Privacy Policy

Last updated: June 2026

1. Who we are

HeyCarta ("HeyCarta", "we", "us") provides cloud software that helps restaurants publish digital menus, manage allergen information, and offer an AI guest assistant. We are accountable for personal information under our control in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Act respecting the protection of personal information in the private sector (Law 25).

Privacy inquiries and access requests: use our contact form. Select "Privacy" as the subject where available.

2. Scope

This policy applies to:

  • Restaurant operators and staff who create a HeyCarta account
  • Guests who scan a restaurant QR code and browse a published menu
  • Visitors to heycarta.com and related marketing pages

When a restaurant uses HeyCarta, the restaurant is generally the organization responsible for guest-facing menu content. HeyCarta acts as a service provider processing data on the restaurant's instructions, as described in our Data Processing Agreement.

3. Information we collect

Account and billing data (operators): name, email address, restaurant name and profile, authentication identifiers, subscription and billing records processed by Stripe when you subscribe to a paid plan.

Menu and operational data: dishes, prices, photos, allergen labels, branding assets, QR configuration, and team membership for restaurants you manage.

Guest session data: menu views, dish clicks, optional allergen filter selections (stored locally in the browser where possible), language preference, and AI chat messages when guests use the assistant. We do not require guests to create an account to browse a menu.

Support and contact data: information you submit through our contact form or support channels.

Technical data: IP address, browser type, device information, and server logs used for security, abuse prevention, and service reliability.

4. Why we collect and use information

  • Provide, secure, and improve the HeyCarta platform
  • Authenticate operators and enforce account permissions
  • Translate menus and guest interfaces into selected languages
  • Generate AI responses grounded in each restaurant's published menu
  • Provide analytics dashboards to restaurant operators
  • Process payments and manage subscriptions
  • Respond to support requests and legal obligations

We collect only information reasonably necessary for these purposes. We do not sell personal information and we do not use guest menu data for third-party advertising.

5. Legal basis and consent

We rely on contract performance (providing the service you signed up for), legitimate interests (security, product improvement, fraud prevention), and consent where required by law. For sensitive information such as allergen-related selections, we present clear in-product notices and recommend guests with severe allergies confirm details with restaurant staff.

6. Cookies and local storage

We use essential cookies and browser storage for authentication, session continuity, theme and locale preferences, and optional guest allergen filters. See our Cookie Policy for details. We do not deploy advertising cookies at launch.

7. Service providers and cross-border processing

We use trusted subprocessors to operate HeyCarta. Personal information may be processed or stored in Canada, the United States, or other locations where these providers operate. By using HeyCarta, you acknowledge that data may cross borders subject to contractual safeguards and applicable law.

8. Retention

We retain account data while your subscription is active and for a reasonable period afterward to comply with law, resolve disputes, and maintain backups. Guest session and analytics records are retained according to product settings and operational needs, then deleted or aggregated. Contact form submissions are retained as long as needed to handle your request.

9. Security

We use encryption in transit (TLS), access controls, database row-level security, and environment isolation. No method of transmission or storage is completely secure; we work continuously to reduce risk.

10. Your rights

Depending on your province and role, you may have the right to:

  • Access personal information we hold about you
  • Request correction of inaccurate information
  • Withdraw consent where processing is consent-based
  • Challenge our compliance with applicable privacy law

Restaurant guests should contact the restaurant directly for menu-specific requests. Operators and website visitors may contact us through the contact form.

11. Breach notification

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law, and we will keep a record of the incident.

12. Children

HeyCarta is a business service not directed at children under 13. We do not knowingly collect personal information from children.

13. Changes

We may update this policy when our practices or legal requirements change. Material updates will be reflected on this page with a revised "Last updated" date.