KVKK disclosure — Cafe Brewly

1. Data controller

Your personal data is processed by Mustafa Evleksiz ('Cafe Brewly') as data controller within the scope described below.

2. Categories of personal data processed

Cafe Brewly processes the following categories:

• Identity and contact: email, name, phone (staff OTP login).
• Authorisation: user role and branch access permissions.
• Café/organisation: name, logo, address, phone, tax information.
• Operational and financial: orders, products, prices, payment method type (no card numbers).
• AI interactions: messages exchanged with the Çırak AI assistant and the sales summaries used to answer them.
• Customer feedback (via QR menu): anonymised ratings and comments; optional contact email.
• Newsletter (opt-in): customer emails collected for marketing.
• Usage and device: analytics events, app version, browser/device info, anonymous analytics ID.
• Diagnostics: crash and error logs.
• Session: short-lived authentication cookies.

3. Processing purposes

Your data is processed to:

• Run the platform — orders, menus, role-based access, AI answers.
• Maintain account, café and staff identities.
• Detect errors, prevent abuse (rate-limiting) and improve performance.
• Send transactional and (opted-in) newsletter emails.
• Fulfil legal obligations.

4. Legal bases (KVKK Art. 5 and 6)

Processing is based on:

• Art. 5/2-c: necessary for the establishment or performance of a contract (service delivery).
• Art. 5/2-ç: necessary for compliance with a legal obligation.
• Art. 5/2-f: legitimate interest (security, error detection, improvement).
• Art. 5/1 (explicit consent): for analytics, newsletter subscriptions and, where required, international transfers.

5. Transfers (KVKK Art. 8 and 9)

Your data may be transferred to the following service providers, most located outside Turkey (including the United States and the EU). International transfers rely on your explicit consent and/or appropriate safeguards:

• Supabase — authentication, database, storage — outside Turkey.
• Google (Gemini API) — AI assistant (Çırak) — outside Turkey.
• Upstash (Redis) — rate-limiting — outside Turkey.
• PostHog — product analytics — outside Turkey.
• Sentry — crash reporting — outside Turkey.
• Resend — transactional email — outside Turkey.
• Vercel — hosting and Edge runtime — outside Turkey.

6. Collection method

Your personal data is collected electronically during your use of the platform — in-app forms, QR menu interactions, order flows, AI conversations, and automated event logs.

7. Data subject rights (KVKK Art. 11)

Under Art. 11 you have the right to learn whether your data is processed, request information, know its purpose and whether it is used in accordance with that purpose, learn the third parties it is shared with, request correction of incomplete or wrong data, request deletion or destruction when the conditions are met, request that these be notified to recipients, object to automated decisions, and seek compensation for damages.

8. How to apply

The in-app account deletion UI is in progress. To exercise your rights, contact mustafa@mustafaevleksiz.com under the Communiqué on Application Procedures and Principles to the Data Controller — we will delete your account and associated data within 30 days.

9. Response time

Applications are answered within 30 days at the latest.