MenuQR Lanka Back to home

Trivista Labs (Pvt) Ltd

Privacy Policy

How we collect, use, share and protect personal data on the MenuQR Lanka platform — for both the restaurants who subscribe and the diners who use their menus.

Effective date 20 July 2026Version 1.0Applies to menuqrlanka.com & all restaurant menus

1. Who we are

MenuQR Lanka (the “Platform” or “Service”) is owned and operated by Trivista Labs (Pvt) Ltd (“Trivista Labs”, “we”, “us”, “our”), a company incorporated in Sri Lanka under company registration number PV 00367272, with its registered office at No. 69/1, Mihindu Place, Hiddellana, Ratnapura 70000, Sri Lanka.

For any privacy question or request, contact us at contact@trivistalabs.lk, WhatsApp +94 78 114 9001, or trivistalabs.io.

2. Scope & the two types of user

This policy covers two groups of people whose data we handle:

  • Restaurant Clients — businesses (and their staff) who register for an account and subscribe to MenuQR Lanka to publish a digital menu (“Client”).
  • Diners — members of the public who scan a QR code or open a link to view a Client’s menu, leave a review, or place an order (“Diner”).
Important — who controls diner data. For a Diner’s personal data (such as a name and phone number given when placing an order), the Client (the restaurant) is the data controller and Trivista Labs acts as a data processor on the Client’s behalf. Each Client is responsible for how it uses Diner data it receives and for informing its own customers as required by law.

3. Personal data we collect

From Restaurant Clients:

  • Account & contact details: name, email address, phone/WhatsApp number, business name, city/address, and login credentials (passwords are stored only in a securely hashed form and are never visible to us).
  • Business content: menu items, prices, descriptions, photographs, opening hours, branding and any other information you enter into your dashboard.
  • Billing information: subscription plan, invoice/payment references and payment status. We do not collect or store full card numbers.
  • Support communications: messages you send us by email, WhatsApp or other channels.

From Diners:

  • Order details (only when a Client enables QR Ordering): the name, contact number and table / room number or delivery address the Diner enters at checkout, together with the items ordered and any notes. This is compiled into a message the Diner sends to the restaurant via WhatsApp (see section 5).
  • Reviews (optional): a star rating and, if the Diner chooses, a name and comment.
  • Usage & analytics data: pseudonymous information about menu activity — a randomly generated session identifier, a daily-rotating hashed visitor value (used only to estimate returning visitors), pages/items viewed, searches, taps on Call / WhatsApp / Directions buttons, approximate country, referrer and general device/browser type. We design this so individual Diners are not directly identified.

Collected automatically: a small amount of cookie / local-storage data to keep a session identifier, remember a cart and language choice, and keep a Client logged in (see section 9); and standard server logs (IP address, timestamps, error data) kept by our hosting providers for security and reliability.

4. How and why we use personal data

  • Provide the Service: create and secure accounts, publish menus, generate QR codes, and run search, ordering and translation features.
  • Analytics for Clients: show each Client aggregated statistics about their own menu (views, popular dishes, contact taps) so they can improve their business.
  • Enable ordering: format a Diner’s order and open WhatsApp so it can be sent to the Client. We do not store the order’s personal contents on our servers as a standard part of this flow.
  • Billing & administration: manage subscriptions, issue invoices and keep records.
  • Communicate: respond to support requests and send service-related notices.
  • Improve & secure: maintain, debug and improve the Platform, prevent fraud and abuse, and keep it secure.
  • Legal compliance: comply with applicable law and lawful requests.

5. QR Ordering and WhatsApp

When a Client enables QR Ordering, a Diner’s order is assembled into a text message that opens in the Diner’s own WhatsApp application, addressed to the Client’s WhatsApp number. By sending it, the Diner shares their details directly with the restaurant. WhatsApp is operated by Meta Platforms, Inc. and is an independent third party governed by its own terms and privacy policy, over which we have no control. Trivista Labs is not a party to, and is not responsible for, the transaction or communication between a Diner and a restaurant.

6. Legal basis for processing (PDPA)

We process personal data in accordance with the Personal Data Protection Act, No. 9 of 2022 of Sri Lanka (“PDPA”), relying on one or more lawful bases, including:

  • Performance of a contract — to provide the Service to Clients under our Terms & Conditions.
  • Consent — for example, when a Diner chooses to submit an order or a review.
  • Legitimate interests — such as securing the Platform and producing aggregated, pseudonymous analytics, balanced against individual rights.
  • Legal obligation — where processing is required by law.

7. Sharing & disclosure

We do not sell personal data. We share it only as follows:

  • With the relevant restaurant: Diner order and review data is made available to the Client whose menu was used.
  • With service providers (sub-processors) who help us run the Platform, under appropriate confidentiality and data-protection obligations (see section 8).
  • For legal reasons: where required by law, court order or a lawful request, or to protect our rights, users or the public.
  • Business transfers: in connection with a merger, acquisition or sale of assets, subject to this policy.

8. Sub-processors we use

We rely on reputable providers to operate the Platform. These currently include:

  • Supabase — database, authentication and file storage (hosting of menu content and account data).
  • Vercel — application hosting and content delivery for the website and menus.
  • Google Cloud Translation — machine translation of menu text when a Client enables multi-language menus. Only menu text is sent; no Diner personal data.
  • WhatsApp / Meta — the channel through which Diners send orders to restaurants (initiated on the Diner’s own device).

This list may change as the Platform evolves; the current list is available on request.

9. Cookies & local storage

We use only the storage necessary to operate the Service: a session identifier and analytics helpers, a saved shopping cart and language preference for Diners, and an authentication session for logged-in Clients. We do not use third-party advertising or cross-site tracking cookies. Diners can clear this data at any time through their browser settings.

10. Data retention

  • Client account & menu data — for the life of the account and a reasonable period afterwards, then deleted or anonymised, subject to legal record-keeping requirements.
  • Analytics data — kept in pseudonymous form for a limited period to produce trends, then aggregated or deleted.
  • Reviews — retained while the Client’s menu is active or until removed.
  • Order contents — not stored on our servers as standard; any copy sent via WhatsApp resides with the Diner and the restaurant.

11. Data security

We apply appropriate technical and organisational measures, including: row-level access controls that isolate each restaurant’s data, encryption of data in transit (HTTPS), hashing of passwords and of visitor analytics values, and restricted administrative access. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect personal data against unauthorised access, loss or misuse.

12. Your rights under the PDPA

Subject to the PDPA and applicable law, individuals have rights to: access their personal data; request correction of inaccurate data; request erasure; withdraw consent; and object to or request restriction of certain processing.

  • Clients can exercise many of these directly in the dashboard, or by contacting us.
  • Diners should contact the relevant restaurant first (as the controller of their order/review data). You may also contact us and we will assist or forward the request to the appropriate Client.

To make a request, email contact@trivistalabs.lk. We will respond within the timeframe required by law. You also have the right to lodge a complaint with the Data Protection Authority of Sri Lanka.

13. Responsibilities of Restaurant Clients

Because Clients control the Diner data they collect through their menu, each Client agrees to: use Diner data only for fulfilling and servicing orders and legitimate business communication; keep it secure and confidential; not sell or misuse it; and comply with the PDPA and other applicable laws, including providing any notice or obtaining any consent required from its own customers. Clients indemnify Trivista Labs against claims arising from their misuse of Diner data, as set out in the Terms & Conditions.

14. Children

The Platform is intended for businesses and general dining audiences and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will delete it.

15. International transfers

Our service providers may process or store data on servers located outside Sri Lanka. Where data is transferred internationally, we take reasonable steps to ensure it remains protected consistent with this policy and applicable law.

16. Changes to this policy

We may update this Privacy Policy from time to time. The “Effective date” above shows the latest version. Material changes will be notified to Clients by email or through the dashboard. Continued use of the Platform after an update constitutes acceptance of the revised policy.

17. Contact us

Trivista Labs (Pvt) Ltd
Email: contact@trivistalabs.lk
WhatsApp: +94 78 114 9001
Web: trivistalabs.io
Registered office: No. 69/1, Mihindu Place, Hiddellana, Ratnapura 70000, Sri Lanka