A focused, accessible tool for UK chefs and restaurateurs to identify and adopt the latest global culinary trends with ease.

Think Menu Lab — Privacy Policy

1. Who we are

Think Menu Lab is an app for restaurants and chefs. It helps with menu ideas, recipes, costing, stock, staff rotas and food safety records.

The app is run by Mersey Hospitality Group Ltd (trading as Think Menu Lab), company number 17084869, based in the United Kingdom.

Website: thinkmenulab.com
Address: Unit 2b The Colonnades, Albert Dock, Liverpool L3 4AA
Email: hello@thinkmenulab.com
ICO registration number: ZC278118

In this policy, "we", "us" and "our" mean Think Menu Lab. "You" means anyone who visits or uses the app.

We follow UK data protection law, including the UK GDPR and the Data Protection Act 2018.

2. What data we collect

We only collect what the app needs to work.

Account details: Name, email address and password (passwords are stored securely by our app platform). Your restaurant's name, type and the role you hold (for example chef or manager).
What you create in the app: Dishes, recipes, saved items, folders and notes. Photos you upload, such as a dish or a paper invoice. Voice recordings, if you use voice input. We turn them into text to fill in orders, stock counts or wastage.
Restaurant business data: Till sales from your point-of-sale system (for example Square), if you connect it. Supplier invoices, prices, orders and deliveries. Stock counts, wastage and staff food logs. Food safety records: temperature checks, daily diary entries, training sign-offs and finger-drawn signatures.
Staff data (entered by the restaurant): Staff names, roles and skills. Rotas, contracted hours, availability and time-off requests. Clock-in, break and clock-out times. Absence records, including sickness. We only record that someone was off sick, not medical details.
Technical data: Device and browser type, IP address and basic usage data when you're signed in: which screens you open, how long they're on screen, and which buttons you tap. We never record what you type. This is stored by us, not in a cookie. Small items stored in your browser, such as how many free tries a visitor has used.
Social media: If you connect a business Instagram, Facebook or TikTok account, we receive the data described in section 3.

3. Instagram and Meta data

Think Menu Lab uses Meta's official tools (Instagram API with Facebook Login for Business).

If you connect your business account: You choose to log in with Facebook and pick which Page and Instagram professional account to share. We may receive your Page and Instagram account name, ID and profile picture; your own posts (images, captions, links and post dates), so they can show in the app's Feed; and an access token that lets the app read this data for you. We never see or store your Facebook or Instagram password.

Public hashtag content: We use Meta's Hashtag Search tool to spot food trends. This reads public posts that use certain hashtags. We use it to count and track which dishes and ingredients are trending, and to find posts that use our own hashtags, such as #thinkmenulab. We do not use this to build profiles of individual people.

What we don't do with Meta data: We don't sell it. We don't use it for advertising profiles. We don't share it with anyone except the service providers in section 5.

Removing access: You can disconnect at any time in the app, or in your Facebook settings under Business Integrations. When you do, we delete your Meta data within 30 days. See section 8 for data deletion requests.

4. How and why we use your data

We use data to run the app and keep it safe. Each use has a lawful basis under UK GDPR.

Create and run your account — Contract.
Run app features: recipes, costing, stock, orders, rotas, food safety records — Contract.
Use AI to create recipes, images and dish breakdowns, and to read invoices and voice notes — Contract.
Show your connected social posts in the Feed — Consent (you choose to connect).
Track food trends from public hashtags — Legitimate interests (keeping the app current).
Fix bugs, prevent misuse and keep the app secure — Legitimate interests.
Understand how the app is used, so we can improve it — Legitimate interests.
Send service emails, such as staff invites and account notices — Contract.
Send news and offers by email — Consent (you can opt out at any time).
Keep records the law requires — Legal obligation.

Staff data: When a restaurant adds its staff, the restaurant decides how that data is used. The restaurant is the controller. We process it on their behalf, only to run the app for them.

AI: Some features send your content to an AI provider to process it. The AI provider does not use your data to train its models. We do not make automated decisions that have legal or similar effects on you.

5. Who we share data with

We never sell your personal data. We only share it with trusted providers who help run the app, under contracts that protect it.

Base44 — Hosts the app, its database and your files. Handles sign-in and service emails. Some AI features run through Base44's own AI service.
OpenAI — AI for recipes, images, invoice and photo reading, voice-to-text and Sage, our voice assistant.
Google — Sign in with Google. Gmail sends reports and reads supplier invoice emails. Drive and Docs hold spec cards. Also fonts and YouTube videos in the Feed.
Meta (Facebook and Instagram) — Social account connection and hashtag trends.
TikTok — Shows public TikTok videos in the Feed.
Square (or your own till provider) — Sends till sales, staff shifts and booking deposits into the app, if you connect it.
Xero — Sends staff hours to payroll, if you connect it.
Your suppliers (for example Caterite) — Receive orders you choose to send.
Behold — Shows our own Instagram posts on the website.
LinkedIn — Our own company posts only. No user data.
Unsplash — Some stock food photos.
Namecheap — Domain and email.
Stripe (when payments start) — Takes subscription payments. We never see full card numbers.

We may also share data if the law requires it, such as a court order; to protect people's safety or our legal rights; or if the business is sold, to the new owner, who must follow this policy.

Inside a restaurant account, managers can see that restaurant's data. One restaurant can never see another restaurant's data.

6. Transfers, retention and security

Data outside the UK: Some of our providers store or process data outside the UK, mainly in the USA. When this happens, we use legal safeguards. These include the UK–US Data Bridge or the UK's International Data Transfer Agreement.

How long we keep data:

Account data — While your account is open, then deleted within 90 days of closing.
Dishes, recipes and photos — While your account is open.
Food safety records — 2 years, as restaurants may need them for inspections.
Staff, rota and clock-in records — As long as the restaurant needs them, up to 6 years for payroll and employment law.
Meta data from a connected account — Until you disconnect, then deleted within 30 days.
Voice recordings — Deleted once turned into text.
Technical and usage data — Up to 12 months.

Keeping data safe: Data is sent over secure, encrypted connections (HTTPS). Each restaurant's data is kept separate. Only people with a login and the right role can see a restaurant's data. Food safety times are stamped by the app and can't be edited.

No system is 100% secure. If a breach puts your data at risk, we will tell you and the ICO when the law requires it.

7. Cookies and browser storage

We use a small amount of browser storage to make the app work. For example: keeping you signed in; remembering how many free tries a visitor has used; remembering simple choices, like a filter you picked. These are essential, so they don't need consent.

If we add analytics or advertising cookies later, we will ask you for your consent first.

You can clear cookies and storage in your browser settings. Some parts of the app may then stop working.

8. Your rights

Under UK law, you have the right to: see the data we hold about you; correct data that's wrong; ask us to delete your data; limit or object to how we use it; get a copy of your data to take elsewhere; withdraw consent at any time, such as disconnecting Instagram or unsubscribing from emails.

To use any of these rights, email hello@thinkmenulab.com. We will reply within one month.

If you're a member of staff and your restaurant added your data, you can contact the restaurant or us. We'll help the restaurant answer.

Deleting your data: You can delete your account in the app's account settings. Or email hello@thinkmenulab.com with the subject "Delete my data". We'll delete your personal data within 30 days. This includes any data from a connected Facebook or Instagram account. We may keep a small amount where the law requires it, such as food safety or payroll records.

Complaints: If you're unhappy, please contact us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Children: Think Menu Lab is for people aged 18 and over who work in hospitality. We don't knowingly collect data from children.

Changes to this policy: We may update this policy. If the changes are important, we'll tell you in the app or by email.

Last updated: 19 October 2026