Privacy policy

1. Data collected and purposes

Email is used for registration, login, identity checks and mail; an optional name and language for account display and preferences. Passwords are stored only as per-user salted PBKDF2-HMAC-SHA256 hashes (100,000 iterations), never plaintext. Google, Naver and Kakao profile IDs, email and verification status, and names where provided support authentication and linking. Access management stores SHA-256 session-token hashes, creation/expiry/last-seen times and a hash of the user agent truncated to 512 characters. Session IPs are not stored; IP and email hashes are processed temporarily in server memory for rate limits. Reset and email-verification records contain a one-time token hash, purpose, expiry and use time. Photos, menu names, prices, ingredients, translations, generated images and owner/store information support menu creation and publication. Orders store menu/table IDs, items, quantities, prices, requests, status, times and confirmation hashes. Do not include sensitive or unnecessary personal data in requests or photos. Pilot analytics and error reports use menu/item IDs, language, reason, event/time, daily anonymous IDs and deduplication keys, without storing IPs or user agents in those analytics. Plan-interest records contain menu ID, optional contact (email or phone), consent version, registration and expiry; new collection is currently suspended.

2. Retention and account deletion

Sessions expire after 30 days of inactivity or 90 days from creation, whichever comes first. Reset and verification tokens expire in 30 minutes and work once. Expiry blocks use; it does not mean expired database rows are immediately erased. Deleting your account at /account immediately deletes the account, social links, sessions and tokens and stops menu publication and order-device access. Menus and linked orders, reports and assets are removed by cleanup after the existing 30-day deletion period. Account recovery is unavailable after deletion. Shared photos may remain while other menus use them; records preventing deleted menu-ID reuse remain. Menus, orders, daily aggregates and reports have no separate general automatic expiry. Individual analytics events retain only the current Korean date and previous 29 dates; delivery logs for order notifications are cleaned after 30 days. Existing interest records are deleted on cancellation or cleaned when they expire 90 days after registration. Cleanup failures or missing schedules may delay actual erasure. Where law requires retention, only the required data is separately retained for that statutory purpose and period. The operator must identify and disclose the applicable laws, data and periods.

3. Destruction procedure and method

Data due for deletion after its purpose ends, expiry or a request is identified and removed from the database and linked R2 photos through authorized procedures and cleanup jobs. Electronic files are deleted to prevent reuse; any separately handled paper records are shredded or incinerated. Shared assets, ID-reuse records and legal exceptions follow the retention rules above. Users must separately remove device copies and backups.

4. Data processors

The providers below process data for service delivery. The operator must check and manage contracts, access permissions, safeguards, subprocessors and processing locations. Plaintext passwords and login session tokens are not sent as AI input.

5. International transfers

Cloudflare, OpenAI and Resend may process data overseas. Items: Cloudflare receives account/authentication hashes, menus, photos, orders and technical request data; OpenAI receives menu content/photos needed for AI; Resend receives recipient email, message content and one-time verification/reset links. Destinations: United States and other countries, depending on processor locations. Timing/method: encrypted network transfer when a feature is used or mail sent. Purposes respectively: hosting/database/storage; AI extraction/translation/descriptions/images; verification/reset mail. Service retention follows the periods above; processor retention depends on contracts/policies and is not yet confirmed. Before publication, the operator must verify the actual recipient entities, countries, contacts, contractual retention, transfer basis and refusal procedure. Send transfer questions or objections to the contact below; refusing essential processing may prevent use of the relevant feature.

6. Korea Tourism Organization TourAPI

The server sends search keywords, or the store-selected reference location’s latitude/longitude and radius, and region codes/date ranges for events to Korea Tourism Organization TourAPI, along with service identification and a server API key. It does not send user accounts, email, menu drafts or a guest’s GPS location. It receives place names, addresses, coordinates, tourism content IDs and event dates. Public results are cached for up to 6 hours normally, or 60 seconds on event-query failure.

7. Your rights and how to exercise them

You or a lawful representative may request access, correction, deletion or restriction through the contact below. /account supports account viewing, logout and deletion; menu editing supports corrections and deletion. Contact us for account fields not currently editable or a separate data copy. Only necessary identity/authority checks are performed; statutory restrictions and reasons will be explained. Anyone with a published menu link can view it.

/account · /contact

8. Children’s data

The service is for people aged 14 or older. Children under 14 may not register or enter personal data. Notify the contact if a child’s data was entered; protective or deletion measures will follow verification.

9. Security measures

We use salted password hashes, server-side session hashes and signature checks, owner access control, origin checks and rate limits. Production uses HTTPS and secrets are not placed in public code. The operator must manage staff permissions, training, access records, retention and destruction procedures. These measures do not guarantee absence of all security risks.

10. Cookies and device storage

The login cookie (__Host-qrmenugo-session; qrmenugo-session-local on local HTTP) is HttpOnly and SameSite=Lax, with Secure on production HTTPS. Its browser lifetime is 90 days, subject to server expiry. OAuth state cookies last 10 minutes. The legacy editing cookie (__Host-qrmenugo-device / qrmenugo-device-local) lasts 180 days and, when login is required, is used only to verify migration of existing menus. The language cookie (qrmenugo-language) lasts 180 days and staff order-device cookies 30 days. Device storage may retain menu copies, order selections and confirmations. Browser settings can block/delete cookies, affecting login, editing, order access and language preferences.

11. Privacy officer and contact

The operator must replace the officer and privacy-contact fields below with real details. Bracketed values are unfilled placeholders, not actual contacts. Also see /contact when details remain unfilled.

Privacy officer name

[보호책임자 성명 입력]

Title

[보호책임자 직책 입력]

Officer contact

[보호책임자 연락처 입력]

Officer email

[보호책임자 이메일 입력]

Privacy inquiry contact

[개인정보 처리 문의처 입력]

Privacy inquiry email

[개인정보 문의 이메일 입력]

12. Policy changes

Changes to this policy and its effective date are announced here. Changes materially affecting rights will also be announced in the service before application. The operator must confirm the effective-date placeholder below.

Operator and contact

Operator

[사업자명 입력]

Contact

qrmenugo.contact@gmail.com

Email

qrmenugo.contact@gmail.com

Business information

[사업자등록번호·주소 입력]