Privacy Policy

Last updated: 17 October 2026

Menu Studio (menustudio.org) helps restaurants and cafes build menus and publish a LINE ordering flow, and lets customers browse those menus and place orders. We keep the amount of personal data we handle to a minimum, and we run no advertising or third-party analytics. This policy explains what we collect, why, and the choices you have. Personal data is handled in line with Thailand’s Personal Data Protection Act (PDPA, B.E. 2562).

Two kinds of people use Menu Studio, and their data footprints differ. The two sections below describe each.

If you sign in to publish or manage a menu

Menu owners sign in with Google. We do not run our own password system. When you sign in, Google shares a basic profile with us and we store your name, email address, profile image URL, and a Google account identifier used to recognise you on your next visit. We use this only to authenticate you and to associate the menus you publish and edit with your account.

The menu content you create (venue details, sections, items, prices, and the Bill Payment details you enter for ordering) is stored so it can be published and shown to your customers. Draft edits you have not published are kept private until you publish them.

If you order from a menu

Customers browse a published menu and order through LINE (via the LINE LIFF SDK). When you place an order we store the items and quantities, the order total, the delivery location you pick, and a short reference code so the order can be identified. We do not ask for your name or phone number as part of an order. Your cart is held in your own browser (local session storage) until you check out.

Payments

Payment is completed with a LINE Bill Payment / PromptPay QR code that you scan in your own banking app. Menu Studio never sees or stores your card number, bank login, or banking credentials; the QR only carries the merchant’s Bill Payment reference and the amount.

After paying, you upload your transfer slip so we can confirm the payment. The slip image is sent to our slip-verification provider (SlipOK, below), which checks the transfer with the bank. A slip usually shows the sender’s name, the bank, a partly masked account number, the amount and the time of the transfer. Once the payment is verified we keep the slip image and its transaction reference with the order, as proof of payment and to stop the same slip being used twice.

Preventing abuse

To stop the service being flooded or misused, our server briefly keeps your LINE user ID to limit how often orders can be placed and payment slips checked. It is read from the sign-in token LINE gives our ordering page, which we check so that only orders made in LINE are accepted. Likewise it briefly keeps the IP address a request comes from, to limit how often payment QR codes are requested. Both are kept in a temporary file on our server, so that restarting it doesn’t lift the limits. Neither is saved to our database or its backups, and both are deleted within an hour.

Third parties

We rely on a small number of service providers to make Menu Studio work. Each handles data under its own privacy policy:

• Google: sign-in for menu owners. Google authenticates you and shares your basic profile (name, email, image) with us. Your profile image is loaded from Google’s servers when it is shown in your account menu.
• LINE (LY Corporation): the ordering interface runs inside the LINE app (LINE LIFF), and your order confirmation is sent as a LINE message from your own chat. A menu may also link to the venue’s LINE Official Account.
• SlipOK: verifies the payment slips customers upload. It receives the slip image and returns the transfer details (amount, sender, receiver, transaction reference) so we can confirm the order was paid to the right merchant.
• Fly.io: hosts Menu Studio. Our servers, database and stored slip images run on Fly.io infrastructure in Singapore.
• Banking / PromptPay rails: the QR payment is processed by your bank and the Thai payment network, not by us.
• YouTube (Google): the home page’s intro video is hosted on YouTube. Nothing loads from YouTube until you press play; then the player comes from youtube-nocookie.com, and YouTube handles that viewing under its own policy.
• Buy Me a Coffee: the home page links to it for anyone who wants to support the project. We receive nothing from it unless you choose to give there.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

Cookies & local storage

We use only functional, essential storage: no advertising cookies and no third-party analytics, so no cookie-consent banner is needed. Specifically: a sign-in session cookie keeps menu owners logged in, and your browser’s local storage holds things like your editor draft, your cart, and your language preference. That local storage stays in your browser and is not used to track you.

Your rights

Under the PDPA you may, in respect of your personal data:

• access a copy of it;
• have it corrected if it is inaccurate;
• request that it be deleted;
• withdraw consent where processing relies on it.

To exercise any of these, email [email protected] and we will action your request within a reasonable period. We keep personal data for as long as your account or menu is active, or as needed to operate the service, and remove it on request as described above.

When an owner deletes a menu, customers can no longer open it. The menu and its orders, including their payment slip images, are kept for six months (so the owner can restore it within the first 24 hours and look back on its orders) and are then erased. They can be erased sooner on request, by email to the address above. Copies in our database backups are removed as those backups expire.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page, and material changes will be reflected here.

Contact

Questions about this policy or your data? Email [email protected].