Personal Data Protection Notice (KVKK)

Under Turkish Personal Data Protection Law No. 6698 ("KVKK"), your personal data is processed by [ŞİRKET UNVANI — kuruluş sonrası doldurulacak] ("Flowisma") acting as data controller.

Address: [TİCARİ ADRES — kuruluş sonrası doldurulacak]

Email: [KVKK BAŞVURU E-POSTASI — adres açılınca doldurulacak]

Tax office / Tax ID: [VERGİ DAİRESİ] / [VERGİ KİMLİK NO]

MERSIS: [MERSİS NO]

This notice covers personal data of website visitors, users who create a business account on the platform, and subscription purchasers.

For data relating to the guests and staff of restaurant businesses using the platform, the data controller is the relevant restaurant; Flowisma acts solely as a data processor providing infrastructure under the business's instructions. The guest-facing notice is available from each restaurant's QR menu.

• Identity and contact: name, email, phone, business name and address (shared via sign-up, demo request and contact forms).
• Account and security: an irreversible digest of your password, login and activity records, device/session identifiers kept for account security, failed-login counters.
• Subscription and billing: selected plan, invoicing details (name, address, tax details) and the limited data transmitted to the payment institution. Your card details are NOT stored on our systems; payments are collected on the licensed payment provider's secure pages.
• Usage records: an immutable activity ledger kept for financial record integrity.
• Support communication: the message content you share with us.

• Establishing and performing the membership and subscription agreement, providing the service, invoicing (KVKK art. 5/2-c).
• Fulfilling obligations under tax and commercial legislation (art. 5/2-ç).
• Ensuring account security, preventing abuse and fraud, measuring and improving service quality (art. 5/2-f — legitimate interest).
• Promotional communication is based SOLELY on your explicit consent (art. 5/1); see the Explicit Consent Text.

Your personal data is never sold or rented to third parties for marketing. To deliver the service, data is shared with the following providers to the extent necessary:

• Database, authentication and file hosting: Supabase (servers in the EU — Frankfurt).
• Application hosting: Vercel (EU region — Frankfurt).
• Short-lived security counters: Upstash (rate-limit counters only, max 1 hour).
• SMS verification codes: NetGSM (Türkiye).
• Payments: PayTR and/or iyzico (Türkiye) — name, contact, billing details and, for transaction security, IP address are transmitted during payment.
• Messaging, if preferred: Meta (WhatsApp Business) infrastructure.
• AI-assisted features do NOT receive personal data; only de-identified aggregate business metrics and menu content are processed.

Some providers operate servers abroad; compliance work under Article 9 of the KVKK (international transfers) is being carried out and data processing agreements are applied with providers.

• Account and subscription data: for the duration of membership and, after account closure, for statutory retention periods (e.g. 10 years for financial records).
• SMS verification records: 24 hours.
• Message dispatch logs: 12 months.
• Connection-quality telemetry (contains no personal identifiers): 90 days.
• Unused trusted-device records: 180 days from last use.

When you delete your account, your data is permanently erased except where statutory retention applies.

You have the right to learn whether your personal data is processed; request information; learn the purpose and whether data is used accordingly; know the third parties to whom it is transferred domestically or abroad; request correction, erasure or destruction; request notification of these actions to recipients; object to results arising solely from automated analysis; and claim compensation for damages caused by unlawful processing.

Applications may be submitted to [KVKK BAŞVURU E-POSTASI — adres açılınca doldurulacak] by email or in writing to [TİCARİ ADRES — kuruluş sonrası doldurulacak], in accordance with the applicable regulation. Applications are concluded free of charge within 30 days at the latest.

This notice may be updated due to changes in legislation or processing activities. The current version is always published on this page with its version date shown above.