Privacy Policy

In short

• You do not need an account to see the menu or place an order.
• No location, analytics, advertising or tracking. We do not sell your personal data.
• The camera is used only to scan QR codes; images are neither recorded nor sent.
• You can delete your account at any time from the app or on the Delete account page.

Controller and contact

This app and website are operated by Menuvento. For all requests about your personal data: destek@menuvento.online.

What data we collect

We only process data that is needed to provide the service.

• Account data: your name, email address and password (the password is stored only in one-way hashed form), and your language preference. Collected only if you create an account.
• Order data: ordered products and options, amount, your note, table code or pick-up choice, order status and time. Entering a name is optional when ordering as a guest. Orders placed with an account are linked to it; guest orders can only be viewed with your order tracking code.
• Loyalty data: your digital card per business, your stamp and points activity, your level and the rewards you redeemed. A card is created only when you sign in and get one.
• Business and staff accounts: name, email, role and linked business; business, menu and table details entered by the owner.
• Technical data: in server logs, the IP address, request time and browser or app type, for security, rate limiting and troubleshooting. An access token is issued to your device for your session.
• Stored on your device: your language preference and, in the QR web menu, your cart and order tracking information may be kept locally in your browser. We do not use cookies for these.

What we do not collect

• Location data (location permission is not requested).
• Analytics, advertising, behavioral tracking or third-party tracker data.
• Payment card and bank details (there is no online payment).
• Contacts, photo library or microphone access.
• Push notification identifiers (there are no notifications in this version) and social sign-in data.

Camera permission

The app uses the camera only to scan a table or loyalty card QR code. The image is processed on your device in real time; it is not recorded, stored or sent to a server. You can turn the permission off in your device settings at any time; you can still use the whole flow by choosing a business from the list.

Purposes and legal bases

• Passing your order to the business, showing its status and managing your account: establishing and performing a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
• Running loyalty card, stamp, points and level operations: performing a contract (KVKK art. 5/2-c; GDPR art. 6(1)(b)).
• Ensuring security, preventing abuse and fixing faults: legitimate interests (KVKK art. 5/2-f; GDPR art. 6(1)(f)).
• Meeting obligations under law: legal obligation (KVKK art. 5/2-ç; GDPR art. 6(1)(c)).
• Answering your request when you write to support: legitimate interests and performing a contract.

Who we share data with

We do not sell your personal data and do not share it for advertising. We pass it only to the following, to the extent needed:

• The business you ordered from or got a card at: order contents, your note, table information, your name if given, and your loyalty activity. Businesses see their own customers' data only for their own business; they cannot access other businesses' data.
• Infrastructure providers: server hosting (DigitalOcean) and email delivery (transactional emails such as password reset). They process data only on our behalf and under our instructions.
• Authorities: only when legally required.

International transfers

Our hosting provider's servers may be outside Turkey. In that case transfers are made with the safeguards under KVKK art. 9 and GDPR Chapter V (for example, standard contractual clauses).

Retention

• Account data, your loyalty cards and sessions: until you delete your account. If you delete your account, this data is deleted.
• Orders: when your account is deleted, the personal link (account, name, note) is removed and the orders stay in the business's records anonymously. The optional name on a guest order is part of an order handled this way.
• Server logs (including IP addresses): at most 30 days.
• Backups: database backups are kept for 7 days and then deleted automatically; deleted data also leaves the backups within that time.
• Emails you send to support: at most 1 year after the request is closed.

Your rights

Under KVKK art. 11 and GDPR arts. 15-22 you have the right to:

• Learn whether your data is processed and get a copy of it,
• Ask for incorrect or incomplete data to be corrected,
• Ask for your data to be deleted or destroyed (right to erasure),
• Object to processing and ask for it to be restricted,
• Receive your data in a structured, commonly used format (portability),
• Learn the third parties your data was transferred to,
• Lodge a complaint with the Turkish Personal Data Protection Authority or the data protection authority of your country if you think your rights were violated.

You can delete your account yourself from the app or on the Delete account page. For other requests write to destek@menuvento.online; we answer within 30 days at the latest.

Security

All communication is encrypted with HTTPS. Passwords are stored hashed. Each business's data is isolated, permissions are checked on the server, and rate limits apply to sign-in and ordering endpoints. No system is perfectly secure, but we take technical and organizational measures appropriate to the risk.

Children

Menuvento is not directed at children. You must be at least 16 to create an account; viewing the menu and ordering as a guest need no account. The app's content is suitable for all ages (4+): it has no violence, gambling, age-restricted products, or messaging and comments between users. If you notice a child has given us data, tell us at destek@menuvento.online and we will delete it.

Cookies and local storage

The menuvento.online website does not use cookies and has no tracking tools. Your language preference is kept in your browser's local storage, only to open pages in the language you chose.

Changes

If we update this policy we publish the new version on this page and change its date. We also announce important changes in the app or by email.