Privacy Policy

1. Data Controller

The data controller for personal data collected through menucraft.digital is:

As data controller, E Social Media determines the purposes and means of processing your personal data and is responsible for its lawful handling.

2. Data We Collect

Account & Registration Data

When you create an account, we collect your name, email address, and password (stored as a cryptographic hash — never in plain text). Your business name and any optional profile information you provide are also stored.

Menu Content

All content you create — categories, items, descriptions, prices, images, logos, and theme settings — is stored to provide the Service.

Payment & Billing Data

Payment processing is handled by Stripe. We do not store credit card numbers or sensitive financial data on our servers. We retain only your subscription status, plan tier, subscription date, and Stripe customer ID.

Usage & Technical Data

We may collect standard server logs including your IP address, browser type, operating system, referring URL, and pages visited. This data is used for security monitoring and service improvement.

Cookie Data

We use cookies for session management and, with your explicit consent, for analytics purposes. See our Cookie Policy for full details.

3. How We Use Your Data

• To create and manage your MenuCraft account
• To provide, operate, maintain, and improve the Service
• To process payments and manage your subscription through Stripe
• To send transactional emails (account confirmation, password reset, payment receipts)
• To respond to support requests sent to support@menucraft.digital
• To detect, investigate, and prevent security incidents and abuse
• To comply with applicable legal obligations under French and EU law

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

4. Legal Basis for Processing (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)) — processing your account data and content to deliver the Service you subscribed to
• Legitimate interests (Art. 6(1)(f)) — security monitoring, fraud prevention, and service improvement
• Consent (Art. 6(1)(a)) — analytics cookies; you can withdraw consent at any time via the cookie banner
• Legal obligation (Art. 6(1)(c)) — retaining billing records as required by French accounting law (Code de commerce, Art. L123-22)

5. Third-Party Services

We share data only with the following trusted sub-processors, strictly for operating the Service:

• Stripe (United States / EU) — payment processing; GDPR compliant via Standard Contractual Clauses
• Hostinger (Lithuania / EU) — web hosting and server infrastructure; data stored within the EU
• Google Analytics — anonymous usage analytics, loaded only with your prior cookie consent

All third-party processors are contractually required to process your data only as instructed and in compliance with GDPR.

6. Data Retention

We retain your personal data for as long as your account remains active or as necessary to provide the Service. Upon account deletion:

• Your menu content, profile data, and account information are deleted within 30 days
• Billing and invoice records are retained for 10 years as required by French commercial law
• Server access logs are retained for up to 12 months for security purposes
• Anonymized or aggregated analytics data may be retained indefinitely

7. Your GDPR Rights

As a data subject under the GDPR (Regulation (EU) 2016/679), you have the following rights with respect to your personal data:

To exercise any of these rights, send a written request to support@menucraft.digital. We will respond within 30 days of receipt. We may ask you to verify your identity before processing the request.

You also have the right to lodge a complaint with the French data protection authority, the CNIL, at cnil.fr.

8. Cookies

We use strictly necessary cookies for session management and security (CSRF protection), which cannot be disabled as they are essential to the platform's operation. We use optional analytics cookies only with your prior, freely given, specific, and informed consent.

You can manage or revoke cookie consent at any time via the cookie preference banner or through your browser settings. For full details, see our Cookie Policy.

9. International Transfers

Your data is primarily stored on servers located within the European Union (Hostinger, Lithuania). Where data is transferred to processors outside the EU — such as Stripe (US operations) — we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include HTTPS encryption for all data in transit, bcrypt password hashing, CSRF token protection, and session isolation.

No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it responsibly to support@menucraft.digital.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or via a notice in the platform. Continued use of the Service after notification constitutes acceptance of the updated policy.

12. Contact & CNIL

For any privacy-related questions, data subject requests, or concerns, contact us at:

If you believe your data protection rights have been violated, you may file a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés): cnil.fr/fr/plaintes.