Legal & Privacy

1. Terms of Service

These Terms of Service ("Terms") form a binding agreement between you and ARMenu ("ARMenu", "we", "us", "our"), a business operated from Johannesburg, South Africa. By creating an account, uploading content, or scanning a QR code that opens an ARMenu menu, you accept these Terms.

1.1 The Service

ARMenu is a software-as-a-service platform that provides restaurants with augmented-reality menus, ordering, kitchen and staff consoles, table reservations, and analytics. Restaurants ("you" when signed in as a manager) create menus that diners view on their phones by scanning a QR code.

1.2 Accounts

• Managers sign in with an email address using Clerk authentication.
• Staff and kitchen tablets sign in with a numeric PIN issued by the restaurant manager.
• You are responsible for keeping credentials safe. You must not share your account or let a third party use it without our written consent.
• You must be at least 18 years old to hold a manager account.

1.3 Acceptable Use

You must not upload, request, or generate content that is:

• illegal under South African law or the law of your customers' home countries;
• infringing another party's copyright, trademark, or personality rights;
• defamatory, harassing, hateful, or intended to intimidate;
• sexually explicit, promotes violence, or targets minors;
• designed to distribute malware or scam customers.

We may remove content and suspend or terminate accounts that violate this section without prior notice. Where the law requires it we will preserve evidence and cooperate with authorities.

1.4 Availability

We target 99.5% monthly uptime but do not warrant uninterrupted service. Scheduled maintenance is announced in advance on our status channel and, where practical, kept outside typical service hours (11:00–14:00 and 18:00–22:00 SAST).

1.5 Fees, credits, and billing

• Restaurant subscriptions and credit packs are billed in South African Rand through our payment partner (currently PayFast; may change). Card details are handled by the payment partner and never stored on ARMenu servers.
• Credits purchased for AR Studio generations are non-refundable once consumed and expire 12 months after purchase if unused.
• Prices are inclusive of South African VAT where applicable. Invoices are issued by the payment partner as merchant of record where their model applies.
• We reserve the right to change plan prices with 30 days' notice; existing paid periods are honoured at the price you paid.

1.6 Intellectual property

• Your content stays yours. You keep all rights to your menu, dish names, descriptions, photos, and 3D models. You grant us a limited licence to store, process, transform, and display that content for the purpose of running your menu.
• Our platform stays ours. The ARMenu software, UI, branding and documentation are owned by ARMenu and licensed to you under these Terms for the term of your subscription.
• 3D models generated via AR Studio are licensed to you for commercial use in your restaurant subject to the underlying generator's licence terms.

1.7 Limitation of liability

To the maximum extent permitted by law, our aggregate liability under these Terms is capped at the fees you paid us in the twelve months immediately preceding the event giving rise to a claim. We are not liable for indirect, incidental, or consequential damages including lost profits or lost data.

1.8 Termination

You may cancel your subscription at any time from the manager portal. Cancellation takes effect at the end of the current paid period; no partial refund is given for early cancellation of monthly plans. We may terminate an account for material breach of these Terms with 7 days' written notice, or immediately for serious violations.

1.9 Governing law

These Terms are governed by South African law. Any dispute is subject to the exclusive jurisdiction of the courts of the Gauteng Local Division, Johannesburg, unless a consumer-protection statute grants you a different forum.

1.10 Changes

We may update these Terms; we will email registered managers 14 days before material changes take effect. Continued use of the Service after the effective date confirms your acceptance.

2. Privacy Policy (POPI Act + GDPR)

This section explains what personal information we collect, why, how long we hold it, and the rights you have under the Protection of Personal Information Act 4 of 2013 ("POPI Act") in South Africa and the General Data Protection Regulation (EU 2016/679, "GDPR") where a data subject is in the EU. ARMenu is the "responsible party" under POPI (equivalent to "data controller" under GDPR).

ARMenu (armenu.co.za) is the data controller for personal information it collects directly to operate the platform (manager, staff and billing accounts). For personal information a restaurant collects about its own diners through ARMenu (orders, reservations, reviews), the restaurant is the data controller and ARMenu acts as processor on the restaurant's instructions — see section 5.

2.1 What we collect

Restaurant managers & owners:

• Email address (required — used as the login identifier).
• Display name (as returned by your Clerk profile).
• Business name, address, WhatsApp phone (optional — if you enter them).
• Timestamp and IP address of each sign-in.

Staff and kitchen users:

• Display name.
• A SHA-256 hash of the 4–6 digit PIN salted with the restaurant identifier (we cannot read your PIN — we can only verify it).
• Last-login timestamp.

Diners:

• No profile is created. No email or password.
• Scan events are logged with a hashed IP fragment, browser user-agent, country, and optional table label — used only for aggregate analytics reported to the restaurant.
• Orders you place are stored against the restaurant that received them, with a table label (if provided) and any note you typed.
• Table reservations include the name and phone number you submit.
• Reviews you leave are stored with a rating, optional text, and a routing decision (4–5 stars are offered a Google review link; 1–3 stars stay private for the restaurant).

2.2 Why we process it (lawful basis)

• Performance of contract — accounts, subscriptions, orders and reservations are processed to deliver the service you asked for.
• Legitimate interests — aggregate scan and order analytics help us and the restaurant improve the menu and diagnose bugs.
• Consent — where we ask for browser notifications, cookies beyond the essentials, or marketing communications, we ask you first and you can withdraw consent at any time.
• Legal obligation — invoicing and tax records are retained for the period required by South African tax law.

2.3 Where your data lives

• Database (Neon Postgres, EU-central-1). Menu records, staff PINs (hashed), orders, reviews, reservations.
• Media (Cloudflare R2, Western Europe). Restaurant logos, cover photos, dish 3D models (.glb / .usdz) and thumbnails.
• Manager authentication (Clerk). Email address and OAuth tokens for magic-link and Google sign-in.
• Payments (PayFast or equivalent). Card details are entered on and stored by the payment gateway, never on ARMenu servers.
• Hosting (Vercel). Static files and serverless functions.
• Optional third-party processors: Meshy (AI 3D generation from a photo), Anthropic Claude (AI menu import and translation) — called only when you or the restaurant manager explicitly triggers those features.

Cross-border transfers to the EU (Neon, R2, Clerk) and USA (Vercel, Anthropic) are covered by the recipient's Standard Contractual Clauses. We do not sell your personal data to any third party.

2.4 How long we keep it

• Manager accounts & restaurant records: for the life of the subscription plus 90 days after cancellation, then hard-deleted.
• Orders and reviews: 5 years for accounting and dispute resolution, then anonymised.
• Reservations: 12 months.
• Scan analytics: raw events 90 days; aggregated counts indefinitely.
• Invoices and tax records: 5 years (South African Tax Administration Act).
• Browser Push subscriptions: deleted the first time the browser signals the subscription is dead.

2.5 Your rights

You may exercise any of the following free of charge:

• Access — request a copy of your personal data.
• Correction — update anything that is wrong or out of date.
• Deletion — request permanent deletion (subject to legal retention).
• Restriction / objection — pause or object to specific processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — for any consent-based processing.
• Lodge a complaint — with the South African Information Regulator (inforegulator.org.za) or your local EU supervisory authority.

Send requests to privacy@armenu.co.za. We respond within 30 days.

2.6 Security

• All connections are HTTPS (TLS 1.3).
• Staff PINs are hashed with SHA-256 + restaurant salt.
• Manager tokens and admin tokens are HMAC-signed and short-lived (12 hours).
• Every /api/admin/* request is scope-checked so a manager cannot access another restaurant's data.
• Access to production databases is limited to authorised engineers using unique credentials.

2.7 Children

The Service is not directed at children under 13 and we do not knowingly collect their personal data. If you believe a child has provided us data, email privacy@armenu.co.za and we will delete it.

2.8 Data protection contact

Information Officer: Ian Brijlal · privacy@armenu.co.za · WhatsApp.

3. Cookies & Local Storage

ARMenu uses browser storage sparingly. Everything below is either essential to the service or requires your consent.

Essential (always on)

• Session cookies for manager sign-in (Clerk).
• Local storage for the diner shopping cart, so it survives a page refresh.
• Local storage for kitchen and staff PIN tokens, so tablets don't sign out mid-shift.
• Local storage for the cookie-consent choice itself.

Optional (with your consent)

• Web Push subscription — only after you tap "Turn on" on the opt-in banner.
• Anonymised error reports (Sentry) — captures the error, page URL, and browser; strips personal fields.

No cross-site advertising cookies. No third-party marketing pixels.

4. Refund Policy

• Monthly subscriptions — cancel any time from the portal; access remains until the end of the paid month; no partial refund.
• Annual subscriptions — full refund within 14 days of first purchase; after that, pro-rata refund on a case-by-case basis for unused full months.
• Credit packs — non-refundable once any credit from the pack has been consumed; refundable in full within 14 days if untouched.
• Chargebacks — please contact billing@armenu.co.za before disputing a charge; we usually resolve issues within one business day.

5. Restaurant Data-Processing Agreement

Where a restaurant uses ARMenu to process personal data of its own customers (diners, reservation guests, review authors), the restaurant is the responsible party and ARMenu is the operator under POPI (equivalent to processor under GDPR). By subscribing to ARMenu, the restaurant instructs us to:

• process personal data only to deliver the Service or as required by law;
• keep personal data confidential and secure per section 2.6;
• notify the restaurant within 72 hours if we become aware of a personal-information breach affecting their customers;
• on written request, delete or return the restaurant's customer data within 30 days of subscription termination.

Sub-processors are the parties listed in section 2.3. We give at least 14 days' notice before adding a new sub-processor; the restaurant may terminate its subscription during that window without penalty if it objects.

6. Contact

• General & support: WhatsApp
• Privacy requests: privacy@armenu.co.za
• Billing & refunds: billing@armenu.co.za
• Abuse reports: abuse@armenu.co.za
• Postal: ARMenu, Johannesburg, South Africa

This document is provided in good faith and is not a substitute for advice from a South African admitted attorney. Restaurants dealing with sensitive personal data (health, biometrics) should obtain independent legal advice.