Privacy policy

Last updated: 29 October 2026. Information under Articles 13 and 14 of the General Data Protection Regulation (GDPR). A German version is also available.

1. Controller

Menümde
Istanbul
Türkiye
Email: iletisim@menumde.com

Representative in the EU (Art. 27 GDPR): [AB temsilcisi: ad, adres, e-posta]

For data protection questions, contact us at the email address above.

2. Who is responsible for what?

Business accounts: we are the controller for the data of owners, staff and resellers who use an account.
Menus, orders and waiter calls: we process this data on behalf of the restaurant concerned (Art. 28 GDPR). The controller for guests is the restaurant whose menu you view. Our Data Processing Agreement applies to businesses.

3. What data we process

a) Guests viewing a menu

No account is needed to view a menu; we do not ask for your name or contact details and set no cookies. Allergy, language and filter settings are kept only in your browser's storage (localStorage) and are not sent to us.
When a page is requested, the server processes technically necessary data (IP address, time, page requested, browser identifier). For statistics we only count the number of views per business and day, without reference to any person.
Ordering from the table and calling a waiter (if enabled by the restaurant): the dishes ordered, quantities, your note, table number, menu language and times are sent to the staff screen. A random code in your browser links your orders to your device. Your IP address is used briefly to prevent abuse (too many requests). No phone number is requested. If you choose to enter a name in the basket ("Your name"), staff see it so they can keep separate bills at the table; it is deleted with the table session and kept in your browser for your next order.
"Order ready" notification (only if you allow it in your browser): we store the push address and keys your browser creates for it, together with your table session. The notification is delivered encrypted through your browser's push service (e.g. Google, Apple, Mozilla, Microsoft), which cannot read its content. The data is deleted after 12 hours; you can withdraw permission at any time in your browser settings.
Calling a waiter via WhatsApp (if the restaurant chose this option): you send the message yourself from your WhatsApp to the restaurant; it does not reach us. WhatsApp's privacy policy applies.

b) Account holders (businesses, staff, resellers)

Name, email address, an irreversible hash of the password, time of registration and of acceptance of the terms, chosen language; if two-step verification is enabled, an encrypted secret and hashed recovery codes.
Business details (name, address, phone, WhatsApp number if given) and the name of the person who confirmed the accuracy of the information.
Security log: sign-ins and sign-outs, password and security changes, subscription and credit operations with time and IP address.
Session cookie mu_oturum (strictly necessary), if chosen the language setting mu_dil and, if you tick it, mu_cihaz (remember this device). Details in the Cookie Policy.

c) Contact form

The name, email address, subject and message you enter, the interface language and your IP address (to prevent abuse).

4. Purposes and legal bases

Providing the service, managing accounts and subscriptions: performance of a contract (Art. 6(1)(b) GDPR).
Security, abuse prevention, logs and backups: legitimate interest in operating the service securely (Art. 6(1)(f) GDPR).
Retention under commercial and tax law: legal obligation (Art. 6(1)(c) GDPR).
Answering enquiries sent through the contact form: legitimate interest (Art. 6(1)(f) GDPR); for existing customers also performance of a contract (Art. 6(1)(b)).
We store the language setting in the mu_dil cookie because you explicitly choose it (strictly necessary for the service you requested).

We use no analytics, advertising or tracking services and make no automated decisions within the meaning of Art. 22 GDPR.

5. Recipients

Hosting: [Hosting firması, ülke] (processor).
DeepL SE (Cologne, Germany): only if a business uses automatic translation, menu texts (dish names, descriptions, ingredients) are sent for translation; no guest data is sent.
Open Food Facts: only in the business area (barcode lookup); the IP address is transmitted technically. Menus for guests load no external resources.
Authorities, where we are legally obliged.

6. Transfers to third countries

The provider is established in Türkiye. Where data is processed outside the EU/EEA in a country without an EU adequacy decision, this is based on standard contractual clauses (Art. 46(2)(c) GDPR) or, where necessary for the performance of the contract, on Art. 49(1)(b) GDPR. You can request a copy of the safeguards.

7. Retention

Account data: until the account is deleted; afterwards only as required by statutory retention obligations.
Sessions: 8 hours of inactivity. Abuse counters: at most 2 days; failed sign-in attempts: 1 day.
Security log: about 24 months (730 days).
Waiter calls: 30 days. Orders: 90 days (to settle questions about an order). Table sessions: 7 days after the last activity.
Backups: daily, the last 30 are kept.
Contact form messages: 365 days.
Declarations given when importing photos from another menu (account, email, wording, source link, date, IP address): no deletion period, kept as evidence for legal claims (Art. 6(1)(f), Art. 17(3)(e) GDPR).

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Contact us at the email address above. If your request concerns an order or a waiter call, please address it to the restaurant; we will help it respond.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state where you live.

9. Security

Data is transmitted encrypted (HTTPS). Passwords are stored only as hashes and two-step verification secrets are encrypted. Two-step verification is mandatory for administrator accounts.

Legal notice (Impressum)