Privacy Policy

Last updated: 3 October 2026

This policy explains what personal data Tuvshintulga, the maker of TouchMenu in Mongolia ("we"), handles for TouchMenu and this website, why, and what rights you have. We are the controller of this data. You can reach us at support@touchmenu.app.

Restaurant and guest data stays on the restaurant's computer

Menus, orders, bills, staff accounts, the guest Wi-Fi password and the activity log are stored on the restaurant's own computer. So is what guests send from their phones, such as the names they give, their orders, chat messages, song requests and ratings. Guests' phones connect to the restaurant's computer only over its local network; nothing guests send leaves the restaurant, and we don't receive or store any of it.

The restaurant decides how that data is used and is its controller. Guests with questions about their data should ask the restaurant.

Guests of restaurants that use TouchMenu

When you use a restaurant's menu page on your phone, what you send (your orders, any name you type, chat messages, ratings and comments) goes only to that restaurant's computer. We never receive or see it, and we don't process it for the restaurant. The restaurant decides how it is used and is responsible for it, so please ask the restaurant about your data. The software deletes private chats when your table closes, messages to everyone after a day, and names, notes and comments 30 days after your visit. The restaurant's backups keep a copy for up to 30 more days that its computer is used. Your phone keeps your language, your name, your cart, recent notifications and a random id in its own browser storage. The menu page shows this under Privacy.

What we receive

• Purchases: when you buy a subscription, our reseller Lemon Squeezy collects your name, email, billing address and payment details. We receive your name, email, the plan and the order details, but not your full card number.
• Licence checks: the software sends your licence key and an identifier for the computer it runs on to Lemon Squeezy, to activate the licence and check it about once a day. Like any internet request, this shows Lemon Squeezy the computer's IP address.
• Updates: the software asks this website now and then whether a newer version exists, and downloads it from here when you update. Like any visit to the website, this shows our host the computer's IP address.
• Support: anything you send to support@touchmenu.app, such as your email address, your messages and the details you include.
• Website: our host, Cloudflare, keeps standard server logs (such as IP address and pages visited) for security. We don't use advertising trackers or analytics cookies. The website remembers your language choice in your own browser.

Why we use it, and the legal basis

• Selling and licensing your subscription (the order details, licence checks and updates): to perform our contract with you (GDPR Article 6(1)(b)).
• Answering support messages: to perform our contract with customers, and for people who aren't customers yet, our legitimate interest in answering their questions (Article 6(1)(f)).
• Website and update server logs: our legitimate interest in keeping the website and updates secure, working and free of abuse (Article 6(1)(f)).
• Keeping business records that tax and accounting law requires of us: a legal obligation (Article 6(1)(c)).

We need the purchase and licence data to sell you a subscription and make the software work; without it we can't provide TouchMenu. Writing to support is up to you. We don't sell personal data and don't use it for advertising or profiling.

Who receives it

• Lemon Squeezy (United States), our reseller and merchant of record. It runs the checkout, takes payment, handles sales tax and receipts, and runs the licence server the software checks. For the purchase it is a separate controller under its own privacy policy.
• Cloudflare (United States), which hosts this website and the update files, and forwards email sent to support@touchmenu.app.
• Google (United States), which stores our support mailbox (Gmail).
• Authorities, when the law requires it.

Where it is handled

We work from Mongolia and read your data there. Lemon Squeezy, Cloudflare and Google process it in the United States and other countries. For data from the EU, EEA, UK or Switzerland, these providers rely on safeguards the law recognises, such as the EU-US Data Privacy Framework or standard contractual clauses, as set out in their own terms.

How long we keep it

• Customer, order and licence data: while your subscription runs, and for 2 years after it ends, for refunds, disputes and support. Records that tax or accounting law requires are kept as long as that law says.
• Support emails: 2 years after the last message in the conversation.
• Website and update logs: as long as Cloudflare keeps them, which is a short time.

Your rights

You can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict how we use it, or send it to you or another company in a common format. You can object at any time to our use of your data based on legitimate interests. Some requests are limited by law, for example records we must keep for tax.

To make a request, write to support@touchmenu.app. We answer within one month.

You can also complain to a data protection authority: in the EU or EEA, the one where you live or work; in the UK, the Information Commissioner's Office; in Mongolia, the National Human Rights Commission.

Changes

We may update this policy. The date at the top shows when it last changed. If a change is significant, we will tell customers by email or in the software.