Privacy Policy
Last updated: July 2026
Introduction
MenuCrush takes the protection of your personal data seriously. This policy explains what data we collect, why, and what your rights are, in accordance with the General Data Protection Regulation (GDPR).
Data controller
MenuCrush is published by CrushCode. For any question regarding your personal data, you can contact us at contact@crushcode.fr.
Data collected
We only collect the data necessary for the service to work:
- Account: email address and password (stored encrypted) allowing access to your management dashboard.
- Restaurant: name, description, address, phone number, opening hours, logo, and dish photos that you provide to build your menu.
- Billing: payment data (card number, etc.) is entered and processed directly by our provider Stripe; MenuCrush never accesses or stores it.
Cookies used
The table below details the cookies set while you browse MenuCrush.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sb-access-token, sb-refresh-token | Technical | Keep you signed in (Supabase authentication) | Session to 7 days |
| cookie-consent | Preference | Remember your cookie choice | 1 year |
| cf_clearance | Technical | Anti-bot protection during sign in and sign up (Cloudflare Turnstile) | Session |
| __stripe_mid, __stripe_sid | Technical | Payment security when subscribing to a plan (Stripe) | 30 minutes to 1 year |
Sub-processors and third-party services
We rely on the following providers, which may process some of your data as part of their service:
- Supabase — database hosting, authentication, and image storage (hosted in Europe).
- Stripe — payment processing and subscription management.
- Upstash — request rate limiting to protect the service against abuse.
- Vercel — application hosting.
Data retention
Your data is kept for as long as your account is active. If you delete your account, your data (restaurant, menu, photos, settings) is permanently erased, except for billing data that Stripe may be legally required to retain.
Your rights
In accordance with the GDPR, you have the following rights over your personal data:
- Right of access to your data
- Right to rectify your data
- Right to erasure of your data
- Right to object to processing
- Right to data portability
To exercise these rights, contact us at contact@crushcode.fr. You can also delete your account and all associated data at any time from your settings.
Security
We implement appropriate technical and organizational measures (encryption, per-account access control, per-restaurant data isolation) to protect your data against unauthorized access, loss, or disclosure.