This Privacy Policy explains how Sarıarslanlar Bilişim Danışmanlık Sanayi ve Ticaret Limited Şirketi, a company established in Türkiye (tax office Dikimevi, tax number 7471215151, address: General Zeki Doğan Mah. 522. Sk. Uğurcan Apt. No: 23 İç Kapı No: 20, Mamak / Ankara, Türkiye) (“Hesap Lütfen”, “we”, “us”), collects, uses and protects personal information when you visit hesaplutfen.com.tr, create a restaurant account, or order from a restaurant that uses our service. It is written to meet the requirements of Türkiye’s Personal Data Protection Law No. 6698 (KVKK), the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA), and Canada’s PIPEDA.
1. Who is responsible for your data
- Restaurant customers (account holders) and website visitors: Hesap Lütfen is the data controller.
- Guests ordering from a restaurant: the restaurant is the controller of your order details and Hesap Lütfen acts as its processor/service provider, processing data only on the restaurant’s instructions. Contact the restaurant for requests about your order; we will help them respond.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, phone, restaurant name, country, hashed password | You, at sign-up |
| Billing data | Plan, invoices, billing address, tax ID. Card numbers are collected and stored by Stripe, never by us. | You, Stripe |
| Guest order data | Items ordered, notes, table number; for pickup/delivery: name, phone, optional email, delivery address and optional device location | Guests |
| Technical data | IP address, browser type, timestamps, security logs | Automatically |
| Cookies & local storage | See our Cookie Policy | Your browser |
3. Why we use it and our legal bases
- To provide the service (accounts, menus, orders, dashboards) — performance of a contract.
- Billing and tax compliance — contract and legal obligation.
- Security, fraud and abuse prevention (rate limiting, audit logs) — legitimate interests.
- Service emails (password resets, trial reminders, billing notices) — contract and legitimate interests.
- Analytics and marketing cookies — only with your consent, which you can withdraw at any time.
We do not sell personal information, and we do not use guest order data for advertising.
4. Sharing and sub-processors
We share data only with providers that help us run the service, under written data-processing terms:
- Stripe — subscription payments and invoicing.
- Hosting and database providers — infrastructure where the service runs.
- Email delivery provider — transactional emails.
- Anthropic — only when a restaurant uses automatic menu translation; only menu text is sent.
We may disclose information if required by law or to protect the rights and safety of our users.
5. International transfers
Data may be processed outside your country. Where we transfer personal data from the EEA or UK, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
6. How long we keep data
- Account data: while your account is active and for up to 90 days after closure.
- Order and receipt records: as long as the restaurant keeps its account (restaurants may need them for tax purposes).
- Billing records: as required by tax law (typically 6–7 years).
- Security logs: up to 12 months.
7. Your rights
Depending on where you live, you may have the right to:
- access, correct or delete your personal data, and receive a portable copy;
- object to or restrict processing, and withdraw consent at any time;
- California residents: know what we collect, delete, correct, opt out of “sale” or “sharing”, limit use of sensitive data, and not be discriminated against for exercising these rights. We honor Global Privacy Control signals;
- Canada: access and correct your information and withdraw consent under PIPEDA;
- lodge a complaint with your data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk) — or your EU supervisory authority.
To exercise a right, email [email protected]. We will verify your request and respond within the legally required time (generally 30 days, or 45 days under the CCPA).
8. Security
We use encryption in transit (HTTPS), hashed passwords, encrypted storage of payment-provider secrets, signed table QR codes, role-based access, rate limiting and audit logs. No system is perfectly secure, but we work hard to protect your data and will notify affected users and regulators of a breach where required.
9. Children
The service is not directed to children under 16, and we do not knowingly collect their personal data.
10. Changes and contact
We will post updates here and notify account holders of material changes. Questions? Contact [email protected]. Sarıarslanlar Bilişim Danışmanlık Sanayi ve Ticaret Limited Şirketi, General Zeki Doğan Mah. 522. Sk. Uğurcan Apt. No: 23 İç Kapı No: 20, Mamak / Ankara, Türkiye.