Privacy notice for businesses we contact

Synaltix LLC (1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA) makes Thmenu, a digital QR menu with table ordering for restaurants, and is the controller of the data described here. Contact for anything in this notice: contact@synaltix.io.

Sections 2 to 11 describe the emails our team prepares one by one. Sections 12 to 18 describe our US campaign and, for the businesses it found, apply instead of sections 2 to 11.

We sent your business one introductory email about Thmenu, or we noted your business so that we could. The email names where we found the address and links to this page. If you do not reply, it is the only email you will get from us.

• A Google Maps link that someone on our team pasted. We use only what the link itself carries: the business name, the map pin and the place identifier. We do not copy the Google page.
• OpenStreetMap (© OpenStreetMap contributors, ODbL): the address for the map pin, and the business's public tags (name, type, website, phone). We do not take email addresses from OpenStreetMap.
• Your own website. We follow your robots.txt, make at most one request per second and read at most three pages. We keep only an address that belongs to your business; addresses of agencies or platforms and role addresses (such as noreply, abuse, postmaster, privacy, dpo, legal or security) are refused. We note the language of the site.
• Entries our team makes by hand.

We do not buy contact lists and we do not use data brokers.

About your business: name, address, city, country, map position, type of venue, website, business email address and phone number, the language of your website (and how sure we are of it), the legal form and the register we checked it in, the Google and OpenStreetMap identifiers of the place, a note from our team, and — where your website shows a menu — a draft of that menu we prepared.
About our email: the address we wrote to, the subject and text, and when it was sent, delivered, bounced, reported or answered. If you reply, we keep a working copy of your reply (sender, subject and up to 4,000 characters of text).

Most of this is business data. It is personal data where it identifies a person — for example a sole trader's name, email address, phone number or address, or a business email address that contains someone's name. We do not track whether our email was opened or whether a link in it was clicked.

We use these details to introduce Thmenu to your business once and, if you want it, to set up your menu. The legal basis is our legitimate interest in offering our service to businesses (GDPR Art. 6(1)(f)). We have weighed that interest against yours in a written legitimate interests assessment, which we send on request (contact@synaltix.io).

We write only where the rules allow it, and only in the way they allow — in some countries only to a general business address on your own domain (not to a personal or free mailbox), in some only to a company confirmed in the business register. Where prior consent is required, we do not write at all.

No decision with legal or similarly significant effects is made about you by automated means: a person on our team approves every business before it is saved and every email before it is sent. The facts we gather are put together for that person to check, and that check is deleted after 7 days.

To order our own work, we give each business an explainable priority score made only of business facts: whether you have a website and a menu we could draft, the type of venue, whether card payments through Thmenu are available in your country, the language of our email, the type of address and the stage of our contact. Artificial intelligence (Cloudflare Workers AI) is used only to draft your menu from your public website; the email itself is a fixed text with your business name in it, not written by AI. Our email mentions only how many items our draft has, never the draft itself.

• Cloudflare, Inc. — hosting, our database, and the AI that drafts menus.
• Resend, Inc. — delivers our email; receives the address and the content.
• Google and OpenStreetMap servers — answer our map lookups (the link to resolve, the position to look up).
• Supabase, Inc. — our team's sign-in and the audit log of what our team did; the log holds a reference to your business and the reason, not your name or email address.

We do not sell or rent your details to anyone.

Synaltix LLC is established in the United States. The data is stored and processed in the United States and on Cloudflare's global network.

• A business we never wrote to: deleted 12 months after it was added.
• A business we wrote to: its profile is deleted and the text of our emails is cleared 3 years after the last contact.
• What stays after that, and why: if you object or unsubscribe, your address stays on our suppression list so that we never write to it again; and the address of our first contact stays on record so that our first email remains the only one.
• The record that limits how often we read your website is kept for one day.
• If your business becomes a Thmenu customer, your account is covered by our Privacy Policy instead.

You can object to our email and to any further use of your contact details at any time, free of charge. Every email we send has a link (api.thmenu.com/u/o/…): it opens a confirmation page, and one click stops all contact for good — no login, no preferences to manage. The stop applies to the address in its normalised form (for example, a "+tag" or the dots in a Gmail address do not make it a different address), and our system refuses any new draft or email to it. You can also object by writing to contact@synaltix.io.

You can ask for access to the data we hold about your business, for its correction or erasure, and for its restriction. If you ask us to erase it, we delete your business profile and keep only what we need to honour your objection (the suppression entry). Write to contact@synaltix.io; we answer within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

This part is for food and drink businesses in the United States — restaurants, cafés, bakeries, bars, pubs, food trucks, fast-food and ice-cream shops — that our US campaign found as described in section 13, whether or not we have emailed them yet. The campaign sends each of them at most one promotional email. For them, sections 12 to 18 apply instead of sections 2 to 11; section 1 applies as written.

• OpenStreetMap (© OpenStreetMap contributors, ODbL), through the state files that Geofabrik publishes. We download one state's file at a time, at most once a week, and pick out food and drink businesses on our own computer: name, address, type of venue and website. We do not query OpenStreetMap's own servers.
• Your own website, if OpenStreetMap lists one. We read your robots.txt first and follow it, including any crawl delay. Our requests name themselves thmenu-outreach and carry our contact address. We make at most one request per second, read at most three pages (the page OpenStreetMap lists, then contact or about pages), stop waiting after 8 seconds and read at most 512 KB of a page. If your site asks us to slow down, we wait and come back later. We never get past a login, a CAPTCHA or a block, and we do not use proxies.

We keep an address only if it appears, exactly as written, on a page of your own website, and only if it is on your website's domain or is a free mailbox (such as Gmail) that you list there. We never guess or build an address. We refuse addresses of agencies and website platforms, role addresses (such as noreply, abuse, postmaster, privacy, dpo, legal or security), disposable addresses and disguised ones (such as i_n_f_o@), and we drop an address whose domain does not accept email. We leave out chain restaurants — places that OpenStreetMap tags with a brand, or whose name or website is a large chain's. We do not buy lists and we do not use data brokers.

About your business: name, address, city, state, type of venue, website, the OpenStreetMap identifier of the place and when we found it.
About the address — our record of where we found it: the address; how it appeared (a mailto link, the text of the page, or structured data on the page); the page's web address, title and HTTP status; up to 300 characters of the text around the address; a fingerprint of the page's text (a SHA-256 hash, not the page itself); when we first found it and last checked it; and which of our computers found it. We keep this record so that we can show where an address came from, and, apart from the date we last checked it and the page's HTTP status, we do not change it once it is written.
About our decision: whether a person on our team approved the address for our email or set it aside, and when.
About our email: the address we wrote to, the text we sent and when it was sent, delivered, bounced, reported as spam or answered, and whether and when its "Upload your menu" button was clicked — with a note of whether the click looked like an automatic link scanner rather than a person.

Most of this is business data. It is personal data where it identifies a person — for example an email address that contains someone's name.

We send each address one email, once. Its text is the same for every business apart from two links that are unique to your email (its "Upload your menu" button and the one-click unsubscribe your mail app may show), contains nothing about your business, and was approved by a person on our team before any of it was sent. It shows our logo — one image on thmenu.com, the same for every recipient; we do not use it to tell whether the email was opened, and there is no tracking pixel. Its links go only to Thmenu's own websites. The "Upload your menu" button passes through api.thmenu.com, which notes that it was clicked and when, and then opens our sign-up page; we use this to see whether the email was useful. It says that it is a promotional email, it gives our postal address, and it offers three ways to stop: its "Unsubscribe" button, which opens a page where you type the address that should not hear from us again; the unsubscribe option of your mail app; or a reply saying "stop". Each works at once and does not expire. There is no follow-up email.

We send a limited number of these emails each day, and the whole campaign stops if too many of them bounce or are reported as spam. An address receives the email only if it passes the rules in section 13 and a person on our team has looked at where it was found and approved it. No artificial intelligence is used to find businesses or to choose addresses, and none writes, changes or sends the email for any recipient: everyone receives the same text, approved by a person on our team.

Nothing answers your reply automatically. Our system checks a reply only for whether it asks us to stop, whether it carries a menu, and whether it contains words that may signal a legal or account matter (such a reply is also forwarded to our owner); every reply then goes to our team's work queue. If your reply contains words such as "stop", "unsubscribe", "remove us" or "not interested", our system stops all email to that address at once; other wording is not recognised automatically, and we honour it once our team has read it. If you send your menu, we use it only to set up your menu on Thmenu; we link it to your business only when your provider's checks (DMARC) confirm that it came from the address we wrote to, and otherwise we check with you first.

For each reply we keep a record (whether it asked us to stop, and the names and types of any attachments) and a working copy for our team (sender, subject and up to 4,000 characters of text), which is cleared 180 days after we have dealt with it — unless the reply was forwarded as a possible legal matter, in which case it is kept.

• A business we never wrote to: deleted 12 months after it was added, together with its address and evidence records.
• A business we wrote to: deleted 3 years after the last contact, together with its address, evidence and reply records; the text of our email is cleared, and the record of clicks on its button no longer points to your business.
• What stays after that, and why: if you unsubscribe, reply "stop", report our email as spam, or your mail server permanently rejects it, your address stays on our suppression list so that we never write to it again; and the address of our first email stays on record so that it remains the only one.
• Our server deletes its record of each delivery from our discovery computer after 30 days. On that computer, your business details and addresses are cleared as soon as our server has received them; what remains is the OpenStreetMap identifier of the place and whether we have visited its website, so that we do not visit it again. Its delivery records are deleted after 30 days (90 days if a delivery failed). The OpenStreetMap files we download are public data.
• If your business becomes a Thmenu customer, your account is covered by our Privacy Policy instead.

Our server and database run on Cloudflare, Inc. (in the United States and on its global network); the discovery step runs on a computer operated by our team. Resend, Inc. delivers our email, so it receives the address and the text, and it also receives the replies sent to us. Geofabrik GmbH publishes the OpenStreetMap files; we only download them and send nothing about you. Supabase, Inc. handles our team's sign-in. Anthropic, PBC also processes the replies in our work queue (sender, subject and text), because its AI assistant Claude helps our team handle that queue. A reply forwarded as a possible legal matter also reaches our owner by email and as a phone notification through ntfy.sh. We do not sell or rent your details to anyone.

To stop all email, use the "Unsubscribe" button in our email (or your mail app's unsubscribe option) or reply "stop" — it works at once and for good. An address typed on our unsubscribe page goes on our suppression list even if we have never written to it. You can also write to contact@synaltix.io to ask what we hold about your business, to correct it or to delete it; if you ask us to delete it, we delete your business with its address and evidence records and keep only what stops us from writing to you or adding your business again: your address on our suppression list and one-way fingerprints (hashes) of its identifiers. A reply's working copy is cleared as described in section 16. We answer within one month.