01 Why we publish this
Article 28 of the EU Data Act (Regulation (EU) 2023/2854) asks a provider of a data processing service to publish two things. The first is the jurisdiction to which the systems of its service are subject. The second is the measures that it takes to prevent access by governments outside the EU to non-personal data held in the EU. This applies where that access would conflict with EU law or with the law of an EU country.
Section 8.3 of our customer agreement says that we publish both on this page.
Non-personal data is data that is not about a person, for example a product list or the order dates of a product. For personal data, the GDPR and our data processing agreement apply. Our Sub-processors page lists who processes it.
02 Who provides the service
Enelyse Consulting Kft. provides the MenuMap service. It is a company registered in Hungary, with its registered office in Debrecen.
Hungarian law governs our customer agreement. The courts of Debrecen, Hungary, decide its disputes.
03 Where the systems are
The MenuMap service runs on the systems of the companies in this table. They are the sub-processors that Annex IV of our data processing agreement lists.
| Company | What it runs for the MenuMap service | Where the systems are | Country of the company |
|---|---|---|---|
| Microsoft AzureMicrosoft Ireland Operations Limited | The API, the databases, the file storage, the store of current work, the server that reads and analyses menus, the backups and the technical logs | EU: the Azure regions Germany West Central (Germany), Sweden Central (Sweden) and North Europe (Ireland). Azure copies the database backups to the region paired with Germany West Central. | Ireland |
| Microsoft Azure AI FoundryMicrosoft Ireland Operations Limited | The AI models that read and analyse menus | The resource is in Sweden Central (Sweden). Reading the menu files runs in the EU data zone. Later analysis steps may run in any region where Microsoft deploys the model. This can be outside the EU. | Ireland |
| Microsoft 365Microsoft Ireland Operations Limited | The mailbox that sends the sign-in codes and the other account emails of the MenuMap service | EU and EFTA | Ireland |
| HetznerHetzner Online GmbH | MenuMap's development server | EU (Helsinki, Finland) | Germany |
| VercelVercel Inc. | The delivery of the pages and scripts of the MenuMap web app | USA, and Vercel's global network | USA |
| AnthropicAnthropic Ireland, Limited | AI services that we use to operate and support the MenuMap service | USA | Ireland |
The systems in the EU are subject to EU law and to the law of the EU country where they are. A company can also be subject to the law of the country where it or its parent company is. Microsoft Ireland Operations Limited and Anthropic Ireland, Limited belong to groups whose parent company is in the USA. Vercel Inc. is a company in the USA.
04 What we do against access from outside the EU
These measures are in place today.
- Storage in the EU. The MenuMap service stores customer data in Azure data centres in the EU. Section 05 names what runs outside the EU.
- The content of the app does not pass through Vercel. The content of the web app, such as menu analyses, notes and comments, goes directly between the browser and our API on Azure.
- Encryption. Our web app and our API accept only HTTPS with TLS 1.2 or newer. Azure encrypts the data that the MenuMap service stores on disk.
- Access. Only named MenuMap staff can access our production systems. Our API reaches the databases, the files and the store of current work through Microsoft Entra managed identities.
- Microsoft's commitments. We use Microsoft Azure, Azure AI Foundry and Microsoft 365 under the Microsoft Products and Services Data Protection Addendum. Its version of 1 November 2026 says: "Microsoft will not disclose or provide access to any Processed Data to law enforcement unless required by law. If law enforcement contacts Microsoft with a demand for Processed Data, Microsoft will attempt to redirect the law enforcement agency to request that data directly from Customer." If Microsoft must disclose such data, it says that it "will promptly notify Customer and provide a copy of the demand unless legally prohibited from doing so". It also says that Microsoft will not give any third party "platform encryption keys used to secure Processed Data or the ability to break such encryption". In these terms, "Customer" is MenuMap.
- Our own commitment. Section 9.3 of our customer agreement covers the case where the law or an authority requires us to disclose a customer's information. We then tell the customer first, where the law allows it.
05 What these measures do not cover
- Some steps of the menu analysis run on Microsoft's global capacity. In Microsoft's words, such a request "may be processed in any geography where the relevant model sold by Azure is deployed". This can be outside the EU.
- Vercel receives the request data of the browser, such as the IP address, in the USA and in its global network.
- Anthropic's AI services, which we use to operate and support the MenuMap service, process customer data in the USA.
- Microsoft's terms allow a disclosure that the law requires.
06 Questions
Write to privacy@menumap.ai.