Privacy

Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains, under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), how personal data is processed when you use the QR menu, ordering, reservation, waiter, kitchen, cashier, hotel room service and pastry production-and-order platform ("Platform") and the promotional website provided by MenuRobo ("MenuRobo", "we").

1. Our roles: data controller and data processor

MenuRobo is the data controller for business accounts and website visitors. We process the data of restaurant, café, hotel and pastry shop owners using the Platform, panel users and visitors to our website for our own purposes.
The business is the data controller for its guests, customers and staff. Data of guests who use the QR menu, place orders or make reservations; customers ordering from a pastry shop; customers for whom the business opens an on-account (tab) record; and staff such as waiters, cashiers, chefs and couriers is processed on behalf of and on the instructions of that business. For this data MenuRobo acts as a data processor; our relationship is governed by the Data Processing Agreement concluded with the business. For requests about this data, please contact the relevant business first.

2. What data do we process?

Business account holders and panel users

Identity and contact: full name, company name, username, email address, phone, business address.
Account security: password stored in non-reversible form; two-factor authentication (app, email or SMS code) data; PIN codes of staff screens (as a non-reversible hash).
Transaction security and access logs: IP address, browser and date-time at login; successful/failed login and PIN attempts; a log of actions taken in the panel.
Consent records: dates on which the terms of use, KVKK notice, Data Processing Agreement, explicit consent and (optional) commercial communication consent were accepted.
Plan and payment: selected plan, add-on modules (Cashier Module, Owner Screen, extra branch, etc.), start and end dates, extra branch requests, bank transfer order and payment records (plan, amount, date, payment reference). Plan payments are accepted by bank transfer only; the Platform does not collect or store card details. Official invoices are issued outside the Platform.
Business content: menu, product, price, photo, table/room, branch and staff information you enter in the panel.
Integration settings: the business's own email server (SMTP) details, POS device settings, API keys and notification (webhook) addresses. Passwords and secret keys are stored encrypted with AES-256; only a non-reversible hash of API keys is kept.

Visitors to our website

Contact form: full name, email address, (optional) phone, subject and your message.
Visit statistics: page visited, date-time, IP address, browser, operating system and device type, language and referring site. Unique visitors are counted with a daily-changing, non-reversible hash; these records are not used for advertising or profiling.
Site assistant (Digi): questions you type to Digi are matched against ready answers on our server; they are not stored and are not sent to any external AI service.
Google Analytics: runs only if you allow performance cookies in the cookie notice.

Guests of businesses (QR menu and hotel)

Order data: order contents, table or room number, note, payment method, amount, discount, tip and order status. Guests are not asked for their name in QR menu and hotel orders; orders are placed with the table or room number. If "charge to my room" is chosen, the reception approval is recorded.
Reservation data: full name, phone, email, party size, date-time, note, preferred language and the date of KVKK acknowledgement; email verification, approval, rejection, cancellation and arrived/no-show records.
Reviews: ratings given by the guest and IP address.
Location check: if the business has enabled the location check, your location at the time of ordering is used only to calculate your distance to the business instantly; it is not recorded or stored.
Device recognition cookie: to prevent abuse, a random device code that does not identify you is placed in your browser. If a waiter marks an order as "reject and block", that device cannot order from that business for 24 hours.
Table session: after scanning the table QR code the session is valid for 30 minutes; once the bill is closed, the QR must be scanned again for a new order.
IP address and browser information during ordering, reservation, waiter calls and reviews (to prevent abuse).
Menu assistant: questions are matched on the Platform's own server against the business's menu and FAQs; they are not sent to any external AI service.

Guests do not need to register to use the menu. Guests' card details are not collected by the Platform; card payments are made on the business's own POS device.

On-account (tab) customers

If the business opens an on-account record at the cashier: the customer's name, phone and note if any; amounts charged, collections and the name of the cashier who performed the transaction. Only the relevant business can see these records.

Pastry shop customers (on behalf of the pastry shop, only if the business uses the pastry system)

Full name, phone, email and (for home delivery) address and directions; selected product, cake inscription and design preferences; delivery date and time; (if added) image; order note; time of KVKK acknowledgement and explicit consent; WhatsApp notification preference; name of the staff member who took the order and a non-reversible hash of the IP address.
Allergy/sensitivity information is health data; it is processed only with the customer's explicit consent and only for preparing the cake.
Email verification: if enabled by the pastry shop, a one-time 6-digit code is sent from the pastry shop's own email account to confirm the order was placed by the customer; the code is valid for 10 minutes and kept only temporarily as an encrypted hash, and the verification time is saved with the order.
Also: delivery photo and delivery problem notes, response to a delay notice, cancellation request and reason, log of changes made to the order, record of uncollected orders, deposit refund outcome, storage consent and withdrawal time, satisfaction survey answers and complaint records.
If the customer orders more than one product, contact details are kept in the server session for at most 60 minutes. Authorised staff can see previous orders placed with the same phone number and download the order list as Excel.
Address, email, notes, allergy information, complaint descriptions and uploaded images are stored encrypted with AES-256; on printed slips and lists the customer's name is masked and only the last 2 digits of the phone are shown. Payment for cake orders is not taken through the Platform; any deposit is taken at the pastry shop's own till.

Business staff (on behalf of the business)

Name of the waiter, cashier, chef, courier, goods receiving staff and food engineer, (if WhatsApp notifications are on) the waiter's phone, PIN code stored as a non-reversible hash and a log of their actions; performance reports generated from these; if enabled by the pastry shop, the courier's live location only during delivery; staff training and health certificates within the scope of food safety.

3. Purposes and legal bases

Opening the account, providing the Platform, managing plans and add-on modules — establishment and performance of a contract (KVKK Art. 5/2-c).
Forwarding orders to the waiter, kitchen and cashier, closing bills, order tracking, receipts, Z reports and reports; receiving, producing and delivering cake orders — performance of a contract.
Receiving reservations, verifying them by email and notifying the result — establishment and performance of a contract.
Keeping access logs; retaining payment records — legal obligation (KVKK Art. 5/2-ç), Law No. 5651, tax and commercial legislation.
Account and system security, prevention of fraud and abuse (table QR verification, location check, device block, email verification, blocking attacks) — legitimate interest (KVKK Art. 5/2-f).
Processing allergy information at the pastry shop — the customer's explicit consent (KVKK Art. 6). Staff food safety certificates — obligation arising from food legislation.
Website visit statistics, contact and support requests, improving the service — legitimate interest. Google Analytics and campaign announcements — only with your explicit consent (KVKK Art. 5/1).

4. Recipients of data

Your data is not sold and is not shared with third parties for advertising. It may be transferred only to the extent necessary to provide the service to:

Infrastructure providers: hosting (cloud server), domain/DNS, content delivery and security (Cloudflare) and email delivery services. Emails to the business's guests and customers (reservations, cake order notifications, verification codes) are sent from the business's own email (SMTP) account.
Banks: to receive plan payments made by bank transfer.
The business's POS device and its own software (API): only if the business has enabled these optional integrations; the business decides the recipient and purpose.
Messaging services: if enabled by the business, "order ready" notifications to the waiter's phone and cake order status to the customer's phone via WhatsApp; if phone verification is on, the SMS code via the SMS provider.
AI image service: if the business chooses to generate a product image with AI, only the product name and description are sent; no personal data is sent.
Analytics service: Google Analytics only if you allowed performance cookies.
Authorised public authorities: when legally required.

Some of these providers may have servers abroad; such transfers are made in accordance with Article 9 of the KVKK.

5. Retention periods

Closing an account: you can close your account from the Profile page in the panel. Login and QR menus are disabled immediately; after 30 days the account and business data (restaurants, menus, images, orders, reservations, cashier, on-account and pastry records and files) are permanently deleted. You can have your account reopened within this period. Before closing, you can download your orders, reservations, on-account, pastry orders and payment records from the same page.
Inactive accounts: if an account is unused 60 days after the plan expires, you are warned by email; if it is still not renewed 30 days after the warning, it is deleted in the same way.
Payment records: plan and extra branch payment records (name, company, email, phone, plan, amount, date, payment reference) are kept for 10 years under tax and commercial legislation even if the account is deleted, accessible only to authorised administrators, and anonymised at the end of the period.
QR menu and hotel: IP address and browser information in orders, waiter calls and reviews, the order note and the customer name in takeaway orders are deleted within the period set in the business's plan (30, 90 or 180 days; default 90 days); name, phone, email and note in reservations are deleted within the same period after the reservation date. Content that does not identify a person (product, amount, date, table) remains for the life of the business account.
On-account: kept while a balance is outstanding; after the balance is closed, deleted if there is no activity for the period in the plan (1, 2 or 3 years; default 3 years).
Pastry shop: images uploaded by the customer are deleted within the period chosen by the pastry shop after the order is closed (7–90 days, default 30 days). The customer's name, phone, email, address, notes and allergy information are permanently anonymised — without storage consent, within the period in the plan after the order is completed (delivered, rejected or cancelled) (48 hours, 7 days or 30 days; default 7 days); with consent, if no new order is placed within the period in the plan after the last order (1–3 years; default 3 years). For an order subject to an open complaint, this is postponed until the complaint is closed.
Login, security and panel action logs are kept for 2 years (Law No. 5651); menu view statistics and waiter calls for 13 months; website visit statistics for 1 year.
Location is not stored. Device blocks last 24 hours and table sessions 30 minutes; IP addresses blocked for security are released automatically after 1 hour. Reservation requests not verified by email expire after 24 hours.
A record of deletions containing no personal data and (if given) the commercial communication consent record are kept for 3 years. Deleted data may remain in server backups until the backup retention period (at most 7 days) expires; it is not restored from backups. Expired data is automatically deleted, destroyed or anonymised.

6. Security

Connections are protected with HTTPS and HSTS; the site runs behind the Cloudflare security network and uses a security shield (WAF) that automatically blocks attacks. Passwords are stored in non-reversible form; secret settings, email passwords and pastry customer data are encrypted with AES-256; staff PINs and IP addresses are kept as non-reversible hashes. Two-factor authentication is supported and mandatory for pastry shop administrators. Staff screens open with a separate secret link and PIN; repeated wrong attempts are temporarily blocked; the open screen of a deactivated staff member is also closed. Table QR codes are table-specific and signed.

7. Cookies

Essential cookies are used to maintain the session, remember your language, the table session and for security (including the device recognition code). Performance and analytics cookies (including Google Analytics) run only if you allow them in the cookie notice; you can change your choice at any time via the "Manage cookie preferences" link. Website visit statistics do not use cookies.

8. Your rights

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, request information if it is, learn the purpose of processing and whether it is used accordingly, know the third parties to whom it is transferred, request correction if it is incomplete or inaccurate, request deletion or destruction when the conditions are met, request that these actions be notified to third parties to whom the data was transferred, object to a result against you arising exclusively from automated analysis, and claim compensation for damage caused by unlawful processing. Requests are concluded free of charge within 30 days at the latest. For data processed on behalf of a business, please contact that business first.

9. Contact

Email: [email protected]
Phone: +90 224 483 6 436
Address: Üçevler, İzmir Yolu Cd NO: 241 Westpoint

10. Changes

This policy may be updated when necessary. The current text is always published on this page; significant changes are also announced in the panel.