Privacy Policy
Last updated: November 11, 2026
This Privacy Policy explains how the Web Gerek QR menu platform ("Platform") collects, uses, stores, and protects your personal data. On the Platform, businesses such as restaurants, cafés, bars, bakeries and hotels build digital menus, and guests open those menus in their browser by scanning a QR code. The Platform is operated by Efe Gerek ("Data Controller", "we") at webgerek.com.
1. Data Controller
Efe Gerek
Email: support@webgerek.com
Web: webgerek.com
2. Personal Data We Collect
a) During Account Creation
- Full name
- Email address
- Profile photo (optional, when using Google/social login)
b) During Platform Use
- Menu content you create (item names, descriptions, prices, calorie, ingredient and allergen details)
- Business details (name, logo, address, opening hours, phone, to the extent you choose to show them on the menu)
- Menu, design and QR code settings and preferences
- Dish photos and other images you upload
- Messages you write to the support assistant
c) Automatically Collected Data
- IP address
- Browser type and version
- Device information
- Page view and click data
- Session durations
d) Payment Data
Your payment details (credit card numbers, etc.) are not stored by us. Payments are processed by Freemius, Inc. under their own privacy policy.
e) Menu Visits (Guests)
Guests do not need an account to open a menu, and menu pages use no ad cookies. When a menu is opened, the following is recorded:
- The page viewed, the referring address (referrer) and the country
- QR code scans and taps on the phone, WhatsApp, directions, email and link buttons on the menu
- A shortened one-way hash of the IP address and browser details that changes every day; the IP address itself is not stored in these records
On paid plans, this data is shown to the menu owner as visitor statistics. Menu fonts are loaded from Google Fonts, so the guest's browser connects to Google's servers.
3. Purposes of Processing
Your personal data is processed for the following purposes:
- Creating and managing your account
- Delivering Platform services (QR menu creation, hosting, publishing, AI menu translation)
- Showing menu owners their visitor statistics
- Managing paid plan subscriptions
- Providing technical support
- Sending service emails (for example, reminders about an unpublished menu)
- Measuring how well our ads work
- Ensuring Platform security and preventing abuse
- Improving service quality
- Fulfilling legal obligations
4. Legal Basis for Processing
Your personal data is processed on the following legal bases:
- Contract performance: Account creation, service delivery
- Legitimate interest: Platform security, service improvement, analytics
- Consent: Marketing communications (only with your consent)
- Legal obligation: Fulfilling legal requirements
5. Third Parties We Share Data With
Your personal data is shared with the following third-party providers to deliver the service and measure our ads:
| Provider | Purpose | Country |
|---|---|---|
| Clerk, Inc. | Authentication, session management | USA |
| Supabase, Inc. | Database, file storage | USA |
| Cloudflare, Inc. | CDN, hosting, analytics | USA |
| Freemius, Inc. | Payment management, subscription processing | USA |
| Google LLC | AI menu translation and the support assistant (Gemini API), ad measurement (Google Ads tag), menu fonts (Google Fonts) | USA |
| Meta Platforms, Inc. | Ad measurement (Meta Pixel and Conversions API; at sign-up, a SHA-256 hash of your email address and your account id; can be turned off with the “Turn ad cookies off” link at the bottom of the page) | USA |
| Resend | Sending service emails | USA |
6. Data Retention
- Account data: Retained while your account is active. Deleted within 30 days of account deletion.
- Menu content: Retained while your account is active or until you delete the relevant menu.
- Analytics data: Menu visit records contain no IP address and are deleted after 180 days.
- Legal obligations: Retained for as long as required by applicable law.
7. Data Security
The following measures are in place to protect your personal data:
- SSL/TLS encrypted data transmission
- Authentication and authorization mechanisms
- Regular security updates
- Access controls and permission restrictions
8. Your Rights
You have the following rights regarding your personal data:
- The right to know whether your personal data is being processed
- The right to request information about how your data is processed
- The right to know the purpose of processing and whether it is used accordingly
- The right to know the third parties your data is shared with
- The right to request correction of incomplete or inaccurate data
- The right to request deletion or destruction of your data
- The right to claim compensation for damages caused by unlawful data processing
9. Exercising Your Rights
To exercise your rights, please contact us at support@webgerek.com.
Please include information to verify your identity and clearly state your request. We will respond within 30 days, free of charge.
10. Children's Privacy
The Platform is not intended for individuals under 18. We do not knowingly collect personal data from anyone under 18.
11. Changes
We may update this Privacy Policy when necessary. Significant changes will be notified by email. The current version is always published at webgerek.com.
12. Contact
Efe Gerek
Email: support@webgerek.com
Web: webgerek.com