Provider policies name the data
A QR-menu provider privacy policy says its service collects usage data such as IP address, browser type, and interaction logs, and uses cookies. That directly supports the idea that scanning a menu can be more than pass