Privacy Policy
How MenuStudio AI collects, uses, stores, shares and deletes your data, including data received from Google when you sign in with Google.
Last updated: November 2, 2026
MenuStudio AI (menustudioai.com, the "Service") is a web application that generates and edits professional food photography and short videos with artificial intelligence for restaurants, menus and social media. This Privacy Policy explains what personal data we process when you visit the website, create an account, sign in with Google or Apple, buy credits or generate content, why we process it, who we share it with, how long we keep it and which rights you have. It applies to the website, the web application and the related emails.
1. Who is responsible for your data
The data controller is Jaime Villanueva, operating MenuStudio AI as an individual business based in Spain (European Union).
Contact for any privacy request: jaimebillanueba99@gmail.com. We answer within 30 days at the latest.
2. Data we collect
We only collect the data needed to run the Service. Depending on how you use it, this includes:
Account data
Email address, name, password (stored only as a one-way salted hash, never in plain text), preferred language, interface preferences, the date you created the account, whether your email is verified, your credit balance and, if you use Google or Apple sign-in, the identifier of that account and your profile picture URL.
Data received from Google (Google Sign-In)
If you choose "Continue with Google", we request only the "email" and "profile" scopes. From Google we receive your Google account ID, email address, name and profile picture URL. We do not request access to Gmail, Google Drive, Google Contacts, Calendar, YouTube or any other Google service, and we never receive your Google password.
Data received from Apple (Sign in with Apple)
If you sign in with Apple we receive your Apple account identifier, your email address (or the private relay address Apple provides) and, the first time only, your name.
Content you create
The text prompts you write, the images you upload to edit or animate, the images and videos generated for you, the settings used (aspect ratio, style, resolution, duration), descriptive metadata extracted from your prompts (cuisine, dish category, visual style) and whether you decide to publish an image in the public gallery or create a share link.
Purchase data
When you buy credits, the payment is processed by Stripe. We receive and store the amount, currency, exchange rate used, credits added, date and the Stripe session identifier. We never receive or store your full card number, expiry date or security code.
Session and device data
For each signed-in session we store a session identifier, its expiry date, the browser user agent (from which we derive browser, operating system and device type) and the IP address used, so you and we can see active devices and detect suspicious logins.
Safety and moderation data
Automated safety scores for generated and uploaded images, moderation notes, the number of content-policy violations and, if an account is suspended, the email address and reason, so that banned users cannot re-register.
Communications and feedback
Messages you send us by email or through the on-site chat assistant, and the optional reason you give when you delete your account.
3. How we use your data and legal basis
Provide the Service (performance of a contract)
Create and secure your account, sign you in, generate and store your images and videos, keep your history, manage credits and deliver share links and the public gallery when you choose to use them.
Payments and accounting (contract and legal obligation)
Process credit purchases, prevent duplicate charges and keep transaction records required by tax law.
Service emails (contract)
Send email verification, password reset, welcome, purchase and account-deletion emails. We do not send marketing emails unless you have opted in, and every marketing email includes an unsubscribe link.
Safety, fraud and abuse prevention (legitimate interest)
Check generated and uploaded images for unsafe content, enforce our Terms of Service, rate-limit login attempts and investigate abuse.
Improve the Service (legitimate interest)
Use aggregated, non-identifying statistics (for example, number of generations per style) to fix bugs and improve features. We do not sell your data, we do not use it for advertising and we do not use your content to train third-party AI models.
4. Google user data: what we access, how we use, share, protect, keep and delete it
This section applies to the data MenuStudio AI receives when you choose "Continue with Google" (Google Sign-In). It describes every way our application accesses, uses, stores, shares, protects, retains and deletes Google user data.
Data accessed
MenuStudio AI requests only the following non-sensitive Google OAuth scopes: "email" (https://www.googleapis.com/auth/userinfo.email) and "profile" (https://www.googleapis.com/auth/userinfo.profile). With them our application accesses exactly four pieces of Google user data: your Google account ID, your email address, your name and the URL of your profile picture. We do not request or access any other Google data: no Gmail, Google Drive, Google Contacts, Google Calendar, YouTube, Google Photos or Google Workspace data. We never see or store your Google password.
Data usage
We use your Google user data only to provide and improve the user-facing features of MenuStudio AI: (1) to create your MenuStudio AI account, or link Google sign-in to an existing account with the same email address; (2) to sign you in securely without a separate password; (3) to show your name and profile picture inside your account; and (4) to send you service emails about your account, purchases and security. We do not use Google user data for advertising (targeted, personalized, retargeted or interest-based), we do not sell it, we do not provide it to data brokers or information resellers, we do not use it to determine credit-worthiness or for lending, and we do not use it to create databases for other purposes. We do not use Google user data to develop, improve or train artificial intelligence or machine-learning models, generalized or otherwise.
Data sharing, transfer and disclosure
We do not sell, rent, trade or transfer Google user data to third parties. Google user data is disclosed only to the service providers that run our infrastructure, and only as needed to provide the Service: Hetzner Online (EU server and database hosting, where your account is stored) and Resend (delivery of service emails to your email address). These providers act on our instructions under data-processing agreements and may not use the data for their own purposes. Your Google user data is never sent to the AI image or video providers listed in section 5. We may disclose data only if required by law or a valid order from a competent authority. If MenuStudio AI is sold or merged, we will notify you before your data is transferred, and it will remain subject to this policy.
Data storage and protection
Google user data is stored in our PostgreSQL database on servers located in the European Union. All data in transit is encrypted with HTTPS/TLS. The OAuth access token Google gives us is used once, during sign-in, to read your basic profile and is then discarded; we do not store Google access tokens or refresh tokens. Access to the database and servers is restricted to the administrator using key-based authentication, servers are firewalled, sessions use secure HttpOnly cookies and login attempts are rate-limited. Security procedures are in place to protect the confidentiality and integrity of your data.
Data retention and deletion
We keep your Google user data only while your MenuStudio AI account exists. You can delete your account at any time from Profile → Delete account in the app, or by emailing jaimebillanueba99@gmail.com from your account email address. When you do, your account is deactivated immediately and your Google user data (Google account ID, email, name and profile picture URL), together with your generated content, is permanently deleted within 30 days. You can also revoke MenuStudio AI's access to your Google account at any time at https://myaccount.google.com/permissions; after that we can no longer receive any data from Google.
Limited Use disclosure
MenuStudio AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
6. International transfers
Some providers (Google, Stripe, Cloudflare, Resend, WaveSpeed AI, Novita AI) may process data outside the European Economic Area, mainly in the United States. In those cases transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
7. How long we keep data
- Account data, content and Google user data: while your account exists. When you delete your account it is deactivated immediately and permanently erased, including stored images and videos, after a 30-day grace period during which you can ask us to restore it.
- Session records: up to 30 days after the session expires or you sign out.
- Payment records: the period required by Spanish tax law (currently up to 6 years), then deleted.
- Email verification and password-reset tokens: deleted automatically once they expire.
- Suspension records for banned accounts: kept as long as needed to enforce the ban.
- Server logs: up to 30 days, unless needed to investigate a security incident.
8. Your rights and choices
Under the GDPR and other applicable laws (including the CCPA for California residents) you have the right to access your data, receive a copy in a portable format, correct it, delete it, restrict or object to its processing and withdraw any consent you gave. California residents also have the right to know what we collect and to non-discrimination; we do not sell or share personal information for cross-context behavioural advertising.
You can edit your profile and delete your account yourself from Profile → Delete account. For any other request write to jaimebillanueba99@gmail.com from the email of your account. If you are not satisfied with our answer you can complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.
10. Security
All traffic is encrypted with HTTPS (TLS). Passwords are stored only as salted hashes, session cookies are HttpOnly and protected against cross-site requests, login attempts are rate-limited, and access to production systems is restricted to the administrator with key-based authentication. No system is completely secure; if a breach affecting your data occurs we will notify you and the competent authority as required by law.
11. Children
MenuStudio AI is intended for businesses and adults. It is not directed to anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We will publish any change on this page and update the date at the top. If a change is material, we will also notify registered users by email before it takes effect.
Questions about privacy?
Write to us and we will answer within 30 days.
Email: jaimebillanueba99@gmail.com