Last updated: 22 August 2026
UpFront Menus is operated by RiskActiv, LLC, a limited liability company registered in the State of NH, United States (“we”, “us”, “our”). RiskActiv, LLC is the data controller for personal information processed through upfrontmenus.com (the “Service”).
Contact: privacy@upfrontmenus.com
This policy applies to everyone who uses upfrontmenus.com, whether or not you create an account. If you are located in the United Kingdom or the European Economic Area, Section 10 sets out additional rights that apply to you.
Age restriction. The Service is not intended for anyone under 16. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us with personal information, contact us at privacy@upfrontmenus.com and we will delete it.
To create an account we ask for your first name, your last name and your email address. Nothing else is required to register or to use the Service. We do not ask for your date of birth, postal address, phone number, payment details, government identifiers, or any special category information such as health, religion or ethnicity.
You also choose a username, which is displayed publicly in place of your name.
The following are optional. You decide whether to provide them and you can remove them at any time.
Profile. An avatar — either one of our preset images or a photograph you upload — and a short bio.
Menu and lounge contributions. Photographs of menus and dishes, along with the flight number, date, cabin class, seat number and any other detail you supply.
Ratings and reviews. Your ratings of dishes and menus and any written review text.
Flight log entries. Flight numbers, dates, cabin classes, seat numbers and aircraft types you record.
Correspondence. Anything you send us by email.
Although we ask for very little, some of what you contribute is more revealing than it may appear:
Usage and device data. Our analytics provider collects information about how the Service is used — pages visited, approximate location derived from IP address, device and browser type, and referring site.
Authentication cookies. Cookies strictly necessary to keep you signed in and to maintain your session. We do not use advertising or cross-site tracking cookies.
Flight data enrichment. When you record a flight, we send the flight number and date to a third-party aviation data provider, which returns the airline, origin, destination, aircraft type and route distance. We do not send your identity to this provider.
Flighty import. If you import data from your Flighty account, we receive flight history and upcoming flight information from that service. Flighty import is not required to use the service, and you can delete imported flights individually.
Please read this section carefully.
Photographs you upload may contain personal information beyond the menu itself — your name or booking reference on a boarding pass, your seat number, your handwriting, reflections, or other passengers and crew visible in the background.
Before uploading, please review your photographs and obscure or crop anything you do not wish to be public. Photographs attached to published menus are visible to anyone who visits the Service, including people without an account, and may be indexed by search engines.
If you upload a photograph containing another identifiable person, you are responsible for having an appropriate basis to do so. If you are depicted in a photograph uploaded by someone else and wish it removed, contact us at the provided email address.
We use an automated content moderation service to screen uploaded images and text for prohibited content. We may also remove content following a report from another user.
| Purpose | Lawful basis (UK/EU users) |
|---|---|
| Creating and administering your account | Performance of a contract |
| Displaying menus, ratings and reviews you contribute | Performance of a contract |
| Extracting structured menu data from photographs you upload | Performance of a contract |
| Enriching flight entries with airline and route data | Performance of a contract |
| Operating the gamification features (XP, badges, levels, leaderboards) | Performance of a contract |
| Understanding how the Service is used and improving it | Legitimate interests |
| Moderating content and preventing abuse | Legitimate interests |
| Responding to your enquiries | Legitimate interests |
| Complying with legal obligations | Legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. You may object to processing based on legitimate interests — see Section 10.
Public by default:
Never shown publicly:
Private by default:
You can set your profile to private in your settings, which hides it from other members. Note that content you have already published remains associated with your username.
Deletion and residual copies. When you delete content, we remove it from the Service. Copies may persist for a limited period in backups, and we cannot recall content that others have already downloaded, screenshotted or that search engines have cached.
We do not sell your personal information. We do not display advertising and we do not share your information with advertisers.
We use the following service providers, who process personal information on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Clerk | Authentication and account management | United States |
| Convex | Database and file storage | United States |
| Vercel | Website hosting, delivery and usage analytics | United States |
| OpenAI | Extracting menu text from uploaded photographs; content moderation | United States |
| API.market | Flight and route data lookup (data sourced from AeroDataBox) | United States |
| Flighty | Flight history import, if you use it | United States |
We may also disclose information where required by law, to enforce our terms, or in connection with a sale or reorganisation of the business.
We are based in the United States and most of our service providers are located there. If you are in the United Kingdom or the European Economic Area, your personal information will be transferred outside your country.
Where we transfer personal information out of the UK or EEA, we rely on the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, as applicable, together with the transfer terms in our agreements with each provider.
| Data | Retention |
|---|---|
| Account and profile data | Until you delete your account |
| Published menus, photographs, ratings and reviews | Until you delete them, or until account deletion |
| Flight log entries | Until you delete them, or until account deletion |
| Analytics data | 14–26 months |
| Moderation records | 12 months after the decision, to handle appeals and repeat abuse |
| Correspondence | 24 months |
On account deletion we remove your personal information. We may retain contributed menu data in de-identified form — with your username and account association removed — because it forms part of the shared community record.
We use HTTPS throughout, delegate password handling entirely to our authentication provider (we never see or store your password), and restrict administrative access.
No online service is completely secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant supervisory authority where the law requires it.
You have the right to: access your personal information; have inaccurate information corrected; have your information erased; restrict processing; object to processing based on legitimate interests; receive your information in a portable format; and withdraw consent where we rely on it.
You can exercise most of these directly in your account settings. For anything else, contact us. We will respond within one month.
You also have the right to complain to your data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk).
Article 27 representative. In our current testing phase, we do not yet have one but we are investigating options to appoint a UK/EU representative.
Subject to the thresholds in the CCPA/CPRA, California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion or correction, and are entitled not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.
Regardless of where you live, you can access, correct and delete your content and close your account at any time, or contact us by email.
We will post any changes on this page and update the date at the top. If the changes are significant, we will notify account holders directly.
RiskActiv, LLC
State of NH, United States
privacy@upfrontmenus.com