AirMenu – Privacy Policy

# AirMenu Privacy Policy

**Last updated: 15 July 2026**

## 1. Who We Are

AirMenu is a software-as-a-service platform that enables businesses to create and operate digital services, manage orders and customer requests, communicate with customers, and connect AirMenu with third-party services.

AirMenu is operated by:

**AirMenu, Lda.**
Rua Primeiro de Dezembro, 243
4450-227 Matosinhos, Porto
Portugal
Email: **info@airmenu.com**

This Privacy Policy explains how AirMenu collects, uses, stores, and shares personal data when people visit our websites, create or use an AirMenu account, contact our support team, or interact with a business that uses AirMenu.

## 2. Scope of This Policy

This Privacy Policy applies to:

– AirMenu websites, including `airmenu.com`, `www.airmenu.com`, and `info.airmenu.com`;
– AirMenu accounts and administration tools;
– web applications and services operated through the AirMenu platform;
– integrations enabled through AirMenu;
– communications with AirMenu;
– personal data processed through AirMenu on behalf of our business customers.

A business using AirMenu may have its own privacy policy. When an end customer interacts with that business, the business is generally responsible for deciding why and how the end customer’s data is used. AirMenu processes that data on behalf of the business and according to its instructions.

## 3. Our Role Under Data Protection Law

AirMenu may act in two different roles.

### AirMenu as Data Controller

AirMenu acts as a data controller when it determines why and how personal data is processed, including for:

– account creation and administration;
– billing and contractual management;
– customer support;
– website security and operation;
– service communications;
– compliance with legal obligations.

### AirMenu as Data Processor

AirMenu generally acts as a data processor when processing information on behalf of a business customer, including:

– customer orders and requests;
– contact information submitted to the business;
– messages and customer-service conversations;
– booking and delivery information;
– data received through integrations configured by the business.

In these situations, the business customer is normally the data controller and is responsible for providing appropriate privacy information to its end customers and establishing a lawful basis for processing their data.

## 4. Personal Data We Process

Depending on how AirMenu is used, we may process the following categories of personal data.

### Account and Business Information

– name;
– email address;
– telephone number;
– username and authentication information;
– business name and contact details;
– account permissions and user roles;
– billing and subscription information;
– communications with AirMenu support.

### End-Customer and Transaction Data

When AirMenu processes data for a business customer, the information may include:

– customer name and contact details;
– telephone number and messaging identifiers;
– orders, bookings, requests, and associated notes;
– delivery or service location, when required;
– transaction references and payment status;
– loyalty, voucher, and campaign information;
– communications between the business and its customers.

### Messaging and Integration Data

When a business enables a messaging or third-party integration, AirMenu may process:

– business account and asset identifiers;
– telephone number identifiers;
– customer telephone numbers and messaging identifiers;
– profile names made available by the messaging service;
– message content;
– message timestamps;
– delivery, read, and failure status;
– campaign, referral, or advertisement information;
– authorization tokens and integration configuration;
– webhook and synchronization events.

### Technical and Usage Data

– IP address;
– browser and device information;
– operating system;
– session and cookie identifiers;
– pages and functions used;
– authentication and security events;
– request, error, and diagnostic logs.

## 5. Where Personal Data Comes From

AirMenu may receive personal data:

– directly from AirMenu account holders and website visitors;
– from end customers when they submit an order, request, booking, or message;
– from business customers using the AirMenu platform;
– from authorized integrations, including Meta and the WhatsApp Business Platform;
– automatically through browsers, devices, cookies, logs, and security systems.

When AirMenu receives personal data from a business customer or an authorized integration, the business customer is responsible for ensuring that the data was collected lawfully and that appropriate information was provided to the individuals concerned.

## 6. How We Use Personal Data

We use personal data to:

– provide, maintain, and operate AirMenu;
– create and manage accounts;
– authenticate users and control permissions;
– process orders, bookings, and customer requests;
– enable communications requested by business customers;
– connect AirMenu with authorized third-party services;
– provide technical and customer support;
– monitor service availability and performance;
– prevent fraud, abuse, and unauthorized access;
– diagnose and correct technical problems;
– comply with contractual and legal obligations;
– improve AirMenu’s functionality and user experience;
– send service-related communications;
– send marketing communications when permitted by law.

AirMenu does not sell personal data or Meta Platform Data.

## 7. WhatsApp Business Platform and Meta Platform Data

AirMenu is developing an official integration with the WhatsApp Business Platform. Availability is subject to Meta’s approval.

Once available, a business customer may choose to authorize AirMenu to connect to its own WhatsApp Business Account. AirMenu may then process Meta Platform Data for purposes such as:

– receiving customer messages;
– sending customer-service messages;
– sending approved message templates;
– following up authorized sales leads;
– receiving message delivery and read status;
– synchronizing approved account, number, and template information;
– supporting workflows and automations configured by the business.

AirMenu will only access WhatsApp Business assets selected and authorized by the business customer.

AirMenu will not use Meta Platform Data for unrelated purposes, sell it, or share it with third parties except where necessary to provide the requested service, comply with the business customer’s instructions, or meet a legal obligation.

Business customers are responsible for obtaining any consent or opt-in required to contact individuals, honoring opt-out requests, using approved message templates where required, and ensuring that their communications comply with applicable law and Meta’s policies.

AirMenu does not automatically authorize a business to contact an individual merely because the individual’s telephone number or messaging identifier is available in AirMenu.

Meta and WhatsApp process personal data under their own terms and privacy policies. Business customers remain responsible for complying with the WhatsApp Business Messaging Policy and applicable laws when contacting their customers.

## 8. Third-Party Integrations and Automation

AirMenu allows business customers to enable optional third-party integrations. AirMenu does not automatically send all customer data to these providers. Data is transmitted only when the business customer enables and configures the relevant integration or when it is necessary to perform a requested service.

Depending on the customer’s configuration, providers may include:

– workflow platforms such as Monday.com and Make;
– artificial intelligence services such as OpenAI;
– payment processors;
– point-of-sale and invoicing systems;
– delivery platforms;
– email, SMS, and notification providers;
– customer relationship management systems;
– Meta and the WhatsApp Business Platform.

When a business customer enables an integration, relevant data may be transmitted to that provider to perform the requested function.

Third-party providers process data under their own terms, privacy policies, and contractual arrangements. Business customers should review those terms before enabling an integration.

## 9. Legal Bases for Processing

Where the General Data Protection Regulation applies, AirMenu relies on one or more of the following legal bases:

– **Performance of a contract:** to provide AirMenu services and manage accounts.
– **Legitimate interests:** to secure, maintain, support, and improve the platform, provided those interests do not override individual rights.
– **Legal obligation:** to comply with accounting, tax, regulatory, and lawful authority requirements.
– **Consent:** when required for non-essential cookies, optional marketing, or another specific processing activity.

When AirMenu acts as a data processor, the relevant business customer determines the applicable legal basis for processing end-customer data. AirMenu processes that data only on the customer’s documented instructions and under the applicable contractual and data-processing terms.

## 10. How We Share Personal Data

We may share personal data with:

– hosting and cloud infrastructure providers;
– communication and notification providers;
– payment processors;
– technical support and security providers;
– professional advisers, such as accountants or legal advisers;
– integration providers selected by the business customer;
– public authorities when required by law;
– a buyer or successor in connection with a merger, acquisition, or restructuring, subject to appropriate safeguards.

Service providers are only given access to data that is reasonably necessary to perform their services.

We do not sell or rent personal data.

## 11. International Data Transfers

Some service providers may process personal data outside Portugal or the European Economic Area.

Where personal data is transferred outside the European Economic Area, AirMenu and/or the relevant business customer will use a transfer mechanism recognized under applicable data protection law. Depending on the provider and destination, this may include an adequacy decision, Standard Contractual Clauses, or another legally permitted safeguard.

Information about applicable safeguards may be requested by contacting `info@airmenu.com`.

## 12. Data Retention

AirMenu retains personal data only for as long as reasonably necessary for:

– providing the service;
– maintaining the relevant account or customer relationship;
– fulfilling the business customer’s documented instructions;
– resolving disputes;
– preventing fraud and abuse;
– maintaining security and operational records;
– complying with legal, tax, and accounting requirements.

Retention periods depend on the type of data, how AirMenu is configured, the instructions of the business customer, and applicable legal obligations.

When an account is deleted, personal account information will be deleted or anonymized where reasonably possible. Some records may be retained when required by law or where necessary to establish, exercise, or defend legal claims.

Residual copies may remain temporarily in backups and logs until they are overwritten or deleted through normal retention processes.

## 13. Security

AirMenu uses technical and organizational measures designed to protect personal data, including:

– HTTPS-encrypted communications;
– authentication and access controls;
– user roles and permission restrictions;
– logging and monitoring;
– infrastructure and application maintenance;
– backups and service recovery measures;
– restrictions on access to production systems and credentials.

No internet-based service can guarantee absolute security. Users must protect their credentials and notify AirMenu if they suspect unauthorized access.

## 14. Cookies

AirMenu websites and applications may use:

– essential cookies required for authentication and platform operation;
– preference cookies;
– analytics cookies;
– other optional cookies enabled with consent where required.

Users can manage optional cookies using the cookie settings available on the relevant website. Disabling essential cookies may prevent parts of AirMenu from functioning correctly.

## 15. Automated Processing and Artificial Intelligence

AirMenu may allow business customers to configure automated workflows or artificial intelligence services.

These tools may help classify requests, generate suggested responses, or automate customer-service tasks. Their operation depends on the configuration and instructions of the relevant business customer.

AirMenu does not use personal data to make solely automated decisions that produce legal or similarly significant effects on AirMenu account holders. Business customers are responsible for ensuring appropriate human oversight when their use of automation or artificial intelligence may significantly affect individuals.

## 16. Individual Rights

Subject to applicable law, individuals may have the right to:

– be informed about the processing of their personal data;
– access their personal data;
– correct inaccurate or incomplete data;
– request deletion;
– restrict processing;
– object to certain processing;
– receive portable copies of data;
– withdraw consent;
– object to direct marketing;
– lodge a complaint with a data protection authority.

Requests can be sent to `info@airmenu.com`. AirMenu may request information necessary to confirm the requester’s identity.

When AirMenu processes data on behalf of a business customer, the request may need to be directed to that business. AirMenu will assist the business as required by applicable law and contractual obligations.

Individuals in Portugal may lodge a complaint with the **Comissão Nacional de Proteção de Dados — CNPD** at [www.cnpd.pt](https://www.cnpd.pt/).

## 17. Account and Data Deletion

AirMenu account holders can request deletion by:

1. Logging in at [https://www.airmenu.com/Configure.html](https://www.airmenu.com/Configure.html).
2. Opening [https://www.airmenu.com/Configure.html?deleteUser](https://www.airmenu.com/Configure.html?deleteUser).
3. Following the account deletion instructions.

A deletion request may also be sent to `info@airmenu.com`.

When a valid deletion request is completed, AirMenu will delete or anonymize personal account information, subject to legal retention requirements.

Transaction records may be retained in anonymized form where required for accounting, reporting, fraud prevention, or legal compliance.

Users who authorized a Meta or WhatsApp integration may also disconnect that integration through the applicable Meta or WhatsApp account settings. Disconnecting an integration prevents future access but may not automatically delete information previously processed lawfully. A separate deletion request can be submitted to AirMenu.

## 18. Children

AirMenu is a business platform and is not intended for use by children.

AirMenu account holders must be at least 18 years old or have the legal authority required to enter into a contract on behalf of a business.

Business customers are responsible for ensuring that their use of AirMenu complies with applicable rules concerning children’s data.

## 19. Changes to This Policy

We may update this Privacy Policy when AirMenu’s services, integrations, or legal obligations change.

The updated version will be published on this page with a revised “Last updated” date. Where required, we will provide additional notice of material changes.

## 20. Contact Us

Questions, requests, or complaints concerning this Privacy Policy or the processing of personal data can be sent to:

**AirMenu, Lda.**
Rua Primeiro de Dezembro, 243
4450-227 Matosinhos, Porto
Portugal
Email: **info@airmenu.com**