Data Protection Notice (KVKK)

Smart Voice Menu is operated by Bilcod Yazılım ("Bilcod"). Bilcod acts as the data controller under KVKK. Contact: info@bilcod.com

We process the following categories of personal data: • Identity: display name • Contact: email, optional phone • Customer transaction: order items, quantities, notes, table number, total • Marketing: opt-in marketing consent • Voice data: when the voice menu (browsing and ordering) is used, spoken commands are converted to text in real time; audio is NEVER stored, only the transcript is kept for 90 days. When voice confirmation is used, the transcript of the confirmation statement is linked to the related order as proof (subject to the same 90-day retention). If companion mode is enabled the microphone may re-open automatically after each command and closes by itself about 1 minute after your last command; if you don't start speaking, no audio is sent or stored. • Security: IP address (country only), user agent, session info • Table Session: duration of the waiter-opened table session and the staff who opened/closed it (table_sessions). Ordering is authorized within this session.

We process your personal data for the following purposes and legal grounds: • Performance of contract: service delivery, account management, order handling, taking the binding voice confirmation ("I confirm") of orders • Legal obligation: tax law, commercial bookkeeping • Establishment/protection of a right (KVKK art. 5/2-e): evidencing the binding voice confirmation statement and defence in potential disputes • Legitimate interest: service quality, voice intent learning, security logs • Explicit consent: marketing emails Companion (automatic listening) mode is processed under KVKK Art. 5/2-f (legitimate interest) solely to provide a hands-free, uninterrupted ordering experience, and only when the user themselves has started it. In this mode no audio is sent to the server or stored during the silent window; the duration is limited (it turns off on its own about 1 minute after the last command), a live on-screen indicator is shown, and the user can stop it at any time with a tap.

We transfer personal data to the following categories of recipients to deliver the service: • Cloud database, authentication and file storage infrastructure: hosted in EU data centers (Frankfurt), as a data processor under a Data Processing Agreement (DPA). • An overseas speech-to-text (STT) service (voice ordering — audio-to-text): US-based, transferred abroad under KVKK Art. 9 appropriate safeguards such as Standard Contractual Clauses (SCC). A US-based, overseas backup STT provider may be used for continuity when needed. • An overseas natural-language processing (AI) service (voice ordering — intent parsing): US-based, under SCC + DPA per KVKK Art. 9. • Cloud hosting/delivery (CDN) infrastructure: EU/global. • Email delivery service (future — transactional email): EU-based. These recipient categories may only access the data strictly necessary to deliver the service and may not use it for marketing or any other purpose. International transfers rely on the appropriate safeguards set out in KVKK Art. 9 (Standard Contractual Clauses / undertakings) and cover only the minimum data required for service delivery.

We retain data for: • Contact form (leads): 2 years • Order records: 10 years (tax law) • Voice transcripts: 90 days (intent learning, debugging and voice-confirmation proof) • Profile data: while account is active + 1 year after closure • Security logs: 6 months • Table session records (waiter open/close, table session times): 6 months

Under KVKK Article 11 you have the following rights:

Submit requests to: • Email: info@bilcod.com • Detailed application form: see link below We respond within 30 days. Identity verification may be required.

Application Form →

We protect your data with technical and organizational measures: • TLS 1.3 encryption in transit • Database-level Row Level Security (RLS) • Bcrypt password hashing • Encrypted backups • Audit logs • Principle of least privilege

Smart Voice Menu is not designed for children under 13. We do not knowingly collect data from children under 13. If we discover such data, we will delete it promptly. For ages 13-18, parental consent is required. The voice-ordering feature in restaurants should be used under adult supervision.

We may update this notice. Material changes will be notified by email. The effective date is shown in the "Last updated" badge above. Turkish law governs; Istanbul courts have jurisdiction.