Privacy policy

1. Controller

The controller of personal data is Luminus d.o.o., Kolodvorska 2, 8000 Novo mesto, registration no. 1201166000, VAT ID SI50032534, [email protected]. For questions about personal data write to [email protected].

For data a venue operator enters about their staff or other people (e.g. photos), the operator is the controller and we are the processor under the Data processing agreement.

2. What data we process and why

• User account: email address, name, team role, sign-in time — for sign-in and providing the service (contract).
• Venue details: name, address, phone, opening hours, menus, logos and photos — for the public menu, website and printed materials (contract).
• Subscription and print orders: billing and delivery name and address, delivery phone, VAT ID, order history — to fulfil orders and issue invoices (contract, legal obligation).
• Support messages and technical logs (IP address, time, errors) — for security and troubleshooting (legitimate interest).
• Analytics on pametnicenik.si pages (Google Analytics) — only with your consent in the cookie notice (consent).

3. Guests on venue menus and websites

When a guest opens a public menu or venue website (*.pametnicenik.si addresses), we collect no personal data and use no tracking or advertising cookies. We only count views and QR scans in aggregate by hour, language and menu, without IP addresses or device identifiers. To avoid counting the same view twice, the guest's browser keeps a view marker until the tab is closed (sessionStorage); it is never sent to us.

4. Processors

Data is processed by the following processors, with whom we have data processing agreements:

• Cloudflare, Inc. — content delivery, attack protection, DNS; analytics (Zaraz) only with consent.
• Sendinblue SAS (Brevo), France — email delivery (sign-in links, order notifications).
• Stripe Payments Europe Ltd., Ireland — card payments; card details go directly to Stripe and we never see them.
• Anthropic PBC — AI menu import and translation; receives only the uploaded menu files and texts, which are not used to train models.
• Google Ireland Ltd. — Google Analytics on pametnicenik.si pages, only with consent.

The application and database run on servers in the European Union. Where a processor transfers data outside the EEA (e.g. the US), the transfer is based on an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.

5. Retention

• Account and venue data is kept while the account is active and removed within 30 days after the account is deleted.
• After a trial ends without a subscription, data is kept for 12 months so the venue can continue, and is then deleted.
• Print files are deleted 30 days after an order is closed; order data and invoices are kept for 10 years after the end of the year of issue (VAT Act).
• Technical logs are kept for at most 90 days.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, portability and to object to processing based on legitimate interest. You can withdraw consent for analytics at any time in the cookie settings in the page footer. Send requests to [email protected]; we reply within one month.

You can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.

7. Security

Connections are encrypted (HTTPS), sign-in uses one-time links without passwords, and only members of a venue's team can access its data. The database is backed up regularly.

8. Changes

We may update this policy; the date of the last change is shown at the top. Users are notified of material changes by email.