This policy explains what data we handle when you use Tiza or visit our website, why, who we share it with and what rights you have. If you want to know what happens when you open a restaurant's menu, see section 9.
1. Who we are
- Company: Cedano Labs LLC, a Wyoming company.
- Privacy contact: support@tizamenu.com.
2. What we collect, why, and for how long
| Data | Why | Legal basis (for people in the EEA, UK and Switzerland) | How long |
|---|---|---|---|
| Your account: email, password (stored encrypted), restaurant name, country, language, currency, time zone, and the date and version of the terms you accepted | Create your account, let you log in and run the service | Contract | As long as you have an account. If you ask us to delete it, we do so within one month, and backups are overwritten within 30 days |
| Your menu: items, prices, allergens, text, logo, photos, designs and translations | Show your menu, create your designs and translate it | Contract | Same as your account. Photos and PDFs you upload to import your menu are deleted once the import is done |
| Billing: business name, address, tax or VAT ID, card country, plan, price and payment history. Stripe stores your card details: we never see them | Charge you, issue invoices and meet tax rules | Contract and legal obligation | 10 years, as tax rules require |
| Messages: emails you send us and emails we send you (welcome, trial reminders, payments) | Help you and tell you what's happening with your account | Contract | 3 years after the last message |
| Service usage, from our server: an ID for your location, its country, plan, how you found us (the utm parameters in the link you came from) and usage data such as the number of items, tables or languages, your price and your reason for canceling. No name, email or IP address | Understand how Tiza is used, improve it and see which channels bring customers | Legitimate interest: measuring and improving our service with data that doesn't directly identify you. You can object (section 7) | Up to 2 years |
| Website and dashboard analytics (PostHog): pages you visit, the page you came from, browser, operating system, screen size and a random ID; your IP address and the approximate location it gives (country, region and city); your clicks and what you click on, including for heatmaps; and recordings of your visit: what's on screen, mouse movements and clicks, the browser console log, and the address and timing of each request. Recordings hide everything you type into fields, email addresses, your account details in Settings and your VAT number, and never include the content of requests. Card details are entered on Stripe, never on Tiza. When you log in, we link it to your location's ID | See which pages work, how you find us and where people get stuck using Tiza, so we can fix it | Your consent, which you give in the cookie notice. If you reject or don't answer, nothing is sent. You can withdraw it anytime in "Cookies" (or in your dashboard, under Settings) | Cookie: 1 year. Recordings: 30 days. Everything else: up to 2 years |
| Google ad click ID (gclid), if you came from an ad: we store it with your location when you sign up | Tell Google whether you signed up, started using your trial or paid, so we know which ads work | Your consent to advertising cookies. Without it we don't store it, and if you withdraw it, we delete it right away | 90 days from sign-up |
| Security: IP address, browser, login attempts and technical logs | Protect Tiza and your account, prevent fraud and abuse | Legitimate interest: keeping the service secure | Up to 30 days |
| Tips for using Tiza (emails in your first days and the reminder that your design is saved): your email, your restaurant's name and what you've already done in your account | Help you get the most out of Tiza and tell you what Pro adds | Legitimate interest: telling our customers about our own service. You can opt out when you sign up and unsubscribe in any email | As long as you have an account and haven't unsubscribed |
| Newsletter, if you subscribe: your email, your market, where you signed up (website or blog), the date, the text you agreed to and the date you confirmed. Once you confirm, your email joins our mailing list on Resend | Send you up to two emails a month with ideas for your menu | Your consent, given with the sign-up checkbox or by confirming the email we send when you subscribe | Until you unsubscribe with the link in any email. If you don't confirm, we delete your email within 30 days, and it never joins the mailing list |
| If a partner referred you: the code you entered or the link you came through | Pay the partner who referred you. We tell them your location's public name, that you signed up and, if you go Pro, what you pay each month during your first 12 months of payments | Legitimate interest: paying our referral commissions, which we tell you about next to the code field | While the commission lasts. What goes into their invoices, 10 years |
| If you apply to be a partner or are one: what you enter in the referral program form (name, company, email, phone, country, what you do, how many restaurants you work with and your website) and, if you're accepted, your tax ID, address, bank account, US tax form (W-9, W-8BEN or W-8BEN-E) and your commissions | Reply to your application and, if you're accepted, run the program, pay you and meet tax rules | Your application and the program agreement, and legal obligation for tax records | If you're not accepted, 3 years after the last message, like other emails. If you are, while you're a partner, and tax and payment records for 10 years |
We don't make automated decisions that significantly affect you. Tiza's AI works on your menu (reading, designing and translating it), not on data about you.
3. Who we share your data with
We don't sell your personal information. We share it only with the providers we need to run the service, who handle it on our behalf under contract, except where noted:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting the website, dashboard, menus, database and files; AI models; security; receiving email | US and its global network |
| Stripe, Inc. | Payments, invoices and taxes. Stripe handles some of this data as an independent controller, for example to prevent fraud | US and other countries |
| Resend | Sending automated emails and the newsletter, and keeping the subscriber list | US |
| PostHog, Inc. | Website and dashboard analytics | US |
| Anthropic, PBC or Google LLC, only if we use them | Reading your menu, creating your designs or translating it when Cloudflare's models aren't enough. They only receive your menu content, logo and photos, and they can't use them to train their models | US |
| Google LLC (Google Ads) | If you allow advertising cookies: the click ID, the type of conversion and the date. Google handles them as a controller, under its own privacy policy | US |
| Google LLC (email and spreadsheets) | Receiving and answering the emails you send us, and keeping the referral program's records | US |
| Mercury | Paying partner commissions. It's a bank and handles payment data as a controller | US |
We may also have to share data with authorities when the law requires it.
4. Where your data is stored
Cedano Labs LLC is in the United States, and your data is stored and processed here and in the countries where our providers operate. If you're in the EEA, the UK or Switzerland, we apply the GDPR to your data, and our providers are bound by data processing agreements, using the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where they receive data from Europe.
5. Cookies
We use essential cookies and, only if you allow them, analytics and advertising cookies. The details, and how to change your choice, are in our Cookie Policy.
Do Not Track: browsers' "Do Not Track" signals have no common standard, so we don't respond to them. You can turn off analytics and advertising cookies anytime from "Cookies" at the bottom of the page.
6. Security
Connections are encrypted (HTTPS), passwords are stored encrypted, access to data is restricted, and we never store your card details. If a security breach affects you, we'll notify you as the law requires.
7. Your rights
You can ask us to:
- access your data and get a copy;
- correct it if it's wrong;
- delete it, for example by deleting your account;
- object to how we use it based on legitimate interest, such as usage measurement;
- restrict its use while we look into a complaint;
- export it in a machine-readable format;
- withdraw your consent, for example to cookies, from "Cookies" at the bottom of the page or in your dashboard settings.
Email support@tizamenu.com from your account's email address. We'll reply within one month. If you're in the EEA, UK or Switzerland and you're not happy with our answer, you can complain to your local data protection authority (in Spain, the AEPD).
8. Age
Tiza is for businesses, and you must be at least 18 to sign up. We don't knowingly collect data from children under 13.
9. If you open a restaurant's menu
Each menu belongs to the restaurant, which is responsible for the data of the people who open it. We host and run the menu on its behalf. When you open a menu:
- Like any website, your browser sends your IP address and browser type. They're used on the spot to show you the menu and protect it, and we don't store them with any data about you.
- We count how many times the menu is opened, without cookies and without knowing who opens it.
- On Pro menus, a cookie stores the date of your last visit on your phone for 13 months, so the restaurant knows how many guests come back. In Europe, only if you say yes in the notice.
- The menu shows in your phone's language, which isn't stored.
- Menus have no ads, no third-party analytics and no cross-site tracking.
To exercise your rights, contact the restaurant or email support@tizamenu.com and we'll pass it on.
10. Changes
If we change this policy, we'll post the new version here with its date. If it's a significant change, we'll let you know by email or in your dashboard.