Privacy Policy
Last updated: 30 October 2026
This policy explains how SEREL TATLI ("we", "us"), a sole trader registered in Türkiye at Haraparası Mah. İzzet Güçlü Cad., Palladium Antakya AVM No: 22, İç Kapı No: 226, Antakya, Hatay, handles personal data in connection with AsmiQR (the "Service").
Contact for any privacy matter: support@asmiqr.com
1. Two different roles
We are the controller for data about our own customers — the businesses that buy and use the Service, and visitors to our website.
We are a processor for data that our customers collect from their own guests through the Service (for example an order placed from a QR menu). In that case the restaurant is the controller and decides what is collected and why. We act on their instructions.
2. What we collect
Account data. Name, business name, email address, phone number, country, billing address, and the credentials you create.
Payment data. We do not receive or store your card details. Payments are handled by our merchant of record partners, Paddle.com Market Ltd and Gumroad, Inc., who process card data under their own privacy policies. We receive only the transaction result, the last four digits, and billing country.
Content you upload. Menu items, descriptions, prices, photographs, branding, business hours and similar operational data.
End-customer data (as processor). Where your guests place orders, make reservations or leave reviews, this may include name, phone number, email, table number, order contents and free-text notes.
Usage data. IP address, browser and device type, pages viewed, timestamps, and error logs, collected to operate and secure the Service.
Support correspondence. Messages you send us and our replies.
3. Why we process it, and on what basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service | Performance of a contract |
| Billing and invoicing | Contract / legal obligation |
| Support | Contract / legitimate interests |
| Security, fraud and abuse prevention | Legitimate interests |
| Product improvement, aggregated analytics | Legitimate interests |
| Service announcements | Contract |
| Marketing email | Consent (withdrawable at any time) |
| Tax and accounting records | Legal obligation |
4. Who we share it with
We do not sell personal data. We share it only with service providers acting on our behalf:
- Hosting and infrastructure — to run the Service and store data
- Paddle.com Market Ltd / Gumroad, Inc. — payment processing and invoicing
- Email delivery providers — transactional and support email
- SMS providers — where a customer enables SMS notifications
- Error monitoring and analytics — to diagnose faults
We may also disclose data where required by law, to enforce our Terms, or in connection with a merger or sale of the business, in which case we will give notice.
5. International transfers
We operate from Türkiye and our providers may process data in the EU, the UK, the United States and elsewhere. Where we transfer personal data from the EEA or the UK, we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.
6. Retention
- Account and content data: for the life of the account, then up to 30 days after termination for export, then deleted or anonymised.
- Billing and tax records: as required by Turkish law (currently 10 years).
- Server and security logs: typically up to 12 months.
- Support correspondence: up to 3 years.
End-customer data processed on behalf of a restaurant is retained according to that restaurant's settings and deleted when they delete it or close their account.
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive it in a portable format, and to withdraw consent. Where GDPR or UK GDPR applies, these rights apply in full.
To exercise any right, email support@asmiqr.com. We respond within 30 days. If you are a guest of a restaurant using our Service, please contact that restaurant first; we will assist them in responding.
You may also complain to your local data protection authority. In Türkiye this is the KVKK (Kişisel Verileri Koruma Kurumu).
8. Cookies
We use cookies that are strictly necessary for login sessions and security. We use limited analytics cookies to understand how the Service is used. We do not use advertising cookies or third-party tracking for advertising purposes. You can control cookies in your browser; disabling necessary cookies will prevent login.
9. Security
We use encryption in transit, hashed passwords, access controls, tenant-level data isolation and regular backups. No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify you and the relevant authority without undue delay.
10. Children
The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data.
11. Changes
We will post updates here with a new "Last updated" date and notify account holders by email of material changes.
12. Contact
SEREL TATLI Haraparası Mah. İzzet Güçlü Cad., Palladium Antakya AVM No: 22, İç Kapı No: 226, Antakya, Hatay, Türkiye support@asmiqr.com