Privacy Policy

1. Operator and contacts

The service operator and data controller is the individual entrepreneur დმიტრიი ერმოლაევ, registered in Georgia, identification number 105579357. Address: Apartment 8, 4 Vakhtang Chabukiani Street, Tbilisi, Georgia. Contact for privacy and service questions: ermolaevd@gmail.com; Telegram: @jumpy_de.

2. Data processed

Account and sign-in data include your name, email, password hash, email-verification status, session information and security events. Passwords are stored as hashes rather than plain text. If you choose Google sign-in, the service receives your Google account identifier, name and verified email; it does not receive your Google password.

Menu data include catalogs, dish names and descriptions, prices, photographs, translations, design settings, imported spreadsheets and exported PDFs. Do not upload personal information about guests, employees or others unless it is needed for your menu and you have a lawful basis to provide it.

Subscription data include plan information, payment-attempt outcomes, transaction and subscription identifiers, access dates and a billing email where required by the payment provider. Full card details and CVV are entered with the payment provider; our service does not request them in its own form.

Visit data include technical request information such as IP address, browser and connection country, plus a visit identifier, language, landing page, referral source, UTM labels and interaction events. After registration, attribution may be linked to your account, so this should not be described as completely anonymous statistics. Support correspondence includes your message and attachments.

3. Purposes and grounds

Data are used to create and protect your account, verify your email, recover access, store catalogs and menus, prepare PDFs, provide paid access, reconcile payments, answer support requests and prevent misuse. Analytics help assess traffic sources and service use.

Account and subscription data are processed to enter into and perform the service contract. Without the necessary information, an account, verified sign-in or paid access cannot be provided. Security, support handling and assessing service use relate to the operator’s legitimate interests; required record keeping relates to applicable legal duties. Where processing is based on consent, you can withdraw it. This policy itself is not blanket consent to all processing or advertising.

4. Providers and recipients

Cloudflare supplies website hosting and protection, D1 databases, R2 file storage, Browser Run PDF preparation and transactional email delivery. Google participates if you choose Google sign-in. Whop or lava.top handles payments and subscriptions according to the payment option available to you. These providers receive data needed for their functions, and their own processing terms also apply.

The operator receives support messages and service notifications, including payment notifications, by email. Information may be disclosed to competent authorities where legally required. Saving a catalog or menu in your account does not by itself make your files public.

Providers may process information outside Georgia, including in the United States and European countries, using their international infrastructure. Applicable processing terms and safeguards are described in their documents; for example, Cloudflare’s data processing addendum provides contractual safeguards for relevant international transfers. This does not mean that all data are stored exclusively in Georgia or the EU. You can ask the operator about recipients and safeguards for specific processing.

5. Cookies and browser storage

Session cookies support account sign-in and security. localStorage stores your language choice and may keep local copies of unsaved edits for recovery after an error. Protect your browser profile when using a shared computer for confidential work.

Our own analytics use sessionStorage for visit identification and attribution, with a 30-minute inactivity window. These records do not subscribe you to marketing emails. You can clear storage in your browser, which may sign you out, reset your language or remove local recovery copies. Consent requirements for optional storage apply separately from your ability to clear that storage.

6. Retention and deletion

Catalogs, menus, photos and exports are needed while you keep them in the service. Account deletion is available in your profile and removes account workspace data from the primary database and private files from service storage. It does not automatically erase payment-provider records, support correspondence, delivered emails or every provider backup. Cancelling renewal is a separate action.

Own visit-analytics sessions are pruned after 180 days. Sign-in sessions expire after 14 days; verification links after 24 hours; password-recovery links after 30 minutes. Expiry does not mean that every associated technical record is immediately erased.

For support correspondence and individual transaction records, the retention criterion is the need to finish a request, reconcile a transaction, resolve an existing dispute or meet a mandatory record-keeping period. Account-related technical records also depend on the lifetime of the account. External-provider records and backups follow their own rules and applicable law. Ask the operator about a specific record’s retention or request deletion; there is no single immediate-erasure period covering every system.

7. Your requests

Email ermolaevd@gmail.com to request processing information, access and a copy, correction or deletion, restriction, objection or withdrawal of consent where the relevant right applies. Proportionate identity verification may be needed to protect your account. Never send a password, CVV or sign-in code.

Deletion and other rights may have lawful exceptions. You may complain to a competent authority or court. In Georgia, personal-data protection complaints fall within the powers of the State Audit Office of Georgia under current law.

8. Updates

When processing changes, we update this policy and its revision date. New purposes requiring separate consent or additional notice are not automatically authorised by an earlier version. Contact us by email with questions about updates.