Version 1.8 · Last updated: September 29, 2026
Cookie Policy
This policy describes cookies, local storage, and similar technologies used by the MenuXS website and app.
1. Who manages the site
The site is managed by 3Sigma s.r.l.s. a socio unico, registered office at Via Antonio Viri 16, 00124 Rome (RM), Italy, VAT number 12847171001, REA RM-1404631. Privacy contact: privacy@menuxs.io; Certified email 3sigma@pec.it. For more information on processing, consult the Privacy Policy.
2. What are cookies and similar tools
Cookies are small files stored by the browser. Local storage, pixels, SDKs, and identifiers can perform similar functions. Italian regulations distinguish between technical tools, necessary for the requested service, and tools used for further purposes such as profiling, marketing, or non-technical analytics.
3. Categories used
| Category | Purpose | Consent |
|---|---|---|
| Necessary | Security, session, load balancing, privacy preferences, shopping cart, language, and explicitly requested functions. | Not required within the limits of strict necessity. |
| Analytics | Measure usage and performance when the service is not configured as strictly technical and anonymous. | Required before activation. |
| Marketing | Embedded newsletters, campaign attribution, profiling, or personalized content. | Required before activation. |
4. Current inventory
| Tool | Provider/domain | Category | Indicative duration |
|---|---|---|---|
| `menuxs_cookie_consent_v1` (local storage) | MenuXS | Necessary | 6 months |
| Account token and profile (local storage, app) | MenuXS | Necessary | Until logout/expiration; architecture under review |
| Guest cart and onboarding (local storage) | MenuXS | Necessary | Until completion, cancellation, or application expiration |
| Language/layout preferences and store preview | MenuXS | Necessary/functional | Persistent until browser deletion |
| Fonts, CSS and JavaScript | MenuXS | Necessary/presentation | Page load; files served locally |
| Logo, favicon and marketing images | First-party CDN cdn.menuxs.io | Necessary/presentation | Page load and technical cache |
| Payment elements, when chosen | Stripe | Necessary for the requested payment function | According to Stripe policy |
| Umami Analytics (page views and aggregate events) | Umami Cloud EU, domain cloud.umami.is | Analytics | Only after consent; query strings excluded, Do Not Track respected, and retention according to Umami configuration |
| Google Analytics 4 (page views and funnel events) | Google, domain googletagmanager.com | Analytics | Only after Analytics consent; query strings and application identifiers excluded, Google Signals and personalization disabled |
| Vercel Web Analytics (aggregate cookie-free page views) | Vercel, first-party endpoint | Aggregate technical measurement | No cookies; URLs redacted, sensitive routes excluded, and anonymous session discarded after 24 hours |
ChatGPT Ads Measurement Pixel (__oppref, __obref, and conversion events) | OpenAI, domains bzrcdn.openai.com and bzr.openai.com | Marketing | Only after consent; duration determined by OpenAI configuration and checked periodically |
The inventory must be updated whenever a provider is introduced or modified. Simple access to external resources may communicate IP and technical data; for this reason, MenuXS plans to self-host fonts and production assets where reasonable.
5. Presentation resources
Fonts, stylesheets and interface scripts are served directly by the site. The logo, favicon and marketing images are distributed through the first-party CDN cdn.menuxs.io to avoid unnecessary website-hosting traffic. The public site does not load Google Fonts, Tailwind Browser or libraries from third-party CDNs.
6. Stripe
At checkout, the user can choose electronic payment. At that moment, Stripe components necessary to securely collect payment data are loaded. Stripe may use technical tools for security and fraud prevention according to its own policy.
6a. ChatGPT Ads campaign measurement
Only with Marketing consent, MenuXS loads the OpenAI Measurement Pixel on merchant-funnel pages and may communicate page visits, registration, checkout start, and subscription activation. The advertising parameter oppref and pseudonymous identifier obref may be associated with events for conversion attribution. Subscription events may also be sent server-side through the Conversions API. The pixel is not activated on public menus or restaurant-customer order checkout pages.
6b. Umami Analytics
Only with Analytics consent, MenuXS uses Umami Cloud in the EU region to measure aggregate website activity and the merchant registration and activation funnel on app.menuxs.io. Automatic app page views are disabled. Query strings are excluded, Do Not Track is respected, and names, email addresses, user, store or order identifiers, free text, and order contents are not sent to Umami.
7. Managing or revoking consent
You can accept, reject, or choose categories from the banner. You can modify your choice at any time with the following button:
You can also delete storage and cookies from your browser settings. Deleting necessary tools may cause logout, loss of shopping cart, or reset of preferences.
8. Default setting
Before a choice is made, only necessary tools are activated. Rejecting optional categories does not prevent browsing the site and using essential functions. The choice will be requested again after approximately six months or in case of substantial changes.
9. Updates
This policy will be updated when technologies, providers, or purposes change. The published table must reflect a periodic technical scan of the site in production.
Google Ads measurement
Only with Marketing consent, we use Google Ads to attribute new store registrations to advertising campaigns. The tag loads on the website and merchant funnel, not on public menus or restaurant customer checkout. Google may process advertising and cookie identifiers, IP address, browser data and a pseudonymous registration reference. We do not send emails, names or order data; enhanced conversions and ad personalization are not enabled. Before consent we do not load the tag or send pings to Google. You can withdraw consent in cookie preferences.
Attribution cookies _gcl_*, normally up to 90 days; actual duration depends on the cookie and Google configuration. The consent choice is stored separately for 180 days.
Advertising provider for MenuXS campaigns, not a sub-processor of merchant order data. Roles and international transfers are governed by the Google terms applicable to the service, including DPF/SCC safeguards where applicable. Google Privacy · Google Ads terms · DPF / SCC
Meta Pixel measurement
Only with valid Marketing consent, the Meta browser Pixel measures visits (PageView) on the marketing website and merchant registration funnel, and new merchant registrations (CompleteRegistration) confirmed by the backend. Logins, failures, existing accounts, additional stores, public menus and restaurant customer checkout are excluded. We do not use the Meta Conversions API.
We do not send email addresses, names, menu content or other personal data in event parameters. Automatic advanced matching is disabled. Meta may still receive technical data such as IP address, browser, page URL and cookie identifiers; this data may be personal.
Consent is requested separately on the website and in the app and lasts 180 days. Rejection, expiry or withdrawal prevents new transmissions; withdrawal does not undo previous ones. Use Cookie preferences in each service. Revision 2026-09-29.1 requires a new choice. Meta cookies such as _fbp and _fbc, if present, have lifetimes and uses determined by Meta configuration; see the provider policy.
Meta is an advertising provider for MenuXS campaigns, not a sub-processor of restaurant order data. Roles, retention and possible international transfers are described in the applicable Meta terms.