Privacy Policy

Last updated: 4 November 2026

kart.menu is operated by EFIRITY PTE. LTD., Singapore (UEN 202402844G), 68 Circular Road #02-01, Singapore 049422. We are responsible for the personal data described here. Questions and requests: support@kart.menu.

The short version: you do not create an account, and we do not ask for your name, email or phone number. We use what you upload to make your menu, Stripe takes the payment, and we count visits with Google Analytics (in Europe only if you accept). There are no advertising trackers on kart.menu, and none on the menus guests read.

What we collect and why

• Your menu. The photos, PDFs or link you give us (our server opens that link to read the menu), and what you add while checking it: the venue's name, corrections, languages, logo, colours and, if you add one, the link where guests can review you on Google. We use it to make, publish and change your menu. A published menu is public by design: anyone with its link or QR code can read it.
• Payments. Stripe handles them on its own page. We receive whether the payment went through and its amount, linked to your menu. We never see or store card numbers.
• Guest feedback. Guests reading a published menu can send the venue a rating and a short message. We keep them with the menu for the venue to read. Guests are not asked for their name or contact details.
• Technical data. Your IP address is used for a short time to limit how many menus can be started per hour, which protects the service from abuse. When you open kart.menu, the country of your IP address and the languages your browser asks for are used once to show the site in your language; the country is looked up in a database on our own server and nothing about it is stored. We do not fingerprint browsers. Our servers keep standard access logs (IP address, time, page requested and browser) for security and troubleshooting.

Analytics

kart.menu's own pages (the home page in every language, the menu generator, support, terms and this page) use Google Analytics to see how many people visit and where they give up. In the EU, the EEA, the UK and Switzerland it asks first: a small bar at the bottom of the page offers Accept or Decline, and until you accept, Google Analytics runs in its consent mode with every kind of storage turned off, so it sets no cookies and cannot recognise you from one visit to the next. Elsewhere it sets its own cookies (_ga, _ga_*, up to two years) to count returning visitors. Your choice is kept on your device (kart.consent), and you can change it by clearing this site's data in your browser. To decide whether to ask, the country of your IP address is looked up on our server and not stored.

What is counted: pages viewed, and the steps of making a menu (the way you chose, upload started, preview ready, checkout, paid), with counts and amounts only; never your venue's name, your menu, a link you pasted or anything you typed. Google signals, advertising features and ad personalisation are off everywhere. The menus guests read under kart.menu/m/ have no analytics at all.

On your device

• Your browser keeps your menu's draft number and a private edit key (local storage), so you can come back to your menu. We store only a hash of that key.
• The photos or PDF you pick on the home page are passed to the generator through your browser's storage (IndexedDB) and removed once it has read them.
• A cookie named lang remembers the language you picked, for one year.

These are needed for the site to work. Google Analytics' cookies are described under Analytics; there are no advertising or tracking cookies.

Who processes it

We share data only with the services that make kart.menu work, and only for that purpose. We do not sell personal data.

• Anthropic (Claude API) (United States): Reads the photos, PDFs and pages of your menu and translates it. Under Anthropic’s commercial terms, content sent through its API is not used to train its models. Privacy policy.
• Stripe (United States, and Stripe’s local companies): Takes the payment on its own payment page: card or wallet details, and the email address Stripe may ask for to send a receipt. Privacy policy.
• OVHcloud (Germany and the United Kingdom): Hosts our servers, where uploads, drafts, published menus and server logs are stored. Privacy policy.
• Google Analytics (Google LLC) (United States): Counts visits to kart.menu’s own pages and the steps of making a menu (see “Analytics” below). Privacy policy.

Some of these services are outside your country, including in the United States. We rely on their contractual commitments to protect the data they process for us.

The country lookup uses IP Geolocation by DB-IP, licensed underCC BY 4.0. It runs on our server: your IP address is not sent to DB-IP.

How long we keep it

• A published menu, its files and its guest feedback: for as long as the menu is online. Paid menus stay online unless you ask us to remove them.
• Uploads and drafts that were never paid for: until we delete them, or sooner if you ask.
• Server logs: for a limited time, for security and troubleshooting.
• Payment records: as long as the law requires for accounting.

Your rights

You can ask us for a copy of your data, to correct it, to delete it or to stop using it, under Singapore's Personal Data Protection Act and, where it applies to you, the GDPR. Email support@kart.menu with your menu's link; we may ask you to show the menu is yours. We answer within 2 business days and act within a month. You can also complain to the Personal Data Protection Commission of Singapore or to the data protection authority where you live.

Security

The site and the menus are served only over HTTPS. Edit keys are stored only as hashes, and the admin side of kart.menu needs its own key.

Children

kart.menu is a service for restaurants, cafés, bars and hotels, and is not meant for children.

Changes

We may update this policy; the date at the top says when it last changed.

Contact

EFIRITY PTE. LTD., 68 Circular Road #02-01, Singapore 049422.
Email: support@kart.menu. See also support and the terms of service.