Data Protection Notice (KVKK)

Smart Voice Menu is operated by Bilcod Yazılım ("Bilcod"). Bilcod acts as the data controller under KVKK. Contact: info@bilcod.com

We process the following categories of personal data: • Identity: display name • Contact: email, optional phone • Customer transaction: order items, quantities, notes, table number, total • Marketing: opt-in marketing consent • Voice data: when the voice menu (browsing and ordering) is used, spoken commands are converted to text in real time; audio is NEVER stored, only the transcript is kept for 90 days. When voice confirmation is used, the transcript of the confirmation statement is linked to the related order as proof (subject to the same 90-day retention). If companion mode is enabled the microphone may re-open automatically after each command and closes by itself about 1 minute after your last command; if you don't start speaking, no audio is sent or stored. • Security: IP address (country only), user agent, session info • Table Session: duration of the waiter-opened table session and the staff who opened/closed it (table_sessions). Ordering is authorized within this session.

We process your personal data for the following purposes and legal grounds: • Performance of contract: service delivery, account management, order handling, taking the binding voice confirmation ("I confirm") of orders • Legal obligation: tax law, commercial bookkeeping • Establishment/protection of a right (KVKK art. 5/2-e): evidencing the binding voice confirmation statement and defence in potential disputes • Legitimate interest: service quality, voice intent learning, security logs • Explicit consent: marketing emails

We share data with the following processors: • Supabase (database, auth, storage): EU data centers (Frankfurt), under DPA • Groq (voice → text, whisper-large-v3-turbo model): US-based, Standard Contractual Clauses (SCC); fallback provider OpenAI (US) • Google Gemini (intent parsing): US-based, SCC + DPA • Vercel (web hosting): EU/global CDN • Resend (future, transactional email): EU These parties may only access data strictly necessary for service delivery.

We retain data for: • Contact form (leads): 2 years • Order records: 10 years (tax law) • Voice transcripts: 90 days (intent learning, debugging and voice-confirmation proof) • Profile data: while account is active + 1 year after closure • Security logs: 6 months • Table session records (waiter open/close, table session times): 6 months

Under KVKK Article 11 you have the following rights:

Submit requests to: • Email: info@bilcod.com • Detailed application form: see link below We respond within 30 days. Identity verification may be required.

Application Form →

We protect your data with technical and organizational measures: • TLS 1.3 encryption in transit • Database-level Row Level Security (RLS) • Bcrypt password hashing • Encrypted backups • Audit logs • Principle of least privilege

Smart Voice Menu is not designed for children under 13. We do not knowingly collect data from children under 13. If we discover such data, we will delete it promptly. For ages 13-18, parental consent is required. The voice-ordering feature in restaurants should be used under adult supervision.

We may update this notice. Material changes will be notified by email. The effective date is shown in the "Last updated" badge above. Turkish law governs; Istanbul courts have jurisdiction.