Privacy Policy

Last updated: 24 October 2026 (version 2026-10-24)

This Policy has two parts. The main text (Sections 1-17) applies to all users and visitors, wherever they are located. The annexes at the end of this document supplement the main text with rules that apply to persons in a particular country or region. Where an annex differs from the main text, the annex prevails for the persons it covers.

1. Data controller

The controller of personal data is NENAD BUGARSKI PR AGENCIJA ZA KREATIVNE MEDIJE I PROGRAMIRANJE PIXELSPIRE SRBOBRAN, Vrbaska br. 4, 21480 Srbobran, Republic of Serbia, company ID 62838167, tax ID 107575085 ("we"). For any questions or requests about your data, write to [email protected].

This Policy explains which personal data we process when you use the IzeshMenu platform (izeshmenu.com, the "Platform"), for what purposes and on what legal basis, who we share it with, how long we keep it and what rights you have.

2. Whose data we process

• Users - people who have an account: venue owners and editors, i.e. users whom an owner has given access to edit their venue (e.g. staff, contractors, photographers, designers or agencies).
• Guests - visitors of public menus (via a QR code or link).
• Website visitors - who send the contact form or sign up for the newsletter.

3. What data we process

• Account data: name, email address, password (stored only as a hash, we cannot read it), phone number if you provide it, language, profile picture and name if you sign in with Google, and records of your acceptance of the Terms and Conditions and this Policy (version, time and method).
• Billing data: company or venue name, address, city, country, tax ID or tax number, company ID and billing email.
• Venue data and content: name, address, logo, photos, menus, translations and settings. These are mostly not personal data, unless you enter them yourself (e.g. the owner's name in the venue name or photos of staff).
• Roles on venues: who is the owner and who is an editor of a venue, who added an editor or transferred a venue to another account and when, requests for access to a venue (status, time and the message the editor sends with the request) and the account setting that you also edit other people's venues.
• Payment data: card details are collected and processed by Paddle - we never see or store them. From Paddle we receive customer, transaction and subscription data (e.g. email, address, amount, status). For payments made against a pro-forma invoice, we process payment details (amount, payment reference, date).
• Consents and requests: the consent given when purchasing an annual subscription (version of the terms, time, IP address), cancellation and refund requests and their outcome.
• Communication: the content of messages sent through the contact form or by email (name, venue name, email, phone, message, language, IP address); for the newsletter, email address and language, together with the time and IP address of sign-up and confirmation.
• Technical and security data: IP address, time and type of request, data about active sessions (IP address and browser, visible to you in your account settings), records of sign-ins and failed sign-in attempts, and records of administrative actions.
• Guests of public menus: we process the technical data needed to display the menu and prevent abuse (IP address in server logs and for rate limiting) and the data for our own view statistics described below. We do not profile guests or track them on other websites, and on public menus we do not use cookies for analytics or any advertising tools.
• Our own view statistics (public website and public menus): the address of the page opened, the page you came from, the type of device, browser and operating system, language, country (determined from the IP address, which we do not store) and time; on a public menu, also which menu, language and items were opened. We keep these statistics on our own server, without cookies and without storing anything on your device. To count unique visits, we create a one-way hash of the IP address and browser data using a key that is changed and deleted every 24 hours, after which the visit can no longer be linked to you.
• Google Analytics (only on the public website izeshmenu.com, not on public menus or in the admin area, and only if you accept it in the cookie notice): data about visits and use of the website, identifiers from cookies and approximate location. Google Analytics does not store your IP address.

4. Purposes and legal bases

• Opening and managing accounts, providing the service and support - performance of a contract with you.
• Managing access to venues: adding and removing editors, access requests, transferring a venue to another account and emails about these - performance of a contract with the owner and with the editor.
• Billing, pro-forma invoices, invoices and bookkeeping - performance of a contract and legal obligation.
• Notices about your account, payments and material changes to the service - performance of a contract.
• Proof of acceptance of the terms and of consents given, handling of complaints and disputes - legitimate interest and legal obligation.
• Security, prevention of abuse and fraud, protection against attacks - legitimate interest.
• Maintaining and improving the Platform based on technical logs - legitimate interest.
• Our own view statistics for the website and public menus, and the aggregate statistics shown to the venue - legitimate interest (so that we know how the website and menus are used, and the venue knows how often its menu is viewed), without cookies.
• Google Analytics on the public website - consent, which you may withdraw at any time (Section 9).
• Newsletter - consent, which you may withdraw at any time via the link in the email or by writing to us.
• Responding to requests of competent authorities - legal obligation.

Where we rely on legitimate interest, we have assessed that it does not override your rights; you have the right to object to such processing (Section 12). The statutory provisions on which these legal bases rest are listed in the annexes.

5. AI processing

When you use AI menu recognition, AI descriptions or automatic translations, we send menu photos and text to OpenAI (OpenAI, L.L.C., USA) for processing. We send only the content needed for processing, without your account data. We have disabled storage of results in OpenAI's archive; under its own rules OpenAI may retain requests for a limited time to prevent abuse and does not use data sent via its API to train models. Do not submit photos containing personal data for AI processing. AI processing is used only to prepare menu content and does not make decisions with legal effects on you.

6. Who we share data with

We do not sell or rent personal data and we do not share it for advertising. We share it only with processors that provide technical services to us, under contract and to the extent needed for the service, and with the other recipients listed below:

• Hetzner Online GmbH (Germany) - server and database, in data centres in the EU;
• Amazon Web Services - storage of photos, documents and backups (EU region, Stockholm);
• OpenAI - AI menu processing and translations (USA);
• Resend - sending emails (USA);
• Cloudflare - bot protection for forms, Turnstile (USA);
• Google - sign-in with a Google account, if you choose it; Google Analytics on the public website, only with your consent (Google Ireland Limited as processor, with transfer to Google LLC in the USA); fonts used by some public menu themes (Google Fonts), in which case Google sees the IP address of the guest's browser;
• Have I Been Pwned - checking whether a new password has appeared in known data breaches; we send only the first 5 characters of the password hash, never the password or email;
• Paddle.com Market Limited (United Kingdom) - seller and processor of card payments; it processes payment data as an independent controller under its own privacy policy;
• our bank and accounting service - to record payments and keep business books;
• competent authorities - where we are required to by law;
• a legal successor - if the Platform or part of it passes to another person (e.g. through the sale of the business), subject to an obligation to comply with this Policy.

Guests of public menus see only the content the venue has published. The venue receives from us only aggregate view statistics for its menu (e.g. number of views per day, languages, most viewed items), from which it is not possible to determine who viewed the menu.

Venue owners and editors see some of each other's data, because this is part of the service they use. On the Editors page, the owner sees the name and email address of their venue's editors and of people requesting access, as well as the message sent with a request. When an editor requests access, we email the owner the venue name, the editor's email address and the message; when an owner adds an editor, the editor receives an email with the venue name. An editor sees the content and settings of the venue they edit, but not the owner's payment and billing data or the venue's other editors.

7. Where data is processed and transfers to other countries

The Platform and its database run on servers in the European Union, and we are based in Serbia. Some processors (OpenAI, Resend, Cloudflare, Google, Paddle) process data in the USA, the United Kingdom or other countries. We make such transfers only with appropriate safeguards, such as an adequacy decision, a data transfer framework the processor has joined, or standard contractual clauses. You can ask us for information on the safeguards applied.

8. How long we keep data

• Account data and content (including photos): while the account exists. After an account is deleted, they are erased within 30 days, and from backups within a further 35 days.
• Roles on venues: an editor's access lasts until the owner removes them or the editor leaves the venue, and also ends when the venue or the owner's or editor's account is deleted; we keep an access request until the owner accepts or declines it, and at most until the venue or the editor's account is deleted. Content an editor enters on another person's venue is part of that venue and is deleted together with the venue.
• Sign-in sessions: until you sign out, and no longer than 30 days from last use.
• Pro-forma invoices, invoices and billing data: for the periods required by accounting and tax law, also after the account is deleted.
• Payment, consent and refund request data: for the duration of the subscription, and afterwards until the limitation periods for contractual claims expire.
• Contact form messages: up to 24 months.
• Our own statistics: individual visit records for up to 13 months; the key for counting unique visits for 24 hours; aggregate figures containing no personal data may be kept indefinitely.
• Google Analytics: data is kept for 14 months, and cookies for up to 13 months; we remember your choice in the cookie notice for 12 months.
• Newsletter: until you withdraw consent; unconfirmed sign-ups are deleted automatically after 7 days. After you unsubscribe, we keep only your email address and the record of unsubscribing, so that we do not send you messages again.
• Security and administrative records: up to 24 months, unless needed longer to resolve a specific incident or dispute.

9. Cookies, statistics and local storage

We use strictly necessary cookies and similar technologies so that the Platform can do what you have asked for; the law does not require consent for these. We place analytics cookies (Google Analytics) only on the public website and only once you accept them in the cookie notice. The "Accept" and "Reject" buttons are equally accessible, and rejecting does not affect your use of the website. You can change or withdraw your choice at any time via the "Cookie settings" link in the website footer. If your browser sends a Global Privacy Control signal, we treat it as a rejection of analytics cookies. On public menus and in the admin area we use only strictly necessary cookies. We do not use advertising cookies.

We keep our own view statistics (Section 3) without cookies and without storing anything on your device, so they also work when you reject analytics cookies.

We choose the website language based on your browser settings, without cookies.

10. Security

We apply technical and organisational safeguards: encrypted connections (HTTPS), passwords stored only as hashes, checking passwords against known data breaches, restricted access to data, protection against password guessing and bots, logging of administrative actions and regular backups. No system is completely secure; in the event of a data breach likely to put your rights at risk, we will notify the competent authority and you within the deadlines set by law.

11. Automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Automated protection against bots and password guessing may temporarily block a request; if that happens, you can contact us and we will review it manually.

12. Your rights

We grant the following rights to everyone, wherever you are located:

• the right to know which data we process and to obtain a copy;
• the right to rectification and completion of inaccurate or incomplete data;
• the right to erasure, except for data we are legally required to keep;
• the right to restriction of processing;
• the right to data portability in a structured, machine-readable format;
• the right to object to processing based on legitimate interest and to receiving the newsletter;
• the right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• the right not to be discriminated against for exercising these rights (we do not refuse service or change the price).

Send requests to [email protected], preferably from your account email so we can verify your identity. A request may also be submitted by a person you have authorised, with proof of authorisation. We respond without delay and within 30 days at the latest; if a request is complex, we may extend this period within the limits of the law that applies to you, and we will inform you of this. If we refuse a request, we will give reasons; you can ask us to reconsider by replying to our email, and you also have the right to lodge a complaint with a supervisory authority. The competent authorities and specific rights are listed in the annexes.

13. Guest data and the venue's responsibility

The Platform does not collect guest data on behalf of venues (there are no orders, reservations or guest accounts on the Platform). If a venue enters personal data into its menu or gallery (e.g. names or photos of staff or guests), the venue is responsible for that data as controller and must have a legal basis for publishing it; we process that data only as a processor, under the terms set out in the Terms and Conditions (section "Processing of data on behalf of the User").

14. Minors

The Platform is intended for business users and is not directed at children. We do not knowingly open accounts for persons under 18 or collect children's data. If we learn that we have collected such data, we will delete it.

15. Sale of data and advertising

We do not sell personal data, share it for targeted advertising or track you on other websites. We use Google Analytics only to measure visits to our website, with advertising features and data sharing with Google for its own purposes switched off. That is why we do not offer an opt-out from sale or sharing - there is none to opt out of. If we ever change this, we will first amend this Policy and provide an opt-out, or ask for consent where the law requires it.

16. Changes to this Policy

We may update this Policy. The date of the last update is shown at the top, and each annex also has its own date. We notify the users affected by material changes by email or in the app before the changes take effect.

17. Language and annexes

This Policy is available in several languages; in case of any discrepancy, the Serbian version prevails. The annexes for specific countries and regions are set out below. Annexes for new countries are added over time; adding a new annex does not change the main text or the rights under existing annexes.

Annex A - European Union and European Economic Area

Effective from: 15 October 2026. Applies to persons located in the European Union, Iceland, Liechtenstein or Norway. The processing of their data is governed by the General Data Protection Regulation (EU) 2016/679 ("GDPR"), because we offer services to them (Art. 3(2) GDPR).

• Legal bases from Section 4: performance of a contract - Art. 6(1)(b); legal obligation - Art. 6(1)(c); legitimate interest - Art. 6(1)(f); consent - Art. 6(1)(a) GDPR.
• You exercise the rights in Section 12 in accordance with Articles 15-22 GDPR. We respond within one month; this period may be extended by a further two months where a request is complex or there are many requests (Art. 12(3) GDPR).
• You have the right to lodge a complaint with the supervisory authority in the Member State where you live or work or where the infringement took place (Art. 77 GDPR). List of supervisory authorities: edpb.europa.eu.
• Transfers of data to the USA and other third countries are based on an adequacy decision (including the EU-U.S. Data Privacy Framework for processors that have joined it) or on the European Commission's standard contractual clauses (Articles 45 and 46 GDPR).
• The strictly necessary cookies described in Section 9 do not require consent, and analytics cookies are placed only with your consent, in accordance with the national laws implementing Directive 2002/58/EC (Art. 5(3)) and Art. 6(1)(a) GDPR. Our own statistics do not access your device and are based on legitimate interest (Art. 6(1)(f) GDPR); you may object to them.
• We notify the competent authority of a personal data breach within 72 hours where required (Art. 33 GDPR), and you without undue delay where the breach is likely to result in a high risk to your rights (Art. 34 GDPR).

Annex B - United States of America

Effective from: 23 October 2026. Applies to persons residing in the United States. Some states have privacy laws (e.g. California - CCPA/CPRA, Virginia, Colorado, Connecticut, Texas and others). These laws apply to us only once we meet their thresholds; regardless, we extend the rights described here to all US residents.

• Categories of personal information we collect: identifiers (name, email, IP address, identifiers from analytics cookies), customer records (billing address, phone), commercial information (subscriptions and payments), internet activity information (records of sign-ins and requests, view statistics), approximate location (country or city determined from the IP address), professional information (venue name and details, role as owner or editor of a venue) and account login data (email and password stored as a hash). Sources, purposes, recipients and retention periods are set out in Sections 3, 4, 6 and 8.
• We use account login data only for signing in and account security, not to infer characteristics about you.
• We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months. Google Analytics processes data on our behalf as a service provider, with advertising features switched off. We have no actual knowledge that we sell or share the personal information of persons under 16.
• Rights: to know what data we collect and obtain a copy, to request deletion, correction, limitation of the use of sensitive personal information and an opt-out from sale or sharing (which we do not engage in), and the right not to be discriminated against for exercising your rights. We accept requests at [email protected]; we verify your identity by matching it against your account data. An authorised agent may submit a request with written authorisation.
• We respond within 45 days, which may be extended by a further 45 days with notice to you. If we refuse a request, you may appeal by replying to our email with the subject "Appeal"; we decide on the appeal within the period required by the law of your state. If the appeal is denied, you may contact the Attorney General of your state.
• Global Privacy Control and "Do Not Track" signals: we treat a GPC signal as a request to opt out of sale and sharing and as a rejection of analytics cookies. We do not respond specifically to "Do Not Track" signals, because we do not track you on other websites; in any case, we place analytics cookies only with your consent.
• California (Shine the Light, Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.
• Data is processed and stored outside the United States (in the EU and Serbia), as described in Section 7.

Annex C - Republic of Serbia

Effective from: 15 October 2026. Applies to all persons whose data we process, because the controller is established in Serbia, together with the rules in the other annexes that apply to persons from those countries. The Law on Personal Data Protection ("Official Gazette of the RS", No. 87/2018, "ZZPL") applies.

• Legal bases from Section 4: performance of a contract - Art. 12(1)(2); legal obligation - Art. 12(1)(3); legitimate interest - Art. 12(1)(6); consent - Art. 12(1)(1) ZZPL.
• You exercise the rights in Section 12 in accordance with Articles 26-38 ZZPL. We respond without delay and within 30 days at the latest; this period may be extended by a further 60 days where necessary given the complexity and number of requests, and we will inform you of this (Art. 21 ZZPL).
• You have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs) and the right to judicial protection.
• Data is transferred from Serbia to countries with an adequate level of protection or subject to appropriate safeguards under the ZZPL, such as standard contractual clauses in accordance with the ZZPL (Articles 64 and 65 ZZPL).
• The strictly necessary cookies described in Section 9 do not require consent, and analytics cookies are placed only with your consent, in accordance with the law governing electronic communications and Art. 12(1)(1) ZZPL. Our own statistics do not access your device and are based on legitimate interest (Art. 12(1)(6) ZZPL).
• We notify the Commissioner of a personal data breach within 72 hours where required (Art. 52 ZZPL), and you without undue delay where the breach is likely to result in a high risk (Art. 53 ZZPL).