Cookie Policy

1. Who we are and what this Policy covers

This Cookie Policy explains the use of cookies and similar technologies on the public MenuAI websites, including menuai.pro and menuai.cz. The operator is World Travel Club s.r.o., company identification number (IČO) 07214073, with its registered office at Ostrčilovo náměstí 462/4, Nusle, 128 00 Praha 2, Czech Republic (MenuAI, the Company, we, us or our). Contact us at team@menuai.pro.

Read this Policy together with the MenuAI Privacy Policy, available through the footer of this website. That notice explains the wider processing of personal data, including the roles of the Company and venues, purposes, lawful grounds, recipients, retention and individual rights. This Policy adds information about storage on, and access to information from, your device; it is not consent to processing.

Business accounts, guest services and a venue’s own website may offer different functions and therefore require additional information about their actual storage technologies. The public-website inventory below must not be read as a complete inventory for every signed-in account, payment service or independently operated venue website. A notice associated with a particular service should identify any additional technologies and choices relevant to that service.

MenuAI’s subscription relationship with a business is separate from a guest’s purchase from a venue. The venue or its owner is the seller to guests and receives their payments through its own payment arrangements. This Policy does not make MenuAI the seller or payment recipient for those purchases.

2. Cookies and similar technologies

A cookie is a small piece of information stored by a browser for a website. Depending on its settings, it may be sent with later requests to the domain for which it was set. Cookies can hold an identifier or preference; they do not have to contain your name to relate to an identifiable person or browser.

A session cookie normally ends with the browser session, subject to the browser’s session-restoration behaviour. A persistent cookie has a configured expiry and can remain between visits until it expires or is removed. A first-party cookie is associated with the site you visit; a third-party cookie is associated with another domain involved in providing content or a service.

Local storage and session storage are other ways of retaining information in the browser. Local storage generally remains until it is removed, while session storage normally belongs to a particular tab or session. Pixels, embedded content and similar mechanisms can cause a request that reveals information about a page visit. These explanations do not mean that every technology listed here is installed on the public website.

The rules for storing or accessing information on a device are not limited to files named cookies. Changing a label or using another browser technology does not remove an applicable consent requirement. Ordinary delivery of a webpage, a temporary browser cache and a server record also need to be distinguished from optional tracking; their purposes and effects must be assessed separately.

3. Information associated with browser technologies

Depending on the function, information may include a browser identifier, referral partner code, referral-interaction identifier, selected settings, the page or link used, campaign parameters and the time of an interaction. A network request can also reveal an IP address, browser and device information and the referring page. Not every item is necessarily stored in a cookie.

A referral identifier may be associated with a later registration or a business record to establish which partner introduced a customer and to administer the referral relationship. An identifier that is pseudonymous at the browser level is not automatically anonymous once other records can be connected to it.

Do not put passwords, payment-card details or sensitive personal information in referral links or campaign parameters. A copied link can expose its parameters to a recipient, browser history or the service that receives the link. Information voluntarily included in a URL is not made confidential by being called a campaign code.

The named referral cookies in this Policy are intended to carry referral context. They are not intended to hold the contents of a guest’s order, health information or payment credentials. The wider handling of account, transaction and enquiry information is explained in the Privacy Policy and the notice applicable to the service concerned.

4. Purposes and the distinction between necessary and optional use

Strictly necessary technologies are those required for transmitting a communication or providing a service you expressly request, within the applicable legal exception. Depending on the service, this may concern protecting a requested form or maintaining an authenticated session. A useful business purpose, a security label or inclusion in a subscription does not by itself establish that exception.

Preference technologies can remember choices such as a language or display setting. Whether a particular use is necessary depends on the actual request and purpose; not every preference technology is exempt from consent. The existence of a language selector does not establish that a language cookie is set, because a choice may instead be expressed in the page address.

Referral and campaign attribution serve a separate commercial purpose: recognising an introduction and carrying that context to registration. Persistent attribution is not treated as necessary for reading public pages merely because it helps administer a partner programme. Non-essential storage or access must meet the applicable prior-consent rules.

Audience analytics, advertising and cross-site profiling are separate purposes from delivering a page or protecting a form. A necessary technology must not be repurposed for these activities without assessing the additional lawful grounds, information and consent that may be required.

5. Public-website referral cookie inventory

The public website uses the following first-party referral identifiers when referral context is present. Both belong to the commercial referral-attribution purpose; their appearance in this inventory does not establish an exemption from consent. The stated duration is the browser setting for a write or renewal, not a universal period for every related record.

• menuai_partner_ref — set by MenuAI to retain the referral partner code and carry an introduction between visits and towards registration. Content: a partner code, which may be associated with a later account or referral record. Configured lifetime: up to 120 days from the latest write or renewal. Scope: the menuai.pro domain and its subdomains when set there; on menuai.cz it is limited to the host that sets it. It is not a sign-in credential, and it is not necessary simply to read the public website.
• menuai_partner_click_id — set by MenuAI to retain the identifier of a referral interaction and associate the relevant introduction with a subsequent registration. Content: a referral-interaction identifier; it may be replaced or cleared when the partner context changes. Configured lifetime: up to 120 days from the latest write or renewal. Domain scope follows the partner-code cookie described above. It is not itself evidence that a subscription or commission is payable and is not necessary simply to read public pages.

Where saved referral context is read on a later visit, the cookies can be written again and their configured expiry renewed. Browsers may shorten retention or prevent storage. Deleting a cookie does not prevent it from being set again if the relevant conditions arise, for example through another referral link; an effective refusal of optional storage must therefore be respected by the relevant consent mechanism, rather than relying solely on deletion.

6. Referral links, campaign parameters and separate domains

Referral context can be supplied in a link as well as in a cookie. For example, a link may contain ref, partner, referralClickId or clickId parameters. Campaign parameters can include utm_ values or identifiers attached by the service from which a visitor arrives. These are URL parameters, not additional cookie names.

Relevant context may be carried when switching language or following a link to registration. Separate domains do not share cookies automatically: information can instead be passed in a link and then handled by the destination under the rules applicable there. Sharing a device or moving between languages does not by itself express consent to a new purpose.

A referral interaction may create a related record containing the partner context, landing-page address, referring page and time of the interaction. Browser storage and the subsequent processing of such a record are separate operations; deleting browser information does not necessarily erase an attribution or accounting record already lawfully held.

A referral code is used to administer introductions, not as permission to send unrelated marketing to a visitor or to disclose guest orders to a partner. A partner’s entitlement is determined by the applicable partner terms and valid business records, not merely by the existence of a cookie.

7. Preferences, account sessions and browser storage

On the public website, the language of a page can be identified by its address and by your choice in the language menu. The referral inventory does not include a separate public-website language cookie. A selected language passed to registration is distinct from persistent storage by an account service.

A signed-in service may need to retain information for access, session protection or preferences. The purpose, duration and necessary or optional character must be explained for that service. Do not infer that every account uses the same cookie names or that its stored information has the 120-day referral lifetime.

Removing all site data can sign you out, reset settings or affect an unfinished task. Some browser storage is not displayed in the ordinary cookie list and may require a separate clear-site-data control. Information held only in a current page’s memory is different from information retained between visits.

The absence of a cookie does not mean that no personal data is processed. An enquiry submitted through a form, a server request or an authenticated action may involve personal information even where nothing new is stored in the browser. Conversely, ordinary browser storage must not be described as optional profiling without examining its actual purpose.

8. Form protection, external resources and embedded content

A requested contact form may use protective verification to distinguish legitimate interactions from misuse. Displaying or completing that verification can involve browser and network information and a temporary verification result. It is not an authorisation for unrelated advertising, and a protection label does not make every operation exempt from device-storage rules.

A webpage can request external resources needed to display its content, such as a font or an interface resource. The receiving service may obtain the information inherent in that request. A request to deliver a resource does not by itself establish that a persistent tracking cookie is placed, and this Policy does not assign unverified cookie names or durations to such services.

If an external feature requires optional tracking or storage, the applicable information and prior-consent requirements must be addressed before it is activated. Selecting a link to an independent website is different from authorising that website’s technologies to load inside MenuAI. The destination’s own notice applies to its activities.

Security-related information must be limited to the legitimate protective purpose and any lawful retention needed for that purpose. Information that must be disclosed by law about processing remains available through the applicable notice or a request to team@menuai.pro; confidentiality does not override mandatory transparency rights.

9. Analytics, advertising and profiling

The referral cookies listed above are intended for recognising an introduction and administering attribution. That purpose must not be confused with a blanket authorisation for audience measurement, behavioural advertising, cross-site profiling or disclosure of a person’s activity to an advertising network.

This inventory does not list a general audience-analytics cookie or an advertising-network cookie for the public website. General descriptions of analytics in product marketing concern business-facing capabilities and do not establish that an audience tracker is installed in a visitor’s browser.

If additional analytics or advertising technologies are introduced, information must identify their actual purposes, responsible parties, relevant storage periods and choices before any use requiring consent begins. A broad statement that services may improve over time does not authorise undisclosed trackers.

A browser preference such as Do Not Track or Global Privacy Control must be distinguished from a choice recorded through a particular service. This Policy does not claim that every browser signal is automatically interpreted by all MenuAI functions. Applicable statutory rights and requirements for such signals remain unaffected; contact us if you need help communicating a choice.

10. Consent and lawful device access

Under the applicable Czech and European rules, non-essential storage on, or access to information from, your device requires valid prior consent unless a specific legal exception applies. A lawful ground for later processing of personal data does not by itself replace that device-access consent. In particular, a claim of legitimate interests does not automatically exempt referral or analytics cookies.

Where consent is required, it must be freely given, specific, informed and expressed by an unambiguous affirmative action. Optional purposes must remain inactive until the required consent is obtained. Refusal should be as accessible as acceptance, and withdrawal must be as easy as giving consent. Necessary public information must remain accessible without accepting optional tracking.

Continued browsing, scrolling, silence, closing a notice, an already selected box or accepting general Terms of Service is not consent to every optional cookie purpose. A browser’s default acceptance of cookies is also not proof of a specific informed choice. Consent to one domain, purpose or provider must not automatically be treated as consent to all others.

This page supplies information; it is not a consent-control panel and does not record a choice. Where a separate control is offered, use the options actually available there. If a control is unavailable, contact team@menuai.pro for assistance; an email address or the publication of this Policy does not itself supply prior technical blocking or establish that a consent mechanism has been implemented.

11. Managing cookies and withdrawing a choice

You may refuse optional purposes and withdraw consent where consent is the ground. Use the relevant service’s available choice controls to change a recorded preference. Withdrawal affects future consent-based activity and does not make processing carried out lawfully before withdrawal unlawful. It also does not cancel a separate contractual or statutory duty with its own lawful ground.

Your browser normally allows you to view, block or remove cookies and other site data, either for individual sites or more widely. Consult the current privacy or site-data settings of the browser you use. You may need to check each browser, profile and device and each relevant domain separately. Private browsing is not a universal guarantee that no information is transmitted or retained elsewhere.

To remove stored referral context, check the menuai.pro and menuai.cz site-data entries applicable to your visits, including relevant subdomains. Links may still contain referral or campaign parameters after cookies are removed. A new link or a saved parameter may supply context again; deleting browser data is therefore different from registering an effective objection or withdrawal with the relevant service.

Blocking genuinely necessary technologies can affect a requested function, such as sign-in or a protected form. Refusing optional referral attribution should not prevent reading public pages. If your browser settings prevent an enquiry from being submitted, you can contact team@menuai.pro directly without using the form.

If you cannot find a relevant control or believe a choice is not being respected, tell us the website or service, the nature of the issue and the browser information reasonably needed to investigate. Do not send passwords, full payment details or an unredacted browser history. We may need proportionate information to locate a record, but must not collect unnecessary personal data merely to handle a preference.

12. Browser lifetimes and retention of related records

The two referral cookies have a configured maximum age of 120 days for each write or renewal. This can be shorter because of deletion, browser restrictions, a change of context or another applicable limit. A renewed expiry can extend the time from the first visit; it should not be presented as guaranteed deletion 120 days after the original introduction.

Session information, a preference, a consent record and a referral-accounting record serve different purposes and need not have the same retention period. The applicable period must reflect necessity, statutory obligations and the information given for that function. The referral lifetime must not be applied indiscriminately to all browser storage or all records held by the Company.

Records needed to demonstrate a choice, investigate misuse, administer a valid referral, resolve a dispute or meet accounting obligations may be kept for the justified period under the Privacy Policy and applicable law. Expiry of a browser cookie does not by itself require erasure of a record that has a separate continuing lawful purpose, and that purpose does not authorise indefinite optional tracking.

A deletion request must be assessed according to its scope and applicable rights. Removing information from an active service and expiry of any lawfully retained recovery copy can occur at different times. This does not permit retained information to be reused for an unrelated purpose or kept without an applicable ground.

13. Recipients and international processing

Authorised Company personnel and service providers may process relevant information where needed to operate the requested service, protect it, administer referrals or comply with a legal obligation. Access must remain limited to the purpose and the applicable contractual and data protection obligations. A cookie’s domain does not identify every recipient of a related server record.

A referral partner may receive information appropriate to administering its referral relationship, such as an attributed business introduction or the status relevant to a lawful commission calculation. The presence of a referral cookie does not grant that partner unrestricted access to a visitor’s profile, guest orders or payment information.

Processing involving a recipient outside the European Economic Area must meet the applicable transfer requirements. The safeguards described in the Privacy Policy, such as an applicable adequacy decision or appropriate contractual safeguards where required, must be assessed for the actual transfer. Neither a cookie banner nor this Policy is a blanket waiver of international-transfer protections.

Information about a particular processing arrangement, relevant recipient categories or applicable safeguards can be requested at team@menuai.pro. A provider acting for us must be distinguished from an independent service that determines its own purposes. Any additional recipient information required for a valid choice must be supplied before the choice is requested.

14. Grounds for processing personal data

Where information associated with a cookie or similar technology is personal data, the Company must also identify a lawful ground under data protection law. The ground depends on the actual purpose and our role. Consent to device storage and the ground for later personal-data processing are related but distinct requirements.

Consent may support optional attribution or other optional processing for which it is requested. Legitimate interests may support proportionate security, fraud prevention or the administration and defence of lawful business claims where the required balancing assessment permits it. A legal obligation may require particular records; contractual necessity applies only where processing is objectively necessary for a contract with the individual concerned.

The existence of a contract with a restaurant does not automatically make every operation involving a guest or website visitor necessary for that individual’s contract. Nor does the use of a pseudonymous identifier remove the requirement for a lawful ground when the information is personal data.

You may ask about the ground for processing concerning you and object where the applicable right permits it. We must explain the relevant purpose and ground rather than relying on a general statement that all data improves the service. The Privacy Policy provides additional information about our processing activities and roles.

15. Your data protection rights

Subject to the applicable conditions, you may request access to personal data, correction, erasure, restriction or portability and may object to processing based on legitimate interests. You may withdraw consent for consent-based processing. Where personal data is processed for direct marketing, the applicable right to object must be respected.

Send a request to team@menuai.pro. We may request information proportionate to verifying your authority and locating relevant records, without requiring unnecessary identity documents or sensitive information. A browser identifier may not allow us to identify a person; we do not have to collect extra information solely to identify them where the law does not require it, and we must explain any resulting limitation on a request.

Requests are handled within the periods required by applicable law, generally without undue delay and within one month under the GDPR, subject to a lawful extension with the required explanation. A right is not unconditional: we may need to retain particular records for an applicable legal obligation or the establishment, exercise or defence of legal claims, with reasons provided as required.

A referral cookie is not by itself a decision producing legal or similarly significant effects about a visitor. If processing involves profiling or a qualifying automated decision, the additional transparency and safeguards required for that activity must be provided; a general cookie notice cannot waive them.

You may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), https://uoou.gov.cz/, or another competent supervisory authority, including where the GDPR permits a complaint in the place of your habitual residence, work or the alleged infringement. Contacting us first is not a condition for exercising that right.

16. Venues, account services and independent websites

A venue may decide how to use its own guest-facing functions, communications or independently selected services. It must provide the information and obtain any consent required for purposes it determines. Where MenuAI processes data on the venue’s behalf, the applicable data processing agreement, lawful instructions and actual allocation of responsibilities remain relevant.

Responsibility is determined by actual purposes and conduct. Calling the venue the controller does not remove the Company’s responsibilities for technologies it independently chooses for its own purposes. Likewise, this public-website Policy is not a substitute for a venue’s own legally required notice to its guests.

A link to a payment provider, social network, partner or another website takes you to an independent service unless stated otherwise. That service’s cookies, storage and privacy practices must be considered under its own notice. An external link or logo is not evidence that the destination’s advertising technologies are already installed on MenuAI.

If you are unsure who is responsible for a particular storage operation, provide the page or service concerned when contacting us. We will address processing for which we are responsible and, where appropriate, help identify the relevant venue or independent service without denying our own obligations.

17. Changes to this Policy

We may update this Policy to reflect an actual change in technologies, purposes, legal requirements or available choices. The version and preparation or update date identify the text. A material change must be explained through an appropriate notice where required, and the relevant information must be available before a new consent-based purpose begins.

An update does not retrospectively legalise an earlier operation, turn continued browsing into consent or expand the scope of a recorded choice. If a new purpose or recipient requires new consent, that consent must be obtained separately. A change to a public page does not automatically amend an existing contractual commitment.

The cookie inventory and the actual operation must remain consistent. A new technology must not be treated as approved merely because it resembles an existing category, and an outdated cookie description must be corrected when its purpose, duration or scope changes.

18. Contact and language versions

Questions about this Policy, browser choices or personal data can be sent to team@menuai.pro or by post to World Travel Club s.r.o., IČO 07214073, Ostrčilovo náměstí 462/4, Nusle, 128 00 Praha 2, Czech Republic. We have not appointed a separate Data Protection Officer; use the contact above for these matters.

The English and Ukrainian versions are intended to provide equivalent information and choices. This Policy does not give one language an overriding priority that restricts an individual’s mandatory rights. If you find a discrepancy or cannot understand a notice relevant to your visit, contact us for clarification.

This Policy does not require publication of confidential implementation details. That protection does not restrict information that must be provided by law, including the identity of the responsible party, actual purposes, applicable rights or the information required for valid consent.