Privacy Notice
The short version. We use your photos and contact details only to prepare the images you asked for and to reply to you. We delete your files after 90 days. We never sell your data, and we never use your photos to train AI models without asking you in writing first.
1. Who we are
MenuRefine is the data controller for the personal data described in this notice. That means we decide why and how it is used, and we are responsible for looking after it.
Trading name, address and registration details to be published before launch.
For anything to do with your data, email privacy@menurefine.co.uk.
2. What we collect
Only what we need. Nothing is bought from third parties or scraped from anywhere.
When you use the free-sample form
- Your name
- Your email address
- The photo you upload
- Anything you write in the message box
- Which pricing package you clicked, if you came from one
- Whether you ticked the optional marketing box
That is the whole list. We do not ask for a phone number, an address or anything about your business that you have not chosen to tell us.
When you become a customer
- The photos you send us and the finished images we return
- Billing details needed to invoice you
- Our email correspondence with you
Automatically, when you visit the site
- Your IP address and browser type, held briefly in server logs for security
- Your cookie choice, stored in a cookie called
mr_consent - Anonymous visit statistics — only if you allow analytics cookies
We do not run advertising or tracking pixels unless you accept marketing cookies. Fonts are served from our own server, so no request about you goes to Google or any other font provider.
3. Why we use it, and our lawful basis
| What we do | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Prepare and send your free sample | It is the thing you asked us for | Steps taken at your request before entering a contract — Art. 6(1)(b) |
| Deliver a paid order and invoice you | To perform our contract with you | Contract — Art. 6(1)(b) |
| Reply to your questions | To run the business properly | Legitimate interests — Art. 6(1)(f) |
| Keep the site and your files secure | To prevent abuse and data loss | Legitimate interests — Art. 6(1)(f) |
| Keep accounting records | HMRC requires it | Legal obligation — Art. 6(1)(c) |
| Send marketing emails | Only if you ticked the box | Consent — Art. 6(1)(a), and PECR |
| Analytics and marketing cookies | Only if you allow them | Consent — Art. 6(1)(a), and PECR reg. 6 |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and we think it is not. You can object at any time — see section 8.
4. Your photos
Photos deserve their own section, because they are the heart of what we do.
- They stay yours. Sending us a photo does not transfer ownership.
- You give us permission to store and edit that photo only so we can produce the images you asked for.
- We do not use your photos to train AI models, and we will not, unless you give us separate written permission. Enhancement tools we use are applied to your image to produce your result; they are not a route for your work to become training data.
- We do not publish your photos as examples on this site, in social posts or in a portfolio unless you tell us in writing that we may.
- If a photo happens to contain a recognisable person, tell us. We will either crop them out or delete the file, as you prefer.
5. How long we keep things
| What | How long | Then what |
|---|---|---|
| Photos you upload and images we return | 90 days after delivery | Deleted from our mailbox |
| Enquiries that never became an order | 12 months | Deleted |
| Email correspondence with customers | 3 years after the last order | Deleted |
| Invoices and accounting records | 6 years | Kept because tax law requires it |
| Marketing list entry | Until you unsubscribe | Removed, with a note that you opted out |
| Server security logs | Up to 30 days | Deleted |
Want your files gone sooner? Ask us and we will delete them, unless we are legally required to keep a record.
6. Who else sees it
We do not sell your data and we do not share it for anyone else’s marketing. A small number of suppliers process data on our behalf, under contract, and only on our instructions:
- Website host — serves this site and runs the contact form.
- Email delivery service — carries the form submission, with your photo attached, from the website to our mailbox.
- Our mailbox provider — holds our correspondence with you.
- Accountant — sees invoices, not photos.
We will also disclose data if the law requires it, or to establish or defend a legal claim.
Before launch: replace the four bullets above with the actual company names you end up using. Naming your processors is expected practice, and vague descriptions are a common reason privacy notices get criticised.
7. Transfers outside the UK
Some of our suppliers operate servers outside the United Kingdom. Where personal data leaves the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, so your data keeps essentially the same protection it has here. Ask us and we will tell you which safeguard applies to a given supplier.
8. Your rights
Under UK GDPR you can ask us to:
- Give you a copy of the personal data we hold about you
- Correct anything that is wrong or incomplete
- Delete your data, where we have no overriding reason to keep it
- Restrict what we do with it while a concern is looked into
- Hand it over to you or another provider in a portable format
- Object to processing based on legitimate interests
- Withdraw consent at any time, for marketing or for cookies
Email privacy@menurefine.co.uk. We reply within one month. It is free; we would only charge if a request were manifestly unfounded or excessive, and we would tell you first. We may ask you to confirm your identity before releasing data.
We do not make automated decisions about you and we do not profile you.
9. How we keep it safe
- The whole site is served over HTTPS.
- Your photo is not stored on the website. It is sent straight to our mailbox as an attachment and exists nowhere else, so there is no public bucket or gallery it could ever leak from.
- Access is limited to the people who need it, with strong, unique passwords and two-factor authentication.
- We clear out old enquiries on a set routine so nothing lingers past the periods in the table above.
If a breach ever put your rights at risk, we would report it to the ICO within 72 hours and tell you directly where required.
10. Complaints
Please come to us first — privacy@menurefine.co.uk — and we will try to put it right.
You also have the right to complain to the UK regulator, the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113. Complaining to us first does not affect that right.
11. Changes to this notice
If we change how we use your data, we will update this page and change the date at the top. Where the change is significant, we will email customers directly rather than rely on you noticing.
See also: Cookie Policy · Terms of Service