Privacy Policy

This policy applies to all personal data processed in connection with your use of Menubarai, including data about business owners, team members, and end customers whose orders are processed through the platform.

As a business using Menubarai, you act as a data controller for your customers' data. We act as a data processor on your behalf. We also act as a data controller for information we collect about you and your team members for the purposes of providing and improving the Service.

Account & Registration Data: Name, email address, phone number, gender, date of birth, business name, business slug, and account credentials (stored as a hashed password — we never store plaintext passwords).

Payment Data: Subscription plan, billing interval, transaction references and amounts. Card details are handled exclusively by Paystack and are never transmitted to or stored on our servers.

Business Configuration Data: Menu categories, products, pricing, QR code configurations, waiter schedules, and business settings you configure within the platform.

Order Data: Customer-generated orders, including customer names, table/seat/room identifiers, order items, quantities, prices, special notes, and order status history.

Usage & Technical Data: IP addresses, browser type, device information, session tokens, last login timestamps, and activity logs generated during use of the Service.

Communications: Any messages or support requests you send to us.

We use the personal data we collect to:

• Create, manage, and authenticate your account
• Process subscription payments and maintain billing records
• Provide and operate the core features of the Service
• Send transactional emails (account verification, payment confirmations, subscription renewals)
• Provide customer support and respond to enquiries
• Monitor platform security and detect fraudulent or abusive activity
• Analyse aggregate usage patterns to improve the Service
• Comply with legal and regulatory obligations
• Enforce our Terms of Service

We do not sell, rent, or lease your personal data to third parties for marketing purposes. We do not use your data for automated decision-making that produces legal or similarly significant effects without your consent.

We share your data only in the following circumstances:

• Service Providers: Supabase (database hosting), Paystack (payment processing), and email service providers, all of whom are bound by data processing agreements and may only use your data as instructed by us.
• Legal Obligations: We may disclose data when required by law, court order, or regulatory authority.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before such a transfer and give you the opportunity to object.
• Protection of Rights: To protect the rights, property, or safety of Meraki Group Ltd., our users, or the public.

All our sub-processors are contractually required to maintain appropriate technical and organisational security measures.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Active accounts: Data retained for the duration of the account
• After account deletion or termination: Data retained for 30 days to allow recovery, then permanently deleted
• Payment records and transaction logs: Retained for 7 years to comply with financial regulations
• Activity logs: Retained for 12 months for security and audit purposes

You may request deletion of your data at any time by contacting us, subject to our obligations under applicable law.

We implement robust technical and organisational measures to protect your data, including:

• All passwords are hashed using bcrypt with a work factor of 12 — plaintext passwords are never stored
• All data in transit is encrypted using TLS 1.2 or higher
• Session tokens use cryptographic hashing (SHA-256) — raw tokens are never stored in the database
• Short-lived access tokens (JWT) with automatic refresh rotation
• Row-Level Security (RLS) policies at the database layer
• Rate limiting on all authentication endpoints to prevent brute-force attacks
• Optional Two-Factor Authentication (TOTP) for business accounts

Despite these measures, no system is entirely immune to breaches. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities as required by law, within 72 hours of becoming aware.

We use HTTP-only, secure cookies for authentication purposes only. We do not use third-party advertising cookies or cross-site tracking. Our cookie use is described in detail in our Cookie Policy.

We collect basic analytics data (page views, feature usage) using first-party methods. We do not integrate Google Analytics, Facebook Pixel, or similar third-party tracking tools that send your data to external parties.

Subject to applicable law, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten"), subject to legal retention obligations
• Restriction: Request that we restrict processing of your data in certain circumstances
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email us at privacy@merakigroupltd.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

The Service is not directed at children under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a child under 18, we will take immediate steps to delete such information. If you believe we may have collected data from a minor, please contact us immediately.

Your data may be stored and processed in countries other than your country of residence, including the United States and the European Union (via our cloud infrastructure providers). We take appropriate steps to ensure that transfers of personal data outside of Nigeria comply with the NDPR and applicable international data transfer mechanisms, including Standard Contractual Clauses where required.

The Service integrates with the following third-party services, each governed by their own privacy policies:

• Paystack: Payment processing — paystack.com/privacy
• Supabase: Database and storage infrastructure

We are not responsible for the privacy practices of third-party services. We encourage you to read their privacy policies before providing them with your personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by email or by posting a notice on the Service. The "Last Updated" date at the top of this page indicates when this policy was last revised.

Your continued use of the Service after any changes take effect constitutes your acceptance of the revised policy.

For any privacy-related questions, requests, or complaints, contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigerian Data Protection Bureau (NDPB) or another applicable supervisory authority in your jurisdiction.