Privacy Policy & Data Protection Notice

1. Identity of the Data Controller

Pursuant to Article 10 of the KVKK and Article 13 of the GDPR, the identity of the data controller is as follows:

2. Definitions and Our Roles

The Service is a Software-as-a-Service (SaaS) platform that provides digital menus and restaurant operations tools to restaurant and café businesses (“Subscribers”).

For Subscriber data

With respect to account, billing and usage data of our Subscribers and their authorized users/staff, we act as the data controller under the KVKK and the GDPR.

For Guest (end-user) data

With respect to restaurant guests who view a Subscriber’s QR menu and any data entered by the Subscriber into its own workspace, the Subscriber is the data controller; we process such data solely to provide the Service to the Subscriber and on its instructions, acting as a data processor.

3. Categories of Personal Data We Process

Depending on who you are and how you use the Service, we may process the following categories of personal data:

4. How We Collect Personal Data

We collect your personal data through registration, profile, billing, delivery, personalization and payment forms; automatically while you use the Service; through shipment/delivery processes; and through your communications with us via email or support channels — by partly automated or automated means.

5. Purposes of Processing

We process your personal data for the following purposes:

• Creating accounts, authenticating you and managing sessions;
• Providing, operating and improving the Service and its features (digital menu, ordering, terminals, inventory, reporting, etc.);
• Managing subscriptions, pricing, invoicing and payment transactions;
• Preparing, personalizing, shipping and delivering physical orders, and managing returns and after-sales support;
• Creating, verifying, changing and revoking automatic-payment instructions, and verifying transaction/consent records in payment-dispute or chargeback proceedings;
• Concluding and performing the contract, and managing customer relations and support;
• Ensuring the security of the Service, preventing fraud/abuse and protecting our systems;
• Complying with legal obligations (tax, accounting, commercial law);
• Establishing, exercising and defending legal rights and interests;
• Where you have given consent, marketing/information communications and statistical analysis.

6. Legal Bases for Processing

Your data is processed on one or more of the following legal bases under Articles 5 and 6 of the KVKK and Article 6 of the GDPR:

• Processing necessary for the conclusion or performance of a contract (membership and subscription agreement);
• Compliance with a legal obligation of the data controller (tax/accounting);
• The legitimate interests of the data controller, provided your fundamental rights are not overridden (security, fraud prevention, improving the Service);
• Necessity for the establishment, exercise or defence of a legal right;
• Express provision in applicable law;
• Where none of the above applies, your explicit consent (e.g. marketing messages, optional card storage).

7. Disclosure and Transfer of Personal Data

Your personal data may be shared, on a limited basis and under confidentiality obligations, with the following categories of recipients in order to achieve the purposes set out above:

We do not sell or rent your personal data to third parties for commercial purposes.

8. International Transfers

Some of the service providers listed above (e.g. Google, MongoDB Atlas, Cloudflare) may host data outside Turkey. In such cases your personal data may be transferred abroad in accordance with the conditions set out in Article 9 of the KVKK (your explicit consent or other statutory conditions and appropriate safeguards) and, under the GDPR, using appropriate transfer mechanisms (e.g. Standard Contractual Clauses).

9. Retention Period

Your personal data is retained for as long as required by the purposes of processing and, in any case, throughout the limitation and retention periods prescribed by applicable law (e.g. statutory periods for tax and commercial records). Once these periods expire, your data is deleted, destroyed or anonymised. When you close your account, your data is deleted or anonymised within a reasonable period, except for data subject to statutory retention obligations.

Account access history — including IP address, approximate country, Cloudflare Ray ID, user agent, hashed device/session identifiers and related risk flags — is retained for two (2) years for security, fraud prevention and payment-dispute evidence. Financial records, payment transactions and automatic-payment approval/revocation evidence may be retained for longer periods required by tax, commercial, payment and limitation-period laws.

10. Data Security

We implement appropriate technical and organisational measures to prevent unlawful processing of and access to your personal data and to ensure its safekeeping. Passwords are stored in irreversibly hashed form, communications are encrypted with TLS, payment card data is not stored by us, and access is restricted on a role-based basis. Please note that no method of transmission or storage is 100% secure.

11. Cookies

The Service uses strictly necessary cookies to maintain your session and provide core functionality. For details on our use of cookies, please see our Cookie Policy.

12. Your Rights as a Data Subject

Under Article 11 of the KVKK, by applying to the data controller you have the right to:

• Learn whether your personal data is being processed;
• Request information if it has been processed;
• Learn the purpose of processing and whether the data is used accordingly;
• Know the third parties to whom data is transferred domestically or abroad;
• Request correction of incomplete or inaccurate data;
• Request deletion or destruction of data under the conditions set out in the KVKK;
• Request that correction/deletion be notified to third parties to whom data was transferred;
• Object to a result against you arising from analysis solely by automated systems;
• Claim compensation for damage arising from unlawful processing.

Data subjects in the EU additionally have the rights under the GDPR to access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability and objection to processing, and the right to lodge a complaint with a supervisory authority.

13. How to Exercise Your Rights

To exercise the rights above, you may submit your requests by email to [email protected] or in writing to our postal address stated above. Requests are concluded as soon as possible and within thirty (30) days at the latest, depending on their nature. Your application must include information establishing your identity.

14. Changes

This Privacy Policy may be updated from time to time. The current version takes effect on the date it is published on this page. We will inform you of material changes by appropriate means. The “last updated” date at the top of the page indicates the version in force.

15. Contact

For any questions or requests regarding our privacy practices, you can reach us at [email protected].