Privacy Policy

We collect the following categories of information:

• Account information — your name and email address when you sign up with email/password or Google sign-in, and your plan.
• Restaurant & menu content — restaurant names, addresses, cuisines, logos, and the meals, drinks, descriptions, ingredients, and prices you enter.
• Uploaded and generated images — photos you upload and the AI images and flyers you create.
• Usage data — how you interact with the dashboard, plus technical data such as device, browser, and IP address, used for security and to operate the Service.
• Public menu visitor data — when someone views a public menu, we store an anonymous, randomly-generated viewer ID (in their browser) to count views and likes and to prevent duplicates.
• Billing information — if you subscribe to a paid plan, payment details are handled by our payment processor; we do not store full card numbers.

• To provide the Service — create accounts, generate images, build flyers, host menus, and render QR codes;
• To power features such as view/like counts and menu engagement analytics for restaurant owners;
• To operate, secure, debug, and improve the Service, including enforcing usage limits and preventing abuse;
• To communicate with you about your account, changes, and support;
• To process payments and manage subscriptions;
• To comply with legal obligations and enforce our Terms.

To generate photos, we send the relevant menu details (such as a meal name, description, ingredients, and any reference image you upload) to third-party AI providers, which currently may include OpenAI, Google, Anthropic, and Stability AI. These providers process the content to return an image or text and are subject to their own terms and privacy practices. We do not sell your content, and we do not use it to train our own models.

We share information only with service providers that help us run Sepaso, and only as needed:

• Hosting & database — Supabase (database & authentication) and Vercel (application hosting).
• Media storage — Cloudflare R2 or Amazon S3 for uploaded and generated images.
• AI providers — OpenAI, Google, Anthropic, Stability AI for image and text generation.
• Authentication — Google, if you choose to sign in with Google.
• Payments — our payment processor for subscription billing.
• We may also disclose information if required by law, to protect our rights or users’ safety, or as part of a business transfer (e.g., merger or acquisition).

We do not sell your personal information.

Anything you publish on a public menu — meal names, descriptions, prices, photos, and your restaurant’s address — is visible to anyone with the link or QR code and may be indexed by search engines. Please do not include information on a public menu that you want to keep private.

We use strictly necessary cookies to keep you signed in and to operate the Service. On public menus, we use your browser’s local storage to remember an anonymous viewer ID so likes and views aren’t double-counted. We do not use third-party advertising cookies.

We keep your information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal data and associated content within a reasonable period, except where we must retain it to comply with legal obligations or resolve disputes.

We use industry-standard measures — including encrypted connections and access controls — to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

• Access and update your account and menu information at any time from the dashboard;
• Delete your account and associated content from your settings;
• Request a copy of, correction of, or deletion of your personal data by emailing us;
• Depending on where you live (e.g., the EEA, UK, or California), you may have additional rights such as objecting to or restricting certain processing.

To exercise any of these rights, contact us at privacy@sepaso.app.

Sepaso is intended for businesses and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We and our providers may process and store information in countries other than yours, including the United States. Where required, we rely on appropriate safeguards for such transfers.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date and, for material changes, take reasonable steps to notify you. Your continued use of the Service means you accept the updated Policy.

For any privacy questions or requests, email privacy@sepaso.app. See also our Terms of Service.