Privacy Policy

Last updated: October 29, 2026

qr2dine (“we”, “us”) is a service for restaurants and cafes to publish their menu online and share it with a QR code, run from 30 N Gould St, Ste 48771, Sheridan, WY 82801, United States. This policy explains what personal information we collect, why, who helps us process it, and the choices you have. It covers qr2dine.com, the restaurant dashboard and the menus restaurants publish with us.

There are two kinds of people who use qr2dine. Restaurant owners create an account and build their menu. Diners scan a restaurant’s QR code and read its menu; they don’t have an account.

What Restaurant Owners Give Us

Your account: Your name, email address, password and the language you use qr2dine in. We store the password only as a secure hash and can never read it. If you sign in with Google, we get your name, email address and profile picture from Google instead of a password.
Your restaurant: Its name, web address on qr2dine, description, logo, currency, and, if you add them, its street address and phone number (shown on your menu only when you choose to show them).
Your menu: Categories, Menu Items, prices, descriptions, allergens, colors and layouts, and the photos you upload. Your menu is public: anyone with its link or QR code can see it, and search engines may list it.
Billing: If you subscribe to Premium, Stripe collects your card details. We never see or store your card number; we keep only Stripe’s customer and subscription IDs and the state of your subscription.
Records we keep about your account: When you agreed to our Terms of Service and which version, whether you verified your email, and, for each signed-in session, the IP address and browser it came from, so we can keep your account secure.
Messages: If you write to us, we keep your message and our reply.

What Diners Leave

Nothing that tells us who they are. Diners don’t sign up, pay, or get tracking cookies. We count how many times a menu is opened each day; the counts don’t say who opened it. The Basket and Favorites on a menu stay in the diner’s own browser (its local storage) and are never sent to us. Like any website, our servers and Cloudflare see a visitor’s IP address to deliver the page and protect it from abuse; we don’t keep it in our database.

Cookies

We only use cookies the service needs to work. On qr2dine.com, one cookie remembers the language you read the site in (English or Turkish), so the sign-in pages show the same one. On your first visit we pick that language from the country Cloudflare sees your connection come from; we don’t store the country. For restaurant owners there are also the sign-in cookie that keeps you logged in to the dashboard, one that only says you are signed in (so qr2dine.com shows Dashboard instead of Log in), short-lived cookies that secure a “Continue with Google” sign-in, and two that remember whether you collapsed the dashboard’s sidebar and closed its menu views chart. Diners’ menus set no cookies. We don’t use advertising or tracking cookies, and our analytics (Cloudflare Web Analytics) don’t use cookies at all.

How We Use It

To run the service: show your menu, let you edit it, and keep your account secure.
To send emails you need, such as verifying your email address and resetting your password.
To tell you about the service you use, such as a change to the price or the Terms, planned downtime or a security notice. These emails go to every account with a verified email address.
To send you Product News: occasional emails about what’s new in qr2dine, such as a new feature or an offer. You get them from when you create your account; you can opt out at any time with the link in each one or in the dashboard’s Account settings, and opt back in there.
To charge for Premium and manage your subscription.
To answer your messages.
To find and fix errors, prevent abuse (for example, limiting how often someone can try to sign in), and understand, without identifying anyone, how many people visit our pages.

We don’t sell your personal information, and we don’t use it for advertising.

Who Processes It for Us

We use these companies to run qr2dine. Each gets only what it needs for its job:

Hetzner: Hosts our servers and database.
Stripe: Payments and subscriptions for Premium, and the Stripe Customer Portal where you manage them.
Resend: Sends our emails (verification and password reset links, emails about the service and Product News, and the messages you send through our contact form to our inbox).
Cloudflare: Delivers and protects our website, Cloudflare Web Analytics counts visits without cookies, Cloudflare R2 stores our backups, and Cloudflare Email Routing forwards messages sent to [email protected] to our inbox. Cloudflare Turnstile checks that whoever sends our sign-up, sign-in, password reset and contact forms is a person, from your IP address and your browser.
Google: “Continue with Google” sign-in, if you use it, and Gmail, our email inbox, where your messages arrive.
Sentry: Tells us about errors in the app. Error reports carry your account ID, not your name or email.

We may also share information if the law requires it, or with a company that takes over qr2dine, which would then be bound by this policy.

How Long We Keep It

Your account, restaurant, menu and photos: for as long as you keep your account.
An account whose email address was never verified: 24 hours after sign-up.
The record of an account we deleted at your request, which holds no email address (see below): for good.
Sign-in sessions expire on their own. Email verification and password reset links stop working after 1 hour.
Our backups are kept for 7 days, so data you delete disappears from them within a week.
Stripe keeps payment records for as long as the law requires it to, under its own privacy policy.

Deleting Your Account and Your Choices

You can change your restaurant and menu at any time in the dashboard, and turn Product News off or on again in Account settings. You can delete your account in the dashboard’s Account settings: this removes your account, your restaurant, its menu and your uploaded photos at once and for good, and cancels an active Premium subscription. You can also write to us at [email protected] to ask what we hold about you, to correct it, or to delete it. We answer within 30 days.

When we delete an account at your request, we keep a record that the request was carried out: the date, your restaurant’s name and a one-way hash (SHA-256) of your email address, never the address itself. The hash can’t be turned back into your email; it only lets us confirm, if you ask again with the same address, that we deleted your account and when. We keep this record for good.

Security

Our website is served only over HTTPS, passwords are stored as hashes, and only you can sign in to edit your restaurant. No system is perfectly secure, but we work to protect your information and will tell you if a breach affects it.

Children

qr2dine is a service for businesses and is not directed at children under 13. We don’t knowingly collect personal information from them. If we learn that a child under 13 has given us personal information, for example because a parent writes to us, we delete it.

Do Not Track

We don’t track visitors across other websites, so we treat every visitor the same whether or not their browser sends a Do Not Track signal.

Where Your Data Is

Our servers, and those of the companies above, may be in the United States or other countries. By using qr2dine you understand your information may be processed there.

Changes to This Policy

If we change this policy, we’ll update the date at the top of this page, and for important changes we’ll email restaurant owners before they take effect. See also our Terms of Service.

Contact

qr2dine
30 N Gould St, Ste 48771, Sheridan, WY 82801, United States
[email protected]