Privacy policy

QRDERS is operated by HOSPITIUM QRDERS LTD, a company registered in England and Wales (company no. 17116477), 128 City Road, London EC1V 2NX. We are the data controller for the personal data described here. This policy covers our website, the dashboard where you run your business, the menus your customers read, and the affiliate program. We keep data collection to what we need to run the service and pay the people who use it.

Information you give us. For businesses: the business and contact details you provide, your login, and the menu, product and media content you upload, so we can show it to your customers and keep it up to date. For anyone reading one of your menus: nothing. A menu is public, and opening one does not ask the reader for anything. For affiliates: your name, your email, the referral activity on your link, and the bank details you enter so we can pay you. We also record a tax-form self-declaration and a sanctions-screening result, because we must screen and may need to report payees.

The AI editor. When you use the AI editor, the words or the photo you give it, and the part of your menu it needs to work on, are sent to an AI model provider outside QRDERS to be processed, and the answer is stored with your menu. We do not use your customers’ personal data to train a model.

Information we collect automatically. When you use the service we log basic technical data, IP address, approximate location derived from it, device and browser type, and the pages you request, to keep the service running, secure and debuggable. Cookies and similar technologies are covered separately in our cookie policy.

Information from other sources. If you sign in with Google we receive your basic profile (name and email) from Google.

If you don't provide it. Where data is needed to run the service or to pay you, for example your business details or affiliate bank details, we can't provide that part of the service without it.

Aggregated, anonymised insights. We combine data across the businesses on QRDERS to produce benchmarks and market insights, for example how many products a business like yours lists, or which languages a menu gets read in. These insights use data that has been aggregated and stripped of anything identifying a specific business or person. We use them to improve the product for everyone.

Public information about other businesses. Our local discovery and map tools use information that is already public, such as business listings, ratings and publicly posted menus for businesses near you. This is public data about businesses, not personal data about their customers.

Improving our automated features. We use data from the service to build and improve automated features such as reading a menu, writing descriptions and translating. Where we do this we de-identify the data first, removing names, contact details and other personal identifiers, so the work does not rely on information that identifies you or your customers.

Under UK and EU data protection law we rely on these bases, depending on what we're doing:

We use a small set of processors, each only for the purpose shown:

We also share data where the law requires it, to protect our rights, or as part of a business sale or reorganisation. We don't sell your personal data. We may share or sell aggregated, anonymised or de-identified data and insights, which by definition cannot identify you or your customers.

Some processors are outside the UK/EEA. Where that happens, the transfer is covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, plus any extra safeguards the law requires.

We keep personal data only as long as we need it. Financial records, including affiliate commission and tax-form data, are kept for at least six years to meet UK tax and accounting requirements, then deleted or anonymised. Account data is deleted on request once there is no legal reason to keep it.

Data is encrypted in transit, and access is limited to the people and services that need it. The database enforces row-level security so each account reaches only its own records, and affiliate bank details can be seen only by the people who run the affiliate programme. We ask for no financial details on the free plan, so there are none here to keep. No system is perfectly secure, but we work to keep risk low and will tell you and the regulator if a breach legally requires it.

• Ask for a copy of the personal data we hold about you.
• Have inaccurate data corrected, or data erased where the law allows.
• Object to or restrict certain processing, and withdraw consent at any time.
• Ask us to move your data to another provider where that applies.
• Complain to the UK ICO (ico.org.uk) or your local supervisory authority.

To exercise any of these, email privacy@qrders.com. We respond within one month, free, unless a request is clearly unfounded or excessive.

You can stop our marketing emails at any time using the unsubscribe link or by emailing us, and we'll stop. That is separate from the service emails we must send to run your account.

We don't make decisions about you by automated means alone that produce legal effects; sanctions screening, for example, is reviewed by a person before any commission is held back.

QRDERS is a tool for businesses and for the people who work for themselves, and is not directed at children. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us data, email us and we'll remove it.

We keep tracking to a minimum and ask consent before anything that records you. The detail, every cookie, what it does, and how to change your mind, is on our cookie policy.

When you make a cookie choice we keep a short, privacy-minimising record of it (the choice, the time, the policy version, and a shortened IP with the identifying part removed) so we can show consent was properly given.

We may update this policy as the service changes or the law evolves. When we make a material change we'll update the date above and, where appropriate, let you know in the product or by email. The current version always governs.

Questions or a data request? Email privacy@qrders.com.