Privacy Policy

Menula is a digital-menu service for restaurants and cafés. It is built and operated by iCode, a software studio based in Kurdistan Region, Iraq. In this policy, “we”, “us” and “Menula” refer to iCode.

This policy covers the Menula service as a whole: the guest menus served from menula.app, the restaurant landing and feedback pages on m.menula.app, our API, and the Menula app for restaurant owners and staff.

Two kinds of people use Menula:

• Restaurant owners and staff, who create an account, build their menu and manage their subscription in the Menula app.
• Guests, who scan a restaurant’s QR code or open its link to read the menu. Guests never need an account.

Account details

When you sign up we store your email address and a cryptographic hash of your password. We never store the password itself and cannot read it. We also keep the sign-in session tokens that keep you logged in to the app, and the role each user has inside a restaurant (for example owner or staff).

Restaurant and menu content

Everything you enter to build your menu is stored so that we can show it to your guests: the restaurant name and its menu web address, categories, items, descriptions, prices and add-ons, the languages you offer, your chosen design and theme settings, tables and their QR codes, and any details you choose to publish on your landing page such as a phone number, WhatsApp number, map link or social-media links.

Photos, logos and other uploads

Photos, logos, banners and videos you upload are stored with our cloud storage provider and served publicly as part of your menu. Images are normally compressed and converted to a web-friendly format when uploaded. The Menula app only asks for access to your photo library at the moment you choose to upload a picture.

Subscription and payment records

We keep a record of your plan, the subscription period, and each payment you start: the plan, the number of months, the amount and currency, the payment status and timestamps. Payments are processed by FIB (First Iraqi Bank) inside the FIB app. FIB gives us only a payment identifier, a readable code and QR/link for you to pay with, the amount and the payment status. Menula never receives or stores your card number, bank account number or FIB login details.

Activity log

The dashboard keeps a log of changes made to a restaurant (what was changed, by which account and when). It exists so owners can see what their team did and so we can help when something goes wrong.

Support messages

If you email, call or message us, we keep the conversation so we can help you and follow up.

Guests read menus without creating an account. We do not ask guests for a name, email address or phone number to view a menu.

Anonymous menu view events

To give restaurants simple statistics, the service may record anonymous view events. Each event stores only: the restaurant, the menu item that was viewed (if any), the type of event (for example “view”) and the time. These events do not contain an IP address, device identifier, user agent, name or any other information about who was viewing.

Optional interactive features

Some restaurants turn on extra features. If you use them, we store what you enter and pass it to that restaurant so it can act on it:

• Orders placed from the menu: the items and quantities, any note you add, and the table you scanned from.
• Car valet requests: the car description you type, the table you scanned from, and the claim code shown to you and the staff.
• Feedbackleft on the restaurant’s feedback page: your rating and answers, any comment, the table and menu language, and a contact detail only if you choose to leave one.

Technical logs

Like any web service, our servers and hosting provider keep short-lived technical logs of requests (such as IP address, the page requested, the time and the browser type). We use them only for security, to prevent abuse and to troubleshoot problems, and we do not use them to profile or track individual guests.

Guest menus do not use tracking cookies. When you pick a language on a menu, that choice is saved in your browser’s local storage (one entry per restaurant) so the menu opens in the same language next time. It never leaves your device, and you can clear it at any time from your browser settings.

The Menula app for owners stores your sign-in tokens on your device so you stay logged in. Signing out removes them.

We do not use advertising trackers, ad networks, social-media pixels or third-party analytics on menus, on our websites or in the app.

• To publish your menu and show it to your guests.
• To run your account, your team’s access and your subscription.
• To deliver guest orders, valet requests and feedback to the right restaurant.
• To give restaurants aggregate statistics such as menu views.
• To answer support requests and tell you about important changes.
• To keep the service secure and prevent abuse.
• To meet our legal and accounting obligations.

We do not sell personal information and we do not share it with advertisers.

We share information only in these cases:

• With the restaurant— guest orders, valet requests and feedback go to the restaurant they were sent to.
• With FIB— to create and verify subscription payments. FIB handles the payment under its own terms and privacy policy.
• With our hosting and storage providers, which run our servers, database and file storage on our behalf and may only use the data to provide those services.
• When required by law or to protect the rights, safety and property of Menula, our customers or the public.

Menula runs on servers operated by our hosting provider, and uploaded files are kept with our cloud storage provider. Both providers protect the data they hold for us with industry-standard physical and technical safeguards. Restaurant menus are public by design: anything you publish in a menu can be viewed by anyone who has the link or QR code.

Owners can edit or delete menu items, categories, photos, banners and tables at any time in the Menula app. Deleted content stops being shown immediately and is removed from our systems, except for copies in routine backups, which expire on their own schedule.

To delete your account and restaurant entirely, email us at support@menula.app from the email address on the account. We will confirm the request and then delete the account, the restaurant, its menu, uploads and QR codes within 30 days. Subscription payment records may be kept longer where accounting rules require it. Step-by-step instructions are on the support page.

Guestorders, valet requests and feedback are kept as part of the restaurant’s account and are deleted with it. Anonymous view events are kept for statistics.

Menula accounts are for businesses and are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

All traffic between your device, our websites, our API and our servers is encrypted with TLS (HTTPS). Passwords are stored only as cryptographic hashes. Access to production systems is limited to the people who need it to run the service. No system is perfectly secure, so please use a strong, unique password and tell us straight away if you suspect your account has been accessed without permission.

You can ask us at any time to see the personal information we hold about you, to correct it, or to delete it. Owners can update most information themselves in the app. To exercise any other right, contact us using the details below; we may need to verify that you are the account holder before acting.

We may update this policy as Menula evolves. When we do, we will publish the new version at this address and update the effective date at the top. If a change materially affects how we use your information, we will tell account holders in the app or by email.

See also our Terms of Service and Support pages.

Effective 9 September 2026 (2026-09-09).