Privacy Policy
Transparent information about how we collect, use, protect and retain your data.
1. Scope of This Policy
As the 3D QR Menü Development Team ("Development Team"), we respect the privacy of everyone who uses the 3D QR Menü ("Platform") services. This Privacy Policy applies to everyone whose data we process, including business account owners, business staff, customers using the businesses' QR menu, and visitors of our website.
For the detailed inventory of the legal grounds under Turkey's Personal Data Protection Law No. 6698 ("KVKK"), the transfer provisions and the data controller information, please see our KVKK Information Notice (available in Turkish and English). This page explains your data in plain language.
2. Information We Collect
Data varies depending on your role on the Platform. The main data we collect:
Business Account Holders
Full name, business name, email address; with Google sign-in, the name, email and profile photo in your Google account; your password (encrypted one-way by Firebase Authentication, never stored in plain text); invoice name, invoice address, city and phone; subscription, payment and billing records; support requests and communication history.
Business Staff
Full name, role/title and permission role; sign-in PIN code (stored only as a one-way digest, never in plain text); weekly work schedule and overtime records. This data is recorded by your business's manager.
Customers Using the QR Menu
Order information (table, order contents and optional name/note), reservation information (name-surname, phone, number of people, time), scores and reviews, the table a waiter call was made from; also device identifier, session identifier, pages visited, time on site, browser type and IP address for menu statistics, live table tracking and security.
Website Visitors
Name, email and message content shared in the contact and quote forms; hashed IP address to prevent abuse; measurement data via cookies and Google reCAPTCHA verification data.
Google Sign-In (OAuth) and Google User Data
The 3D QR Menü platform offers Google Sign-In (OAuth 2.0) as an option for account creation. When you sign in with your Google account, the following data is obtained from Google and processed:
- Google data collected: Full name, email address and profile photo. Per the Google OAuth scope, we only request access to basic profile information. We never have access to your Google password.
- Purpose of use: This data is used solely to (1) create your account, (2) verify your identity and (3) provide platform services.
- Storage: Your Google profile data is stored in Firebase Authentication (Google Cloud). When you delete your account, this data is permanently deleted as well.
- Sharing: We never sell or share profile data obtained from Google with any third party for marketing purposes.
- Revoking access: You can revoke 3D QR Menü's access from your Google account security settings at any time.
- Google's data processing: Google processes OAuth data under its own Privacy Policy. For Google API data usage terms, see the Google API Service Terms.
- Data deletion: You can request deletion of all data associated with your Google account by emailing [email protected].
3. How We Use Your Information
- Create, verify and secure your account (email verification, password reset),
- Deliver 3D/AR QR menu, order, reservation, table, inventory, campaign and staff services,
- Run subscription, payment and billing processes,
- Handle your support requests and send you notifications,
- Keep the Platform secure and prevent fraud and abuse,
- Measure site traffic and improve the experience (Google Analytics),
- Fulfil our legal obligations.
We never sell your information or transfer it to third parties for marketing purposes. Personalised advertising and marketing communication is only possible with your explicit consent.
4. Information Sharing and Transfer
Your data is shared only with the following parties to deliver the service:
- PayTR (Türkiye): Card verification, payment and refunds. Your card details are never entered into or stored on our servers; they are processed directly by PayTR.
- Google (Firebase, Analytics, AdSense, reCAPTCHA): Platform data is hosted on the Firebase infrastructure; measurement, advertising and verification data may be transferred to Google's servers abroad.
- Hostinger (email): Your email address, for sending verification, password reset and subscription notifications.
- Authorised public institutions: Upon request, as required by law.
Transfers abroad are carried out in line with KVKK Art. 9. For details see our KVKK Information Notice.
5. Cookies
We use three types of cookies on our website and Platform:
- Strictly necessary cookies: Required for session management, authentication and security; if blocked, some parts of the Platform may not work.
- Measurement cookies (Google Analytics): Pages visited, time on site, approximate location (country/city), device and browser information.
- Advertising cookies (Google AdSense): Showing ads relevant to your interests and measuring ad performance.
You can delete or block cookies in your browser settings, or configure them to warn you first. You can manage your Google ad preferences at myadcenter.google.com, and use the browser extension to opt out of Google Analytics. Disabling non-essential cookies does not affect the Platform's core functions.
6. Data Security
- All traffic is encrypted with SSL/TLS.
- Passwords and PIN codes are never stored in plain text; they are protected with one-way hashing.
- Card data is never stored by us; payments are processed via the PCI DSS compliant payment provider PayTR.
- Data access is role-based; staff data is accessible only to people your business has authorised.
- Rate limiting and log records are applied to detect abuse.
Although industry-standard measures are taken, no data transmission over the internet can be guaranteed to be completely secure; we recommend you share your data with care.
7. Retention and Deletion
Your data is retained for as long as necessary to provide the service and limited to legal retention obligations (including the 10-year period of Tax Procedure Law No. 213). When you close your account or your subscription ends, your data — except records subject to legal obligations (invoices, collections) — is deleted or anonymised within a reasonable time. You can send deletion requests to [email protected] or permanently delete your account yourself via Settings → Delete My Account. This permanently removes your business data, all subcollections, all uploaded images and your user account; tax records subject to legal retention and system activity logs are retained.
8. Your Rights
Under KVKK Art. 11, you have the right to learn whether your data is processed, request information if it has been processed, learn the purpose of processing, know the third parties to whom your data is transferred, request the correction of incomplete/incorrect data, request its deletion or destruction, request that these operations be notified to third parties, and request compensation for your damages.
If you send your requests to [email protected], your application is answered free of charge within thirty days at the latest. For the full list of rights, see the KVKK Information Notice.
9. Children's Privacy
The Platform does not knowingly collect personal data from anyone under 18, and you must be at least 18 to open a Platform account. For child customers who use your business's QR menu together with their families, the data controller is the business offering that QR menu; the Development Team merely hosts this data in the capacity of data processor.
10. Policy Changes
This Privacy Policy may be updated from time to time. The updated text takes effect as soon as it is published on this page, and the "Last Updated" date shown on the page indicates the current version. For significant changes, we will try to inform you via email or an in-Platform notice.