Privacy policy
Last updated 28 October 2026
The short version
- We collect what we need to make previews, run your menu and bill your plan: mostly your restaurant's menu and your contact details.
- Guests who open a menu don't need an account. Reviews are anonymous and menu stats are only counts.
- Card payments go straight to Stripe. We never see your card number.
- We don't sell personal information and we don't use advertising trackers.
- You can ask us for a copy of your information, or to correct or delete it, at any time.
- Who is responsible
- What we collect and why
- Guests using a restaurant's menu
- Who we share it with
- Where it is stored
- Cookies
- How we protect it
- Your rights
- Changes
- Contact
1. Who is responsible
VORA is run by João Gabriel Pereira Guimarães, a sole trader in Ireland, trading as VORA. We decide how your information is used (we are the "controller" under data protection law). Email: support@vora.company.
2. What we collect and why
When you visit our website
Our web server records each request: your IP address, the page, the time and your browser type. We use these logs to keep the site working and secure, for example to stop abuse. Legal basis: our legitimate interest in running a secure website. Kept for 14 days.
Visit statistics, only if you accept them. If you click Accept in the cookie banner, we count page visits and a few actions (starting a free preview, starting a payment, signing in) with Plausible Analytics. It uses no cookies and doesn't identify you: Plausible turns your IP address and browser into a code that changes every day and keeps only totals. We send the page address without any codes or links in it. Legal basis: your consent, which you can withdraw in Cookie settings. See our cookie page.
When you make a free preview
- What you give us: a link to your menu or website, a PDF, a photo of your QR code or pasted menu text, and optionally your restaurant's name.
- What we keep: the dishes we read from it (names, descriptions, prices and sections). Files are read in a temporary process and are not saved.
- Your IP address: turned into a one-way code and kept in memory for one hour only, to limit how many previews one connection can make.
- How long: a preview is deleted 24 hours after it's made, or 7 days after if you choose to keep your menu.
Legal basis: our legitimate interest in showing restaurants what VORA can do, at their request.
When you keep your menu and choose a plan
- What we collect: your restaurant's name, your name, email address and phone number, the plan you chose, and the payment status and reference numbers that Stripe sends us.
- Why: to create your account, send you your login link, help you set up your menu, bill your plan and keep our accounts.
- Card details are entered on Stripe's payment page and never reach us.
- How long: while you're a customer, and then for 6 years after the end of the tax year, because Irish tax law requires us to keep business records. If you start a checkout but don't pay, we may contact you once to ask if you need help, and we delete those details after 30 days.
Legal basis: to provide the service you asked for (contract), and to meet our legal obligations for tax records.
Your menu editor
- What we keep: your menu (dishes, prices, allergens, photos, logo and opening details), the last 30 published versions, your access code stored only as a secure one-way code, and a sign-in cookie.
- How long: while you're a customer, and for 24 months after your plan ends so you can come back, unless you ask us to delete it sooner. See our terms.
Legal basis: contract.
Emails and customer records
We send you service emails, such as your login link and messages about your plan or payments. We also keep short notes about our conversations with you and how your setup is going, so we can help you. We keep these as long as your account. Legal basis: contract, and our legitimate interest in supporting our customers. We don't send marketing emails without asking first.
When you contact us
If you email or call us, we keep what you tell us for as long as we need to answer and follow up, and no longer than your account if you're a customer.
3. Guests using a restaurant's menu
Guests open a VORA menu without an account.
- Dish reviews: if you rate a dish, we store the stars, your optional comment (up to 280 characters) and the date. So you can change your review later, your phone keeps a random identifier; we store it only as a one-way code that can't be turned back into the identifier. Reviews are shown publicly on the menu without your name. Legal basis: our legitimate interest, and the restaurant's, in showing honest dish ratings. Kept while the restaurant uses VORA and up to 24 months afterwards.
- Menu stats: we count how often a menu is opened, which dishes are viewed and which buttons are tapped. No cookie or identifier is used, and your IP address is only used in memory to limit abuse. The counts are kept for 400 days.
- Your order list stays in the page on your phone and is never sent to us or to the restaurant. The reviews you wrote are also saved on your phone, so you can see them next time.
The restaurant is responsible for what its menu says, including allergen information. If you have a question about a dish, please ask the restaurant's staff.
4. Who we share it with
We don't sell personal information. We use these service providers, who only process it on our instructions or, for Stripe, under its own privacy policy as a payment provider:
| Provider | What for | Where |
|---|---|---|
| Hostinger International Ltd | Server that runs VORA and stores its data | United Kingdom |
| Stripe Payments Europe Ltd | Card payments, invoices and the billing page where you manage your plan | Ireland, with some processing in the United States |
| MillionSend | Sending our service emails, such as your login link | Brazil (Amazon Web Services, São Paulo) |
| Plausible Insights OÜ | Anonymous visit statistics, only if you accept them | European Union (Germany) |
We may also share information if the law requires it, or to protect our rights or someone's safety.
5. Where it is stored
Our server is in the United Kingdom, which the European Union recognises as protecting personal data to the same standard. When a provider processes data outside the European Economic Area and the United Kingdom, such as Stripe in the United States or MillionSend in Brazil, it uses safeguards approved by the European Commission, such as the EU-US Data Privacy Framework or standard contractual clauses.
6. Cookies
We only use cookies and similar storage that the site needs to work, such as keeping you signed in to your editor. We don't use advertising cookies. Visit statistics (Plausible) only start after you click Accept, and they don't use cookies. The details are on our cookie page.
7. How we protect it
Every page uses an encrypted connection (HTTPS). Access codes are stored only as one-way codes. Each part of VORA runs separately with access only to what it needs, and only we can reach the server. No system is perfectly secure: if a breach affects you, we'll tell you and the Data Protection Commission as the law requires.
8. Your rights
You can ask us to:
- give you a copy of the personal information we hold about you;
- correct it if it's wrong;
- delete it, or limit how we use it;
- send it to you, or to another provider, in a common format;
- stop using it where we rely on our legitimate interests.
Where we rely on your consent, such as visit statistics, you can withdraw it at any time. Contact us at support@vora.company. We'll reply within one month. If you're not happy with our answer, you can complain to the Data Protection Commission at dataprotection.ie.
VORA isn't meant for children and we don't knowingly collect information about them.
9. Changes
We'll update this policy when what we do changes, and change the date at the top. If a change matters to customers, we'll email them first.
10. Contact
João Gabriel Pereira Guimarães, trading as VORA. Email: support@vora.company.