Privacy Policy (GDPR and KVKK)
Who is responsible
For the account, billing and website data of venue owners and staff, and for guest accounts, the controller is the QRder team. For the order data of a venue's guests (what was ordered at which table), the venue is the controller and QRder acts as its processor; see the Data Processing Terms. This text is also the information notice required by the Turkish Personal Data Protection Law (KVKK, Law no. 6698).
Data we process
Account: e-mail address, password (stored only as a hash), sign-in with Google, name, avatar. Profile (optional): full name, phone, country, birthday as month and day only. Guests who do not sign in get an anonymous account with no personal details. Orders: items, table, notes, status, optional name and phone. Loyalty: stamps, rewards, surprise-box visits, mayor and quest scores, favourites, preferred language. Device: push notification subscription if you allow it, cookies and local storage (see Cookie Policy), IP address for security checks. Staff: name, role, invitation e-mail, waiter PIN. Venue billing: company or person name, address, e-mail, phone, tax or identity number. Card data is never stored by QRder; it is handled directly by iyzico. Names, phones, e-mails and identity numbers are encrypted in our database.
Why we use it and on what basis
To run the service, deliver orders and keep accounts (performance of a contract). To invoice and keep records (legal obligation). To prevent abuse, secure the platform and run a human check (legitimate interest). To send order updates and notifications you asked for (contract, or consent where required, which you can withdraw). To run loyalty features and the birthday surprise (contract, and consent for the optional birthday and country). In Turkish law terms these correspond to the grounds in KVKK articles 5 and 6.
Who receives data
Only service providers we need: Supabase (database, sign-in, file storage), Vercel (hosting), iyzico (subscription payments), Resend or an SMTP mail service such as Gmail (e-mail), the browser push services of Apple, Google or Mozilla (notifications), Cloudflare (Turnstile human check), Google (Google sign-in, Places data, Cloud Translation and Gemini for menu text, and Business Profile if a venue connects it) and Microsoft Azure (menu text translation, if enabled). Menu names and descriptions written by venues are sent to the translation provider; guest data is not. The venue sees its own guests' orders and, for loyalty, the member data it needs. Authorities receive data only when the law requires it. We do not sell personal data and we do not use it for advertising.
Transfers abroad
Some providers process data outside Türkiye and outside the European Economic Area. You can ask us for details.
How long we keep it
Customer accounts with no activity for 90 days are deleted automatically. About 14 days before, we send one warning (by e-mail, and by push if enabled); signing in once keeps the account. Anonymous guest accounts are removed after 30 days of inactivity. When an account is deleted, orders and bills at venues are kept for the venues' accounting but anonymized (no account link, no name, no e-mail, no pickup name or phone); everything else about the person is deleted, such as the profile, push subscriptions, favorites, loyalty, stamps and rewards, and visit scans. When a venue is deleted, its orders, bills and reports are deleted with it, and staff accounts that work only at that venue are removed. After an owner leaves, subscription payment records (amount, date, method, provider reference) and the organization's company and tax fields are kept for accounting and legal obligations; personal billing fields are removed. Contact form requests are deleted after 90 days. Order status history and finished service requests are deleted after 90 days. The order verification code is valid for 60 minutes. Security counters are kept for about one day. Some data may remain at third-party processors (for example the payment provider's own customer record) under their policies.
Security
We use encryption in transit, encryption of sensitive fields, access rules per venue, login and PIN attempt limits and a human check against automated abuse. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.
Your rights
Under KVKK article 11 and the GDPR you can ask whether we process your data, get a copy, have it corrected or deleted, restrict or object to processing, withdraw consent, and move your data to another service. Customers can delete their own account in the app (Account > Profile > Delete my account); venue owners delete their venues in Settings > Delete venue and then their account. For other requests write to the contact address shown on the QRder website; we answer within 30 days. For guest order data you can also contact the venue.
Complaints
You may complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or to the data protection authority in your country of residence if you think we have not respected your rights.
Children
The service is not meant for children without a parent or guardian. Do not create an account for a child.
Changes
We will update this policy when the service or the law changes.