QR Menu Analytics Without Cookies: A GDPR-Friendly Approach

A question restaurant owners ask all the time: “What do customers look at most on my menu, what do they search for, which language do they use?” It's a useful question — and the worry that usually follows is fair too: “Does finding this out mean collecting customer data, cookie banners and GDPR headaches?” The short answer: no, it doesn't have to.

1. Statistics ≠ personal data

The GDPR protects personal data — information relating to an identified or identifiable person. Counts like “how many times was this dish viewed”, “which words were searched” or “which languages were selected” can be kept without knowing who did any of it. As long as no identifier (name, phone, email, account, device ID) is collected or stored, these are anonymous usage statistics — and the GDPR itself states that its principles do not apply to anonymous information.

2. What about the cookie banner?

Cookie consent rules exist because typical analytics tools store identifiers (cookies, local storage IDs, fingerprints) on the visitor's device to recognise them across visits. An analytics design that stores nothing on the device and assigns no identifier has nothing to ask consent for — no banner, no clicked-away popup covering your menu at the exact moment a hungry customer opens it.

3. How analytics works in Servino

• No cookies are used; nothing identifying is stored in the customer's browser
• Collected events (product views, searches, filters, language selection) are never linked to a person
• The IP address is used only as a temporary, in-memory counter key for flood protection — it is never written to the database
• Free-text fields (such as chat messages) are stripped of email/phone/card-like patterns before being stored
• This data is only collected on the Pro and Business plans — on the free plan, the Statistics feature is off entirely

4. What does the restaurant owner see?

In the Statistics tab of the dashboard: the most viewed products, the top search terms, the filters used (vegetarian, gluten-free, etc.), the language breakdown and the daily traffic trend. Each restaurant sees only its OWN data; Business accounts with multiple branches can also compare across branches.

5. The AI waiter follows the same principle

Conversations with the AI waiter are not stored for the purpose of collecting personal data; the customer is never asked for a name, phone number or similar details. Menu data belongs to that restaurant alone — one restaurant's AI waiter has no structural access to another restaurant's menu.

6. Documented transparently

This entire approach is spelled out in the privacy policy that ships with every account — data minimisation isn't a marketing claim here, it's how the system is built.

Note: this article is for general information and is not legal advice. If your business has specific GDPR obligations, consult a qualified professional.