Privacy Policy

01Who we are

Wonder Things Ltd, trading as MenuSync, registered in England and Wales, company number 15197334. Registered office: 142-143 Parrock Street, Gravesend, England, DA12 1EY.

We are the data controller for the personal data described here. Contact: info@menusync.co.uk.

02What we collect

• Account information: your name, email address, phone number and business name.
• Restaurant details: your restaurant name, address and which delivery platforms you use.
• Access requests: if you use the request form, the answers you give. Details in section 3.
• Communications: the messages you send us containing menu change instructions - text, photos or voice notes - sent via WhatsApp or by email, and our replies including the confirmation screenshots.
• Website usage: aggregated, anonymous page statistics from Simple Analytics, plus standard server logs (IP address, page requested, time, browser user-agent).
• Payment records: handled by our payment providers - we never see or store your card details.

03The access request form

Our request form is optional. You can always message us on WhatsApp or email us instead. If you do use the form:

• What we collect: your shop name, which delivery apps you use, which kind of change you want (prices, photos, descriptions, availability, opening hours or something else), your email address or WhatsApp number (your choice), and, only if you give it, your postcode. We also record the time of your request, the page you came from if it was one of our own links, whether you used a phone or a computer, and whether you ticked the optional marketing box (if you did, with the exact words you saw). Each request is stored with the version of this privacy notice that applied when you sent it (currently 2026-10-a), so we can show which wording you were given.
• What we do with it: we read it ourselves and reply to you, usually within one working day, to set up your free change. Nothing is emailed or sent anywhere automatically.
• Why we can: it is a step you ask us to take before you decide to become a customer (Article 6(1)(b)), and we also have a legitimate interest in running a small business and answering the people who contact it (Article 6(1)(f)).
• Marketing is separate and optional. The tick box is not ticked for you. If you tick it, we may also message you with MenuSync news and offers, and you can say STOP at any time or email us. That is your consent (Article 6(1)(a)) and you can withdraw it whenever you like. If you leave it unticked we use your details only to answer your request, and we do not add you to any marketing.
• Where it is kept: in a private database on our own server, with our hosting provider in Germany. We do not use a third-party form service, and we do not pass requests to anyone else.
• How we count visits to the form: as you move through the questions we count, without your name or contact details, how far people get, using a random code made when the page opens. It is not stored on your device (no cookies, no local storage), it is not linked to your request, and we do not save your IP address with it. We use these counts only to make the form easier.
• Spam protection: your IP address is held briefly in the server's memory to stop one person sending the form over and over. It is not written to our database.
• How long: requests that do not lead to you becoming a customer are deleted within 12 months. If you become a customer, section 8 applies. If you ask us to stop marketing, we keep a note of that so we do not contact you again. A daily summary of new requests is also written to a private file on our server, and those files are deleted after 30 days.

04How access to your platforms actually works

This is the part people most want a straight answer on, so here it is per platform.

• Deliveroo: you invite us from your own Restaurant Hub account. We get our own login. You can remove us at any time and access ends immediately. We never hold your password.
• Uber Eats: you add us as a Staff user. Uber's own role limits mean Staff cannot see Payments, Tax, Users, Settings or Marketing. We never hold your password.
• Just Eat: works differently - it has no staff-login feature, so there is no user to invite or remove. Where a shared login is the only option, we agree it with you directly, hold it encrypted at rest (AES-256) and transmit it only over TLS 1.2 or above, and your off switch is changing that password.

05Why we can process it

• Contract performance (Article 6(1)(b)) - we need your data to run the menu update service you asked for.
• Legitimate interests (Article 6(1)(f)) - to keep the service working, prevent fraud, and understand in aggregate how the website is used.
• Legal obligation (Article 6(1)(c)) - keeping payment records for tax.
• Consent (Article 6(1)(a)) - only for optional marketing messages, only if you tick the box, and you can withdraw it at any time.

06Who your data goes to

We do not sell, rent or share your personal data for anyone else's marketing. Your data reaches the following categories of recipient, and only to run the service:

• The delivery platforms (Just Eat, Deliveroo, Uber Eats, and any other platform you ask us to manage) - we sign in with the access you grant and make the changes you request.
• WhatsApp / Meta - if you message us on WhatsApp, that conversation passes through their service under their own terms. If you would rather not use it, email us instead.
• Stripe (Stripe Payments Europe, Ltd) - payment processing.
• GoCardless (GoCardless Ltd) - Direct Debit processing.
• Our hosting provider (in Germany) - the server that runs this website, holds its logs and stores access requests.
• Simple Analytics - aggregated, cookieless website statistics.

We may also disclose data where the law requires it.

07International transfers

Stripe processes some data in the United States. That transfer is protected by the UK-US Data Bridge, the UK extension of the EU-US Data Privacy Framework, under which Stripe is certified.

This website and the access request form are hosted on a server in Germany. UK law treats the European Economic Area as providing adequate protection for personal data, so no extra safeguard is needed for that.

WhatsApp is operated by Meta, which processes data outside the UK under its own transfer safeguards. Using WhatsApp to message us is your choice; email is always available.

The typefaces on this site are served from our own server rather than a font CDN, so simply loading a page does not transfer your IP address abroad for that purpose.

08How long we keep it

• Account and restaurant data: for the length of your subscription plus 30 days.
• Any shared platform credential: deleted within 30 days of cancellation.
• Payment records: 7 years, as UK tax law requires.
• Access requests that do not become a customer account: deleted within 12 months.
• Anonymous form-visit counts: up to 90 days.
• Daily summaries of new requests (private files on our server): 30 days.
• Messages between us: up to 2 years, so we can check what was asked for and when.
• Server logs: rolled and deleted on a short cycle as part of normal server operation.

09Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, port it elsewhere, or object to processing based on legitimate interests. If you gave consent for marketing, you can withdraw it at any time by saying STOP or emailing us. Email info@menusync.co.uk and we will respond within one month.

10Site statistics and the free price checker

• Site statistics: we use Simple Analytics, a privacy-friendly analytics service. It sets no cookies and collects no personal data. It gives us anonymous totals, such as how many people viewed a page or finished a price check.
• The free price checker: when you use the price checker, we fetch the public menu pages for the links you paste and compare the prices. Menus are public business information, and we keep a copy for a few hours so repeat checks are quick.
• What the checker keeps: only an anonymous count for each check: the time, which apps were checked, the outcome, how many dishes were matched and, if you came from one of our own links, a short source tag such as "email". It does not store the links you paste, shop names, your IP address or your browser's user agent. To stop overuse, your IP address is held briefly, scrambled, in the server's memory and is never written to disk. Our normal server logs (section 2) still record the address of each page visited, as for every page on this site.

11Cookies

This website sets no cookies at all. Our analytics are cookieless. Full detail is in our Cookie Policy.

12Complaints

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. ico.org.uk