Privacy Policy

Privacy Policy (aimenu.ar)

Last updated: October 28, 2026

Welcome to aimenu.ar. We respect your privacy and are committed to protecting your personal data. This Privacy Policy describes how we collect, use, store and share your information when you use our software as a service (SaaS) platform, our digital menu, interactive ordering system and Artificial Intelligence tools (hereinafter, the "Service").

This policy is designed in compliance with Personal Data Protection Law No. 25.326 of the Argentine Republic, and lays the regulatory groundwork for international standards (such as the European GDPR and the Brazilian LGPD) in view of our global expansion.

1. Identity of the Controller

aimenu.ar is a software service provided by an individual under the Monotributo tax regime of the Argentine Republic, with legal domicile in the province of Santiago del Estero, Argentina.

For the purposes of notifications, legal and/or judicial demands, the provider establishes a special domicile at:

Estudio Jurídico Salvatierra y Asociados 24 de Septiembre 574, Santiago del Estero, Argentina (CP 4200)

For commercial or operational inquiries, you must use the contact channels enabled within the Platform (see in-app ticket system, 10.2. Support).

2. aimenu.ar's Role in Data Processing

Given our Multi-Tenant architecture, it is essential to distinguish our role according to the type of user:

  • For "End Users" (Diners): when you interact with the menu of a specific Establishment (e.g. restaurante.aimenu.ar), the Establishment acts as the Data Controller with respect to the commercial sales relationship, and aimenu.ar acts as the Data Processor, providing the infrastructure. However, for the creation of your "Global Profile" in the central application (app.aimenu.ar), aimenu.ar is the Data Controller.
  • For "Clients" (owners and employees of Establishments/Brands): aimenu.ar acts as the Data Controller over your account information, service billing and operational management of the subscription.

3. Information We Collect

3.1. Data provided by You

  • Registration Information: when creating an account (through Google Sign-In, Email or Passkey), we collect your name, email address and public profile picture.
  • Functional Profile (Diners): dietary preferences, order history, frequent delivery addresses ("My Favorites") and information entered in the context of group orders or bill splitting.
  • Commercial Information (Clients): company name, CUIT, legal domicile, menu, prices and operational configuration of the Establishment/Brand.
  • Billing Data: for Clients, we process payments through Mercado Pago (external provider). aimenu.ar does not store your credit card numbers — it only retains, for visual identification purposes, the card brand and its last 4 digits, data that the payment provider itself supplies and which does not constitute information subject to the PCI-DSS standard.
  • Support ticket data: when you contact support, we process the content of your inquiry, its category, and lightweight contextual metadata (approximate IP/geolocation of origin inferred from network headers, never the device's GPS) in order to respond and to prevent abuse of the channel.

3.2. Data collected automatically

  • Usage and Device Data: IP address, browser type, operating system, session duration, interaction with the interface and screen resolution.
  • Security Identifiers (Passkey): if you choose to secure your account (mandatory for the creation of Organizations), we use WebAuthn standards. We neither receive nor store your fingerprint or biometric data, only cryptographic tokens validated by your device.
  • Cache and Local Storage (Local-First): we use localStorage and IndexedDB to keep your preferences saved on your device (e.g. order carts, AI-generated content not yet published) until you decide to sync them to the cloud or download them. This local content is not replicated on our servers: if it is lost due to browser cache clearing or a device change, we cannot recover it.

3.3. Content processed by Artificial Intelligence

When you (the Client) use our AI tools to generate or translate descriptions, images or dietary/allergen labels, the content you provide is sent to third-party artificial intelligence providers (see Section 5) for processing. Such content is treated as strictly contextual to the menu and is not used to personally identify End Users. Remember that, in accordance with our Terms and Conditions, AI-generated output is always indicative and its human review is your responsibility.

Likewise, when you (the Diner) use the AI search of an Establishment's menu, the text of your query and, where applicable, the dietary preferences you have declared —which may include allergies or health conditions— are sent to third-party artificial intelligence providers (see Section 5) for the sole purpose of answering that query. The content of the query is not stored in our databases or in our activity logs. Declaring preferences is voluntary, and submitting them constitutes your consent to this processing for the stated purpose: you may browse the menu and search for products by name without declaring any preference.

4. Use of the Information

We use your personal data exclusively to:

  1. Provide the Service: process your orders in real time (KDS), calculate bill splits and facilitate the management of the Establishment.
  2. Artificial Intelligence Engine: improve your recommendations based on your declared dietary preferences or history. The data sent to AI providers (Section 5) to generate translations, descriptions or images is contextual to the menu, without compromising your personal identity.
  3. Security and Fraud Prevention: implement measures such as the anti-bot barrier through Passkeys, request limiting (Rate-Limiting) and protection against automated attacks.
  4. Billing and Contractual Compliance: calculate the Variable Transaction Fee and apply the Revenue Integrity Clause ("Smart Floor") in accordance with our Terms and Conditions.
  5. Customer Support: respond to inquiries and claims through the ticket system, including the use of internal artificial intelligence assistance to expedite the diagnosis of the inquiry.
  6. Transactional communications: notify you by email and through in-Platform notifications about movements linked to your account or billing (sign-ups, charges, cancellations). These communications cannot be disabled, as they are not commercial/promotional in nature.

5. Data Sharing and Disclosure (Sub-Processors)

aimenu.ar does not sell or trade your personal data. We share information only in the following scenarios:

  1. Interaction with Establishments: the Establishment where you place an order will receive your name (alias), what you consume, and your notes or dietary preferences declared in the order.

  2. Infrastructure and Service Providers (Sub-Processors): to operate the Service, we work with external providers of recognized international standard in security and data protection, including:

    • Supabase — database and file storage.
    • Vercel — hosting and delivery of the application.
    • Mercado Pago — subscription payment processing (a Mercado Libre group company).
    • Resend — transactional email delivery.
    • Upstash — caching and traffic limiting infrastructure.
    • Artificial Intelligence Providers (including, among others, models operated by Google and other providers accessed through our AI infrastructure) — content generation and translation.

    All these providers operate under strict confidentiality and data processing agreements (DPAs), and were selected for their recognized standard of security and quality in the industry.

  3. International Data Transfer: some of the mentioned providers process information on servers located outside the Argentine Republic (including the United States and the European Union). By using the Service, you consent to this international transfer, which is carried out in accordance with the protection standards required by applicable Argentine and international regulations (art. 12, Law No. 25.326).

  4. Legal Requirements: when required by a judicial resolution, legal order, or to protect the rights, property and safety of aimenu.ar or of third parties (e.g. prevention of systemic fraud or subdomain squatting).

AI assistants connected by the Client (MCP). When the Client, or a person authorized by the Client, connects a third-party artificial intelligence assistant to their Brand or Establishment, aimenu delivers to that assistant, on the Client's instruction, the data that the authorized profile is allowed to read. That provider is not an aimenu Sub-Processor: it is chosen and contracted by the Client, and any further processing of that data is governed by that provider's privacy policy. Diners' personal data that may be reached this way is limited to what each profile requires (for example, the name under which a reservation was made); diners' addresses, phone numbers and payment data are never exposed through MCP.

6. Data Retention and Deletion

Our retention policy is unified with the actual operational cycle of the Platform:

  • Accounts without a paid Subscription: an account that exhausts its trial period (currently 30 days, subject to future adjustment — see Terms and Conditions §3.7) without having paid any Subscription installment enters a disabled state with a grace period of 10 days before proceeding in accordance with the following point. It applies equally to those who never contracted the Subscription and to those who contracted it without ever paying it.
  • Disabled Accounts that paid at least one installment: after 6 months from the moment a Brand is left without an active Subscription (due to sustained arrears or cancellation), its operational data is permanently deleted (database and stored files) and the associated subdomain is released for registration by third parties. We will send you email notices in advance of the deletion (at least 30 and 7 days before).
  • Deletion Upon Request: any End User may request the deletion of their Global Profile at any time, through the support ticket system. Such deletion will propagate across all dependencies, except for minimal and immutable records of transactions and receipts already issued, which are retained due to accounting/tax obligations.
  • Note on this section: the timeframes described here reflect the design and the current policy of aimenu's account lifecycle. Their automated execution may be at different stages of technical implementation; under no circumstances is data retained beyond what is strictly necessary for the purposes described here or legally required.

7. Minors

aimenu does not require a minimum age for an End User to consult the digital menu or use the ordering system as a Diner, given that the Service is designed to address language accessibility and health needs (allergies, diets) that are common to people of any age, including children accompanied by their families.

Notwithstanding the foregoing, the creation of a Client account to commercially operate an Establishment or Brand on the Platform requires being over 18 years of age.

8. Rights of the Data Subject

In accordance with current law, you have the right to:

  • Access, Rectification and Update: modify your data directly from your profile at app.aimenu.ar/me.
  • Erasure and Right to be Forgotten: request that we delete your records, provided that no legal retention obligation exists.
  • Portability: export the history of your data.

The personal data subject has the right to exercise the right of access to their data free of charge at intervals of no less than six months, unless a legitimate interest is established for that purpose in accordance with article 14, subsection 3 of Law No. 25.326 of the Argentine Republic. The Agency for Access to Public Information, in its capacity as the Supervisory Body of Law No. 25.326, has the authority to handle complaints and claims filed by those whose rights are affected by non-compliance with the regulations in force on personal data protection.

9. Information Security

We implement reasonable technical and organizational measures to protect your data, including robust authentication through Passkeys (WebAuthn), role-based access controls within each Brand/Establishment, and anti-abuse traffic limiting. Nevertheless, no system is 100% infallible; in the event of any security incident that could affect your data, we undertake to notify in accordance with applicable regulations.

10. Governing Language

This Privacy Policy was originally drafted in Spanish (Argentine Republic, .ar domain). The English and Portuguese versions available on the Platform —including those generated with artificial intelligence assistance— are offered as a convenience for End Users of other languages. In the event of any discrepancy or conflict of interpretation between versions, the Spanish version shall always prevail.

11. Contact and Concerns

If you have any questions about this Privacy Policy, the use of Passkeys, AI-Generated Content or about how we manage data in our Multi-Tenant environment, please get in touch through the support ticket system available on the Platform.

We reserve the right to modify this Privacy Policy at any time. As with our Terms and Conditions, significant changes will be duly notified upon entering your control panel.