Privacy Policy

This policy explains how personal data is processed when you use QR Menu Link (qrmenulink.net), a digital QR menu platform. It is written to meet the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, for users in the EU/EEA, the General Data Protection Regulation (“GDPR”).

1. Who is responsible

QR Menu Link is operated by Mehmet Akbulut, Istanbul, Türkiye (“we”, “us”), who acts as the data controller. Contact: info@qrmenulink.net

Note for restaurant guests: when you view a restaurant's menu, call a waiter or leave feedback, the data is processed on behalf of that restaurant, which is also responsible for it. You can contact the restaurant directly about such data as well.

2. What data we process

a) Restaurant owners and staff (panel users)

• Account data: name, email address, password (stored only as a one-way hash), interface language.
• Sign in with Google: if you use “Continue with Google”, the name, email address and Google account ID Google shares with us. We never see your Google password.
• Business details: restaurant name, address, city, country, phone, contact email, logo, social media links.
• Content: menus, items, prices, descriptions, photos you upload and translations.
• Subscription and payment: plan, billing currency, payment amounts, transfer reference, receipts you upload and invoices. We do not collect card details.
• Support: support tickets, emails and live chat conversations.
• Security logs: sign-ins and sign-outs, IP address, browser details and an audit trail of changes made in the panel.
• Notifications: if you allow browser or mobile app notifications, the device/subscription identifier needed to deliver them.

b) Restaurant guests (people viewing a menu)

• QR scan records: time of scan, IP address, country estimated from the IP, browser/device details and referrer. These are used to give the restaurant visit statistics.
• Usage statistics: which menus and items were viewed and the device type. These are not linked to your identity.
• Service calls: for waiter, bill or valet calls, the table, your optional note and your IP address.
• Feedback: your rating and comment, plus the name and email if you choose to give them.

c) Website visitors

• Visit logs: page visited, time, IP address, estimated country, browser details and referrer. These are used to separate bot traffic and improve the site.
• Cookies and similar technologies: see section 7.

3. Why we process it (legal bases)

We do not sell or rent your data, and we do not share it with third parties for their own advertising.

4. Who we share it with (including transfers abroad)

We use the service providers below. They process data only on our behalf and only as needed to provide their service:

When you use an AI feature, only the menu text or photo you ask us to process is sent to the provider. We recommend not including personal data in that content.

Some providers are located outside Türkiye and the EU, so your data may be transferred internationally. We do this only as needed to provide the service, relying on appropriate safeguards such as standard contractual clauses and, where required, your consent. We may disclose information to public authorities where legally required.

5. How long we keep it

• Account, business and menu data: for as long as your account is open. When you ask us to delete your account, it is deleted or anonymised within 30 days.
• Accounts whose subscription has ended: your menus go offline after a 7-day grace period, but your data is kept so you can resume your subscription, until you ask us to delete it.
• Payment, receipt and invoice records: for the period required by tax law (generally 10 years in Türkiye).
• Scan and usage statistics: for as long as the restaurant's account is open, so the restaurant can see historical statistics.
• Website visit, security and audit logs: for as long as needed for security and legal obligations.
• Backups: kept for a limited time and regularly rotated out.

6. Security

All connections use HTTPS. Passwords are stored as one-way hashes. Server access is limited to authorised people, sign-in attempts are rate-limited and regular backups are taken. No system is 100% secure. If a data breach occurs, we will notify the competent authority and affected people as required by law.

7. Cookies and local storage

• Strictly necessary: session and security (CSRF) cookies. In the panel, your session token and language preference are kept in your browser's local storage. The site and panel do not work without these.
• Analytics: Google Analytics cookies (e.g. _ga), used to measure in aggregate how the website and digital menus are used.
• Ad measurement: Google Ads cookies, used to measure whether our ads lead to sign-ups.
• Live support: Tawk.to cookies, used to keep your chat history across pages.

You can delete or block cookies in your browser settings. You can also opt out of Google Analytics with Google's browser add-on. If you block strictly necessary cookies, the panel may not work.

8. Your rights

Depending on where you live, you have the right to:

• access your data and get a copy of it,
• have inaccurate data corrected,
• have your data deleted,
• restrict or object to processing, including processing based on legitimate interests,
• data portability,
• withdraw consent at any time where processing is based on consent,
• object to decisions made solely by automated processing,
• lodge a complaint with a supervisory authority: in Türkiye the Personal Data Protection Authority (KVKK), in the EU/EEA your local data protection authority.

To exercise your rights, email info@qrmenulink.net from your registered address. We respond free of charge within 30 days. You can also update your account details yourself in the panel.

9. Children

The panel is designed for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

10. Mobile apps

For details specific to the QRMenuLink.net Staff apps for iOS and Android, see the app privacy policy.

11. Changes

We may update this policy from time to time. The current version is always published on this page, and the “Last updated” date at the top changes accordingly. We notify registered users of significant changes by email.

12. Contact

For any privacy question or request: info@qrmenulink.net · Istanbul, Türkiye