Privacy Policy

This Privacy Policy explains how personal data is processed in connection with the menuman.co website and related services, operated under the MenuMan brand by NextEraLabs Bilgi Teknolojileri, a sole proprietorship registered in Turkey (Tax Office: Göztepe, Tax No: 2540302453, Address: Fenerbahçe Mah. İğrip Sk. No: 13/1, 34726 Kadıköy/Istanbul, Türkiye, Phone: +90 530 264 84 00, Email: [email protected]).

MenuMan acts as the "data controller" under the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR) and, for users in Turkey, the Turkish Personal Data Protection Law (KVKK, Law No. 6698).

To provide the Service we process the following categories:

• Identity / contact: name, email, phone, business name • Tax / VAT number: never stored in plain form; only kept as an irreversible hash to prevent the same business from opening multiple accounts • Account data: username, hashed password, role/permissions, session data • Business content: menu photos, item names, descriptions, prices, categories • Usage data: page views, clicks, device/browser info, anonymised IP address • Billing data: payment information processed for statutory invoicing

We do not collect special-category data (health, biometric, religion, political opinion, etc.).

Your data is processed for the following purposes, on the legal bases set out in Art. 6 of the UK GDPR and EU GDPR (and Art. 5-6 of KVKK for users in Turkey):

• Performance of contract: providing the service, invoicing, support requests • Legitimate interest: service security, abuse prevention, product improvement • Legal obligation: invoice retention, tax law, responding to lawful authority requests • Consent: marketing emails, optional cookies, opt-in features

Your data may be shared with third parties only in the limited cases below:

• Infrastructure providers: Cloudflare (hosting, CDN, security) — EU/UK regions • Payments: Paddle.com (authorised reseller / Merchant of Record) — processes your name, email, country and payment details as an independent controller to fulfil the order, invoice and prevent fraud; your card details never reach us — PCI-DSS compliant • Analytics: Cloudflare Web Analytics (cookie-less, anonymised IP) — no GA4 • AI services: processors such as OpenAI/Anthropic for content processing; contractually excluded from model training

Data Processing Agreements (DPAs) compliant with Art. 28 of the UK GDPR and EU GDPR are signed with each processor. We never sell your data or share it for third-party commercial purposes.

Data is primarily hosted in EU/UK data centres. Where data has to be transferred outside the UK/EU, we apply Standard Contractual Clauses (SCCs) and additional appropriate safeguards in line with Chapter V (Art. 44-49) of the UK GDPR and EU GDPR.

• Active account data: for the duration of your account • Closed account: deleted within 30 days upon request; invoicing-related data is retained up to 10 years per law • Server access logs: 30 days • Payment records: 10 years per applicable tax legislation • Marketing consents: until you withdraw consent

• Transport: TLS 1.3 encryption in transit • Storage: AES-256 disk encryption at rest • Access: role-based access control (RBAC), least-privilege principle, two-factor authentication (2FA) • Certification: ISO 27001 aligned infrastructure providers • Regular penetration testing and a vulnerability disclosure programme

Under Art. 15-22 of the UK GDPR and EU GDPR you have the right to:

• Access your data and receive a copy (data portability) • Request correction of inaccurate or incomplete data • Request erasure or restriction of processing ("right to be forgotten") • Object to processing and withdraw consent • Lodge a complaint with a supervisory authority: in the UK, the Information Commissioner's Office (ICO); in the EU, the data protection authority in your country

Users in Turkey also have the corresponding rights under KVKK Art. 11 and may complain to the Turkish Personal Data Protection Authority (KVKK Authority).

Send requests to [email protected]; we will respond within 30 days at the latest.

The Service is not directed at persons under 18 and we do not knowingly collect data from children. Data belonging to any account identified as under 18 will be deleted promptly.

We may update this Policy from time to time. Material changes will be notified by email and/or in-app notice.

Data Protection Officer (DPO) contact: [email protected] Last updated: 2026-10