Privacy Policy

Last updated: August 6, 2026

AR Menu ("we," "us," or "our") operates the AR Menu platform, consisting of the restaurant dashboard at dashboard.armenu.me, the diner-facing menu application at menu.armenu.me, the marketing website at armenu.me, and the backend API at api.armenu.me (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Platform, and describes your rights under applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the CPRA.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of the Platform immediately.

1. Who We Are

AR Menu is a 3D augmented reality restaurant menu platform operated by Nourdine Ouakhroun, a sole proprietor registered in Morocco. For the purposes of the GDPR, we act as a data controller for restaurant owner account data and as a data processor for diner data processed on behalf of our restaurant clients.

We have appointed a Data Protection Officer who may be reached at:

2. Data We Collect

2.1 Data Collected from Restaurant Owners

When you create an account on our dashboard, we collect the following personal data:

2.2 Data Collected from Diners (End Users)

When a diner scans a QR code and accesses a restaurant's menu through our Platform, we collect:

2.3 Data Collected from All Visitors (Guest Sessions)

Even without creating an account, when you visit our landing page or any public-facing page, we may collect:

• IP address — temporarily processed for security, rate limiting, and DDoS protection. Full IP is stored in server logs for a maximum of 30 days.
• User-Agent string — stored alongside IP for security log correlation.
• Referrer URL — the page you arrived from, used for attribution analytics.
• Visitor ID — a randomly generated UUID stored in localStorage that persists across sessions, used to distinguish unique visitors for page-view analytics. This ID is not linked to any personal identity.

3. How We Use Your Data

We use the data we collect for the following purposes and on the following legal bases:

We do not engage in automated decision-making (including profiling) that produces legal effects concerning you. We do not sell personal data as defined under the CCPA/CPRA.

4. Legal Basis for Processing (EEA/UK Residents)

For individuals in the European Economic Area and the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the Platform services you have requested — account creation, menu hosting, 3D model generation, payment processing.
• Consent (Art. 6(1)(a)): Where you have given clear consent — marketing emails, non-essential cookies/FingerprintJS, transfer of dish photos to Meshy AI for 3D generation. You may withdraw consent at any time (see Section 10).
• Legitimate interests (Art. 6(1)(f)): Where processing is necessary for our legitimate interests or those of a third party (our restaurant clients), provided those interests are not overridden by your rights — fraud detection, security monitoring, error tracking, platform analytics, menu delivery to diners who have scanned a QR code.
• Legal obligation (Art. 6(1)(c)): Where processing is necessary to comply with the law — tax records, law enforcement requests, data breach notification.

5. Third-Party Data Sharing

We share data with the following categories of third-party service providers. Each provider has been vetted for GDPR compliance and, where applicable, is bound by Standard Contractual Clauses or equivalent transfer mechanisms.

5.1 Meshy AI — 3D Model Generation Disclosure

When a restaurant owner uploads dish photographs to generate 3D models, those photographs are transmitted to Meshy AI's servers for processing. Meshy processes the images solely to generate a 3D mesh and returns the resulting model file. Meshy's own privacy policy and terms govern their handling of the image data during processing. We do not send any personal identity data alongside dish images — only the image file itself with a randomly generated task identifier. Meshy's standard terms grant them a limited license to use uploaded content for the purpose of providing their service; generated 3D models remain your intellectual property subject to the license terms in our Terms of Service.

5.2 No Sale of Personal Data

We do not sell, rent, or trade personal data to any third party for monetary or other valuable consideration. We do not share data with advertising networks, data brokers, or analytics aggregators that would use your data for their own purposes.

6. Cookies and Browser Storage

Our Platform uses the following storage mechanisms in your browser. For a complete breakdown including durations and management instructions, please see our Cookie Policy.

6.1 Summary of Storage by Category

• Necessary (always active): CSRF protection token (sessionStorage), authentication session identifier (httpOnly cookie set by our API — not accessible to JavaScript), language preference (localStorage), JWT access token (in-memory, not persisted).
• Functional / Analytics (opt-in): FingerprintJS visitor ID (localStorage — a hash of browser characteristics used to distinguish unique diners and prevent abuse), diner session identifier (localStorage — a randomly generated UUID for session continuity across page refreshes), last visited restaurant (localStorage — for return-diner convenience).
• Third-party (byproduct of service delivery): Google Fonts CDN does not set cookies, but your IP address and User-Agent are transmitted to Google servers when fonts load. Cloudflare may set a __cf_bm cookie for bot management on our API domain.

You can manage or delete cookies and site data at any time through your browser settings. Blocking necessary cookies may prevent the Platform from functioning correctly.

7. Data Retention

8. International Data Transfers

AR Menu is based in Morocco. Our primary infrastructure providers are located in the United States (Supabase, Heroku, Cloudflare, Meshy, Stripe, Sentry, FingerprintJS). When you use our Platform, your personal data is transferred to and processed in the United States and other jurisdictions where our service providers operate.

For transfers from the EEA, UK, or Switzerland to countries not recognized as providing an adequate level of data protection, we rely on:

• Standard Contractual Clauses (SCCs): We have entered into the European Commission's approved Standard Contractual Clauses (2021/914) with each of our US-based processors (Supabase, Stripe, Cloudflare, Sentry, Heroku, Meshy). These SCCs include the required supplementary measures, including encryption at rest (AES-256) and in transit (TLS 1.3), and a commitment from each processor to notify us of any government access requests where legally permitted.
• UK International Data Transfer Agreement: Where applicable, we rely on the UK IDTA or the UK Addendum to the EU SCCs.
• Data Processing Agreements (DPAs): Each processor has signed a DPA with us that incorporates the SCCs and specifies the subject matter, duration, nature, and purpose of processing, the types of personal data, and the categories of data subjects.

You may request a copy of the relevant safeguards by contacting dpo@armenu.me.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

• Encryption in transit: All communications between your browser and our servers are encrypted using TLS 1.3 (HTTPS). HSTS is enforced with a max-age of one year and includeSubDomains.
• Encryption at rest: All data stored in Supabase PostgreSQL is encrypted at rest using AES-256. Files stored in Cloudflare R2 are encrypted at rest using AES-256. Backups are encrypted.
• Password hashing: User passwords are hashed using bcrypt with a per-user salt and a work factor of 12. Plaintext passwords are never stored.
• Access control: Database access is restricted to the Supabase service role key, which is stored as an environment variable and never exposed client-side. Row-Level Security (RLS) policies are enforced on all tables containing user data.
• Token security: JWTs are signed with RS256 and have a 15-minute expiry. Refresh tokens are stored in a database table and can be revoked server-side. A token blocklist check runs on every authenticated request.
• API security: Rate limiting is applied on authentication endpoints (5 requests per minute per IP) and public endpoints. Security headers (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) are set on all responses.
• Monitoring: Sentry provides real-time error monitoring. Suspicious activity alerts are configured for repeated failed login attempts and unusual API usage patterns.
• Development practices: All code changes undergo CI checks (linting, type checking, security scanning with Bandit). Dependencies are regularly audited. No production data is used in development or staging environments.

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required by law) and will notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise any of these rights, email dpo@armenu.me with the subject line "Data Subject Request." We will verify your identity before processing the request (typically by confirming your email address matches the one associated with your account, or by requesting additional verification for non-account holders). We will respond within 30 days, with a possible two-month extension for complex requests (we will notify you of any extension within the initial 30 days).

These rights are provided free of charge unless the request is manifestly unfounded or excessive (in particular because of its repetitive character), in which case we may charge a reasonable fee or refuse to act.

11. Children's Privacy

Our Platform is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction — e.g., 16 in certain EU member states under GDPR Art. 8). We do not knowingly collect personal data from children. The restaurant dashboard requires account registration and is intended for restaurant owners and staff who are 18 years of age or older. If we learn that a child under the applicable age has provided us with personal data without verifiable parental consent, we will delete that data promptly. If you believe a child has provided us with personal data, please contact dpo@armenu.me.

12. Contact Information

For EEA residents: You may lodge a complaint with the supervisory authority in your member state of residence, place of work, or place of the alleged infringement. A list of EU data protection authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

For residents of Morocco: we process personal data in accordance with Law No. 09-08 on the protection of individuals with regard to the processing of personal data. You have the right to be informed, and the rights of access, rectification, and objection (Articles 5, 7, 8 and 9 of Law No. 09-08), which you can exercise by emailing dpo@armenu.me. You may also lodge a complaint with the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP) at https://www.cndp.ma.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. When we make material changes, we will notify restaurant owners via email (to the address associated with their account) and will post a prominent notice on the Platform at least 30 days before the changes take effect. For diners and visitors, we will update the "Last updated" date at the top of this page. Continued use of the Platform after changes become effective constitutes acknowledgment and acceptance of the updated policy.

We recommend reviewing this policy periodically. The version history is maintained in our internal records and available upon request.