Data Protection (GDPR)

MenuMan ("we", "the platform") acts as the data controller under the EU GDPR, the UK GDPR and Turkey's KVKK (Law 6698).

Contact: [email protected]

We collect only the minimum data required to provide the service:

• Account: name, email, password (bcrypt hash), phone (optional) • Billing: legal name, address, TCKN/VKN/SSN/VAT number (for legally required invoicing only) • Menu content: uploaded menu photos, product names, prices, descriptions • Usage telemetry: sign-in IP, browser, panel actions, AI credit spend • Cookies: strictly necessary (session, language) + analytics/advertising (GA4, Google Ads) with your consent — see §9

TCKN, VKN, SSN and equivalent national identifiers are NEVER written to the database in plaintext.

They are stored one-way hashed with SHA-256 + a server-side secret pepper. Even a full database breach cannot recover (decrypt) these values.

The hash serves a single purpose — deduplication at signup, to prevent a second account with the same identifier. We never display, export or share the raw value. The value you enter on the signup form is passed to our invoicing provider from a short-lived in-memory buffer for that request only and is not persisted on our side.

All data is hosted on enterprise-grade cloud infrastructure with recognized security certifications.

Primary regions are EU (Frankfurt/Amsterdam) and TR (Istanbul edge). Our hosting provider is certified ISO 27001, SOC 2 Type II, GDPR and KVKK compliant.

At-rest AES-256 and in-transit TLS 1.3 encryption apply. Backups are taken daily and purged after 30 days.

Processing is limited to the following purposes:

• Creating and authenticating your account • Publishing your menus, generating QR codes • AI menu enrichment, translation, image generation (only on your request) • Issuing invoices • Security and fraud prevention • Anonymized aggregate reporting

Your menu photos and product text are NOT included in any AI training set.

We don't sell your data. Limited processors:

• Our cloud hosting provider • Our payment providers (card data never touches our servers) • Our AI providers — only for AI requests you initiate, under no-training and no-retention agreements • Our transactional email provider

None of them may use your data for any other purpose.

You may at any time:

• Request access to your data • Ask for corrections • Delete your account and all data • Export your data in a portable format • Object to processing

Send requests to [email protected] — we respond within 30 days.

Data is kept while your account is active. Upon deletion:

• Menu content, images and profile data are permanently deleted within 7 days • Invoice records are retained for 10 years (Turkish Tax Law requirement) • TCKN/VKN hashes are deleted when the account is deleted

We use two types of cookies:

• Strictly necessary (always on): session identifier and language preference. Required for the service to function. • Analytics & advertising (consent-based): Google Analytics 4 and Google Ads cookies for pageview, session, and conversion measurement. Legal basis: consent (UK GDPR and EU GDPR art.6(1)(a), KVKK art.5/1).

You may withdraw consent at any time — the 'Cookie Settings' link at the bottom of the page reopens the banner.

We notify you by email when this policy changes. Questions: [email protected]

Last updated: 2026-07