurants use it to build, translate and publish their menus; guests use it to browse a menu, book a table and leave feedback. This policy explains what personal information we collect, how we use it, who we share it with, how long we keep it and the choices you have.
It covers our website (qriz.ai), the restaurant dashboard (dashboard.qriz.ai) and the guest menus we host (menu.qriz.ai), together the “Service”. qriz.ai is operated by Mtislab LLC (“Mtislab”, “we”, “us”).
The short version
- Browse without an accountGuests open a menu without signing up. We count visits with a random ID kept on the guest’s device, not with an IP address.
- Bookings go only to the restaurantA guest’s name and phone number are shared only with the restaurant they book, and are deleted automatically 7 days after the visit.
- AI sees menus, not peopleOur AI features read dishes, photos and menu files. They never receive guest bookings, ratings or contact details.
- We never see card numbersCards are entered on our payment provider’s secure page. We keep only the card type, a masked number and the expiry date.
- No ads, no trackersWe don’t sell personal information, show ads, or use third-party analytics or advertising cookies.
- You stay in controlWherever you live, you can ask for a copy of your information, ask us to correct it, or have it deleted.
01Who we are and our role
qriz.ai is operated by Mtislab LLC. Our role depends on whose information it is and why it is collected.
- Restaurant accounts and our website
- We decide how this information is used, so we are its controller.
- Guest information collected for a restaurant
- Bookings, ratings and menu statistics are collected for the restaurant whose menu you’re using. The restaurant is the controller of this information, and we process it on the restaurant’s behalf as its processor (or “service provider”), only to run the Service for it. If you’re a guest with a question about this information, the restaurant is the best place to start. We’ll help it answer you, and you can always contact us directly.
- Security and reliability
- We also use limited technical information, such as IP addresses in server logs, to keep qriz.ai secure and working. For that purpose we are the controller.
02Information we collect
If you run a restaurant on qriz.ai
- Account details
- Your email address and password. Passwords are handled by our authentication provider and stored only as a secure hash; we can’t read them. If you choose “Continue with Google”, Google shares your name, email address and profile picture with us.
- Restaurant and menu content
- Your restaurant’s name, country, address, phone number, opening hours, logo, theme, promotions and links (such as your Google reviews page), and your menu: dishes, descriptions, prices, photos, allergens and nutrition details. This content is meant to be public. It appears on your guest menu. Your country also decides the currency your subscription is billed in. When you sign up, we suggest it from your IP address; the country you confirm is the one we save.
- Menu imports
- The photos, PDF files or web links you give us to build your menu. For a link, we load that page, including the menu files and pictures it links to, to read your menu.
- Billing
- Your plan, its billing currency, trial and subscription dates, and the amount, date and status of each payment. From our payment provider we receive the card type, a masked card number and its expiry date, so you can recognize the card on file. We never receive or store your full card number or security code.
- Communications
- Messages you send us, and the service emails we send you, such as trial reminders, payment receipts, failed-payment notices and warnings before your menu goes offline.
- Security data
- Sign-in records kept by our authentication provider (time, IP address and browser) and our server logs (IP address, time, requested address and browser type).
If you use a restaurant’s menu as a guest
You can browse any menu without creating an account or telling us who you are.
- Menu activity
- When you open a menu, your browser creates a random visitor ID and keeps it on your device. With it we record events such as opening the menu, scanning its QR code, opening a dish, and seeing or adding a suggested pairing, together with the menu language, your device type (phone, tablet or computer) and the time. We work out the device type from your browser’s user agent when the event arrives and store only that one word. We don’t store your IP address, your full user agent or your location with these events.
- Table bookings
- If the restaurant takes bookings through its menu and you book a table: your name, phone number, party size, date and time, the dishes you picked and their total, any note you add, the menu language and your visitor ID. Your booking is shared only with that restaurant.
- Ratings and feedback
- If you rate your visit: your stars, any topics you pick (wait, service, a dish, price, cleanliness or noise), your comment if you write one, the dish it’s about if you choose one, your table number if your QR code includes one, the menu language and your visitor ID. We don’t ask for your name, email or phone number, so please keep personal details out of comments. Your visitor ID stops the same device from rating the same restaurant again within 6 hours.
- Kept on your device
- The dishes on your list and your searches stay in your browser. Dishes reach us only if you include them in a booking.
- Your browser’s language
- Your browser’s language setting helps us choose which language to open the menu in.
- Links to Google
- After you rate a visit, we may offer a link to the restaurant’s Google reviews page, and the restaurant’s address opens in Google Maps. If you follow these links, Google’s privacy policy applies. We don’t send your rating or comment to Google.
If you visit qriz.ai
Our website uses no cookies, analytics or advertising trackers. To show prices in your currency, it asks our hosting provider which country your IP address is in; that answer is not stored. Our hosting provider processes your IP address and basic request details to deliver the pages and protect the site from abuse. If you email us, we use your address and message to reply.
03How we use information
We use personal information only for the purposes below. Where a law such as the EU or UK General Data Protection Regulation (GDPR) requires a legal basis, it is shown for each purpose.
| Purpose | What it involves | Legal basis |
|---|---|---|
| Run the Service | Create and secure accounts, publish menus, deliver bookings and ratings to the restaurant, and show statistics in its dashboard. | Contract with restaurant owners. For guest information, the restaurant’s basis: we act on its behalf. |
| AI features | Read imported menus, translate menus, write dish descriptions and nutrition estimates, and suggest pairings. | Contract |
| Billing | Run trials, charge subscriptions, send receipts and keep accounting records. | Contract; legal obligation |
| Service messages | Trial and payment notices, warnings before a menu goes offline, and product news in the dashboard. | Contract; legitimate interests |
| Security | Rate limits, sign-in protection, and investigating errors, fraud and misuse. | Legitimate interests |
| Improve qriz.ai | Understand which features are used, from aggregated information. | Legitimate interests |
| Legal matters | Comply with the law, respond to lawful requests, enforce our terms and resolve disputes. | Legal obligation; legitimate interests |
We don’t sell personal information, use it for advertising or build profiles of guests. We don’t make decisions about anyone based solely on automated processing that have legal or similarly significant effects.
04AI features
qriz.ai uses AI models from Anthropic (Claude) to read imported menus, translate menus into the languages a restaurant chooses, write dish descriptions and nutrition estimates, and suggest dish pairings with a short reason.
- What the AI receives
- Menu content only: dish and category names, descriptions, prices, photos, the menu files you upload and the pages you link to.
- What it never receives
- Guest bookings, ratings, comments, contact details or menu statistics.
- Training
- Anthropic processes this content to return results to us and, under its commercial terms, doesn’t use it to train its models. We don’t use your content to train AI models either.
- Your control
- AI can make mistakes, especially with allergens and nutrition. You can review and edit everything it writes.
05Cookies and device storage
We don’t use advertising cookies, third-party analytics or tracking pixels, and nothing we store follows you to other websites. Our website (qriz.ai) stores nothing in your browser. The guest menus and the dashboard keep a few small items there to make their features work.
Guest menus (menu.qriz.ai)
| Name | Type | Purpose | Kept for |
|---|---|---|---|
qz-lang | Cookie | Remembers the menu language you chose | 1 year |
qz-ui | Cookie | Remembers which version of the menu design to show | 30 days |
celvo-visitor | Local storage | Random visitor ID used to count visits and to prevent duplicate ratings | Until you clear it |
celvo-cart:‹restaurant› | Local storage | The dishes on your list | Until you clear it |
qz-recent:‹restaurant› | Local storage | Your recent searches on that menu | Until you clear it |
celvo-rated:‹restaurant› | Local storage | When you last rated, so you aren’t asked again too soon | Until you clear it |
qz-lang-toast | Local storage | That you’ve seen the language suggestion | Until you clear it |
celvo-lang | Local storage | Your language on the classic menu design | Until you clear it |
qz-visit:‹restaurant› | Session storage | When your visit started, so the menu asks for a rating at the right moment | Until you close the tab |
qz-rate-draft:‹restaurant› | Session storage | A star rating you haven’t sent yet | Until you close the tab |
Dashboard (dashboard.qriz.ai)
| Name | Type | Purpose | Kept for |
|---|---|---|---|
sb-…-auth-token | Cookies | Keep you signed in (set by our authentication provider) | Until you sign out or the session expires |
celvo-active-restaurant | Local storage | The restaurant you’re managing | Until you clear it |
celvo-theme | Local storage | Light or dark theme | Until you clear it |
celvo-reservation-sound | Local storage | Whether new bookings play a sound | Until you clear it |
celvo-onboarding | Session storage | Your progress through setup | Until you close the tab |
You can delete or block these in your browser settings. Menus keep working, but your preferences reset and you may be counted as a new visitor. The dashboard needs its sign-in cookies to keep you signed in.
06How we share information
We share personal information only in these cases:
- With the restaurant
- Bookings, ratings and menu statistics from a restaurant’s menu are available to that restaurant in its dashboard.
- With our service providers
- Companies that run parts of qriz.ai for us, listed below. They may use the information only to provide their services to us, under contracts that require them to protect it.
- For legal reasons
- When the law requires it, or to protect the rights, property or safety of our users, the public or Mtislab, including to prevent fraud.
- In a business transfer
- If Mtislab is involved in a merger, acquisition or sale of assets, information may transfer to the new owner under this policy. We’ll let you know before that happens.
We never sell or rent personal information.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | Singapore |
| Hetzner Online | Servers that run our application | Germany (EU) |
| Vercel | Hosting for our website, dashboard and guest menus | United States, with a global edge network |
| Anthropic | AI features (menu content only) | United States |
| Resend | Service emails | United States |
| Our payment provider, a licensed bank | Subscription card payments, on its own secure page | Where it is licensed |
| Optional “Continue with Google” sign-in | Global |
Our payment provider and Google act as independent controllers under their own privacy policies. We’ll update this list before we add a provider that processes personal information.
07International transfers
qriz.ai serves restaurants and guests around the world. Our providers process information in Germany, Singapore and the United States, and our payment provider processes card payments where it is licensed. Your information may therefore be processed outside the country where you live, under different data protection laws.
Where the law requires it, for example for information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents, included in our providers’ data processing agreements. Contact us for details.
08How long we keep information
We keep personal information only for as long as we need it for the purposes described above.
| Information | How long we keep it |
|---|---|
| Account, restaurant and menu content | While your account is open. We delete it within 30 days after you close your account. |
| Menu import files | Until you discard the import or close your account. |
| Billing records | As long as tax and accounting laws require. |
| Table bookings | Deleted automatically 7 days after the booked visit. |
| Ratings and feedback | While the restaurant’s account is open, unless the restaurant asks us to delete them sooner. |
| Menu statistics | While the restaurant’s account is open. |
| Server logs | Up to 30 days. |
| Rate-limit counters | About one minute, in memory only. |
Deleted information can stay in our providers’ backups for a short time until those backups are overwritten.
09How we protect information
- All connections to qriz.ai are encrypted with HTTPS (TLS).
- Our database and file storage are encrypted at rest by our providers.
- Each restaurant’s information is available only to its owner’s account, and our own access is limited to what is needed to run and support the Service.
- Passwords are stored only as secure hashes by our authentication provider.
- Card details are entered on our payment provider’s page and never reach our servers.
- Guest submissions (statistics, ratings and bookings) are rate-limited to prevent abuse.
No system is perfectly secure. If a breach affects your personal information, we’ll notify you and the relevant authorities as the law requires.
10Your rights and choices
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy, including in a portable, machine-readable format;
- correct information that’s inaccurate or incomplete;
- delete your information;
- restrict or object to some processing, including processing based on our legitimate interests;
- withdraw your consent at any time, where we rely on it.
Some rights have limits. For example, we must keep billing records for as long as the law requires.
- Restaurant owners
- You can update most information yourself in the dashboard and cancel your subscription under Billing. To close your account and delete your data, email us from the address on your account.
- Guests
- Guest information is held for the restaurant, so please contact the restaurant first. You can also write to us; we’ll pass your request on and help the restaurant respond. Since you don’t have an account, we’ll need details that let us find your information, such as the phone number used for a booking. You can remove your visitor ID at any time by clearing this site’s data in your browser.
- How to make a request
- Email info@mtislab.com. We may ask you to confirm your identity first, for example by writing from the email address on your account. We’ll reply within 30 days, free of charge. You can also make a request through an authorized agent; we may ask for proof of their authority.
- Complaints
- If you’re unhappy with how we handle your information, please tell us so we can put it right. You also have the right to complain to the data protection authority where you live or work.
- US state privacy rights
- If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect, use and disclose (the categories are described in this policy), and to access, correct and delete it. We don’t sell personal information, don’t share it for cross-context behavioral advertising, and use sensitive personal information, such as your account login, only to provide the Service. We won’t discriminate against you for exercising your rights.
- Do Not Track and Global Privacy Control
- We don’t track you across websites, so there is nothing to opt out of. These browser signals don’t change how qriz.ai works.
11Children
qriz.ai isn’t directed to children under 16, and we don’t knowingly collect their personal information. Children under 16 shouldn’t book a table or send feedback without a parent or guardian. If you believe a child has given us personal information, contact us and we’ll delete it.
12For restaurants: guest information
When you take bookings or collect ratings through qriz.ai, you decide to collect that guest information, so you are its controller. You’re responsible for having a lawful basis to collect it and for telling your guests how you use it. Linking to this policy can help. For our part, we:
- process guest information only to run the Service for you and as you instruct;
- keep it confidential and secure, and use only the providers listed in this policy;
- help you respond to guest requests, and tell you without undue delay about any breach affecting it;
- delete bookings automatically after 7 days, and delete the rest when you close your account.
If you need a data processing agreement, contact us.
13Changes to this policy
We’ll update this policy as qriz.ai changes; the date at the top shows when it last changed. If we make significant changes, we’ll tell restaurant owners by email or in the dashboard before they take effect.
14Contact us
For questions or requests about privacy, email info@mtislab.com. qriz.ai is operated by Mtislab LLC.