Clear about the small amount of data we use.

Public menu visitors

Public menus do not require an account and the current product does not set advertising or analytics cookies. Standard hosting logs may include technical information such as an IP address, browser type, requested page and time so the service can be operated securely.

On selected shared menus, you can choose whether to allow optional usage statistics. If you agree, BuiltBy2 records which business’s link was viewed, time actively spent reading, approximate scrolling, menu sections opened and clicks on contact, booking, website or directions links. We also record broad device and referral categories and, where available, country. These statistics help us understand interest in each business’s menu and improve our menu service.

This does not identify a particular person. We do not collect your name, email address, dietary selections, search text, precise location, full referring address or a persistent visitor identifier in these statistics. Public links can be forwarded and repeat visits may be counted again. Results cover visitors who agreed, rather than everyone.

The menu works if you decline. Use “Usage statistics” on the menu to change or withdraw your choice at any time. Only your preference and its expiry are saved on your device for up to 90 days; withdrawal stops future engagement collection. Individual visit records are retained for up to 30 days and daily business totals for up to 13 months. A random reference groups events during the current page visit and is never saved on your device.

We also use Vercel’s cookie-free basic page statistics. Registered shared menus respect your usage-statistics choice for these too. Supported Do Not Track and Global Privacy Control signals disable optional collection.

Venue owners and editors

We process the email address used for passwordless sign-in, the venue membership attached to that account, private menu drafts, published versions and a short audit history. Essential session cookies keep the owner area signed in and secure.

Service providers

Vercel provides application hosting and delivery. Supabase provides authentication and database services. Stripe provides payment, subscription and invoice services, and Resend delivers service emails. These providers process data only as needed to run the service. BuiltBy2 does not sell personal information.

Billing information

We retain the venue, billing contact, selected plan, invoice reference, payment status, service dates and Stripe customer or subscription identifiers needed to administer the agreement. Stripe receives payment details on its hosted pages. BuiltBy2 does not store full card numbers, bank-account numbers or Direct Debit mandates.

Venue content and food information

Each venue remains responsible for checking that its prices, availability, dietary labels and allergen information are accurate before publishing. The product keeps the allergen notice enabled by default, but it does not replace a conversation with venue staff.

Retention and your choices

Account and menu data is kept while the service is active. A venue can request its current menu data before cancellation or within 30 days after service ends. Active menu and owner-account data is then removed within 30 days unless it is needed for a dispute or legal obligation. Residual backups expire under the backup schedule. Invoices, agreements and essential payment records are retained for applicable accounting and legal periods.

Privacy requests can be sent to support@builtby2.co.uk.