Version 1.8 · Last updated: September 29, 2026
Sub-processors and Technical Providers
The table distinguishes data verified in the provider's public documentation from configurations that depend on the MenuXS account. DPAs and referenced terms are incorporated into the relevant online agreement unless different negotiated terms apply.
Infrastructure, Communications, and Payments
| Provider and Purpose | Declared Location and Transfers | MenuXS Retention/Configuration |
|---|---|---|
| DigitalOcean Infrastructure, Spaces, and CDN | Primary storage configured in FRA1, Frankfurt. DPA with DPF and SCC as a fallback mechanism; sub-processors published by the provider. | Private AI import prefix with a maximum expiry of 24 hours. Other objects remain for the duration of the service or until deletion. |
| Vercel Frontend, website, and Web Analytics | Primary processing declared in the United States; DPA and SCC for applicable transfers. | Web Analytics collects aggregate cookie-free statistics with redacted URLs and an anonymous session discarded after 24 hours. Runtime logs depend on the plan. |
| Stripe Subscriptions, Billing, and Payments | Global processing; DPA incorporated into the Stripe Services Agreement, DPF, and SCC. Stripe may act as a processor or controller depending on the purpose. | MenuXS retains identifiers and transaction status, not full card details. Stripe retention according to financial, anti-fraud, and legal obligations. |
| Umami Cloud (optional, with prior consent) Website and merchant-funnel analytics | Account and collection configured in the EU region; provider terms and DPA govern any further processing or transfers. | Active only with Analytics consent. Query strings are excluded, Do Not Track is respected, automatic app page views are disabled, and event properties are restricted to categorical values. |
| Google Analytics 4 (optional, with prior consent) Acquisition and merchant funnel | Google Ireland/Google LLC under the applicable terms, DPA, and safeguards. | Active only with Analytics consent. Query strings and application identifiers are excluded; Google Signals, user-provided data, and personalization are disabled. |
| OpenAI (optional, with prior consent) ChatGPT Ads measurement and attribution | Processing and possible international transfers under the terms and safeguards applicable to OpenAI advertising services. | Active only with Marketing consent in the merchant funnel. MenuXS sends conversion events, pseudonymous advertising references, and technical data; restaurant-customer data is not sent through this pixel. |
| MailerLite Waitlist and Newsletter | For EEA customers served by the European entity, subscriber data declared in the EU (Netherlands; Germany for legacy). DPA and SCC; DPF where applicable. | Until revocation or expiry of MenuXS policy; deletion/suppression via provider account. |
| MailerSend Transactional Emails | DPA with SCC and list of sub-processors; infrastructure declared at Google Cloud EMEA. | Messages and logs according to plan and account settings; deletion upon request and within provider obligations. |
| Twilio (Optional) SMS | Global processing; DPA, SCC, and group Binding Corporate Rules. | Not active if credentials are not configured. Retention specific to product and deletion via Twilio functions/APIs. |
| Google / Apple (Optional) Social Login | Processing according to chosen provider terms and declared international transfers. | MenuXS retains provider identifier and verified email; local linkage is removed in the account deletion workflow. |
| Google Ads Google Ads measurement | Advertising provider for MenuXS campaigns, not a sub-processor of merchant order data. Roles and international transfers are governed by the Google terms applicable to the service, including DPF/SCC safeguards where applicable. Google Privacy · Google Ads terms · DPF / SCC | Only with Marketing consent, we use Google Ads to attribute new store registrations to advertising campaigns. The tag loads on the website and merchant funnel, not on public menus or restaurant customer checkout. Google may process advertising and cookie identifiers, IP address, browser data and a pseudonymous registration reference. We do not send emails, names or order data; enhanced conversions and ad personalization are not enabled. Before consent we do not load the tag or send pings to Google. You can withdraw consent in cookie preferences. Attribution cookies _gcl_*, normally up to 90 days; actual duration depends on the cookie and Google configuration. The consent choice is stored separately for 180 days. |
AI Import
| Provider | Declared Use and Processing | MenuXS Control |
|---|---|---|
| OpenRouter | Intermediary with global processing and potential transfer to the USA. DPA incorporated into commercial terms. By default, does not retain prompts/completions unless opted-in to logging. | Each request sets provider.zdr=true. Input/output logging and response caching must not be enabled on the account. Provider, model, and region are logged per job. |
| Google Gemini | Default downstream provider. For paid services, Google declares no training on prompts/responses; limited logs for abuse prevention and in-memory cache up to 24 hours may exist. | OpenRouter may only use declared ZDR endpoints. The actual model is logged. |
| Cloudflare Workers AI | Default PDF parser, configurable. Cloudflare declares not to use Customer Content for training or improvement without consent; storage only if separate storage services are used. | The actual parser is logged; MenuXS does not configure Cloudflare storage for this function. |
| Mistral AI | Alternative OCR parser. Opt-out training and ZDR are organizational controls; Labs models may have different terms. | Not used unless explicitly configured as mistral-ocr; before activation, ZDR, disabled training, and account DPA verification are required. |
If ZDR routing fails to find a compatible endpoint, the import must fail without sending data to a less protected endpoint. Uploaded files must be minimized and not contain unnecessary personal data.
Changes and Objections
The introduction of a new sub-processor will be communicated to merchants with at least 30 days' prior notice, except for urgent replacements necessary for security or continuity. Merchants may submit a reasoned objection by writing to privacy@menuxs.io or via PEC to 3sigma@pec.it.
Data Controller and Contacts
3Sigma s.r.l.s. a socio unico, Via Antonio Viri 16, 00124 Rome (RM), Italy; VAT ID 12847171001; REA RM-1404631. Privacy Office: privacy@menuxs.io; PEC 3sigma@pec.it.
Meta Pixel measurement
Only with valid Marketing consent, the Meta browser Pixel measures visits (PageView) on the marketing website and merchant registration funnel, and new merchant registrations (CompleteRegistration) confirmed by the backend. Logins, failures, existing accounts, additional stores, public menus and restaurant customer checkout are excluded. We do not use the Meta Conversions API.
We do not send email addresses, names, menu content or other personal data in event parameters. Automatic advanced matching is disabled. Meta may still receive technical data such as IP address, browser, page URL and cookie identifiers; this data may be personal.
Consent is requested separately on the website and in the app and lasts 180 days. Rejection, expiry or withdrawal prevents new transmissions; withdrawal does not undo previous ones. Use Cookie preferences in each service. Revision 2026-09-29.1 requires a new choice. Meta cookies such as _fbp and _fbc, if present, have lifetimes and uses determined by Meta configuration; see the provider policy.
Meta is an advertising provider for MenuXS campaigns, not a sub-processor of restaurant order data. Roles, retention and possible international transfers are described in the applicable Meta terms.