Privacy, clearly.
How does Dine use data? Data categories, preferences and request channels.
Data controller and scope
Dine is a digital menu service provided by Berkay Huz under the Huzstudio brand. Berkay Huz is the data controller for personal data processing related to accounts, subscriptions, support and service security. Contact and request address: info@huzstudio.com.
This notice informs account holders, website visitors and menu visitors. Restaurants retain their responsibilities for personal data they add to menus for their own purposes; Dine provides technical storage and publication. You may also contact the restaurant about its own data use.
Data collected and collection methods
Data is obtained electronically through registration and sign-in screens, account and restaurant forms, uploaded files, support emails, browser requests and subscription notifications. Signing in with Google or Apple may provide the account identifier, email and profile information shared by that provider.
- Account and contact: first name, last name, email, user ID and authentication records required for sign-in.
- Restaurant and content: business name, contact details, menus, products, images, domain and publication preferences.
- Subscription: Polar customer and subscription IDs, plan, payment/subscription status and period dates. Dine does not collect or store full card numbers or card security codes.
- Technical and support records: IP address, browser/device information, session and security records and correspondence you send us.
Processing purposes and legal bases
Personal data is processed in a relevant, limited and proportionate manner. The processing conditions in Article 5 of the Turkish Personal Data Protection Law (KVKK) apply according to the activity. Separate explicit consent is required for optional processing without another applicable legal basis; reading this notice does not constitute explicit consent.
- Account creation, sign-in, menu management/publication and subscription access: necessity for entering into or performing a contract.
- Handling support requests and disputes: performance of a contract or establishment, exercise or protection of a right, depending on the request.
- Preventing unauthorized access and misuse and investigating service errors: legitimate interests, provided fundamental rights and freedoms are not harmed.
- Requests from competent authorities and mandatory recordkeeping: express provision by law or compliance with a legal obligation.
Public menu content
Restaurant contact details, menu content and images you publish are publicly accessible through your domain or QR link. Only add information you are authorized to share. Dine does not ask you to upload special categories of personal data.
Stopping publication or deleting content does not automatically remove screenshots, copies or search engine caches previously created by third parties.
Service providers and other recipients
The new application manages accounts and identity through Huzstudio .NET services, product data in PostgreSQL, and images in the configured R2 storage. Cloudflare bot protection, Resend transactional email and Polar payment services are used in environments where they are configured. Hosting and DNS/TLS providers depend on the deployment environment.
Polar also processes data for its own purposes and obligations as Merchant of Record for payments. Information entered at checkout is subject to Polar's privacy notice. Dine receives status notifications needed to manage subscription access. Data may also be transferred to competent authorities when legal conditions are met, or to persons necessary to handle legal claims.
International transfers
Depending on the international infrastructure and payment services used, data may also be processed outside Türkiye. Using these services does not mean that data is stored only in Türkiye.
The conditions in Article 9 of the KVKK and other applicable data protection rules apply to international transfers. You may request information about recipient services, data locations and transfer safeguards at info@huzstudio.com. This notice is not a declaration of explicit consent to international transfers.
Retention and deletion
Account and restaurant content is retained for as long as necessary to provide the service; subscription records are retained as needed for payment/access management, legal obligations and protection of rights. Technical record retention considers security purposes, incident investigation needs and the provider's logging cycle.
Account deletion and freezing in settings are verified by a code sent to the registered email. Once permanent deletion is confirmed, access and publication close and account and restaurant content is deleted. If you do not sign in within 14 days of freezing, reactivation closes and the account is deleted in the next daily automatic cleanup. Identity and authority are checked for account closure or deletion requests. Data whose processing basis has ended is deleted, destroyed or anonymized; records required by mandatory retention or ongoing disputes remain limited to those purposes. Backup removal may depend on the backup cycle. Polar's own record retention is subject to its separate privacy notice.
Your rights and requests
Under Article 11 of the KVKK, you have rights to learn whether your data is processed and used for its intended purpose, request information, learn domestic/international recipients, request correction of incomplete or inaccurate data, request deletion/destruction under legal conditions and notification of these actions to recipients. You may object to adverse results based solely on automated analysis and seek compensation for damage from unlawful processing.
Preferably send your request from your registered account email to info@huzstudio.com with the subject “Personal data request”. Include your name, request and contact details for a response. Identity verification required by law and relevant procedures may be requested; do not send passwords or card details.
Valid requests are handled as soon as possible according to their nature, and within 30 days at the latest. Requests are free; where additional costs arise, only the tariff set by the Board may apply. Your legal remedies, including complaints to the Board, remain available.
Cookies and changes
Necessary browser storage is used for sessions, security and language preferences. In this version of the notice, no optional advertising or analytics trackers are enabled on Dine's own site. Data and cookie use at Polar checkout is explained in Polar's own notice.
When significant data processing changes occur, this page and, where needed, relevant information channels are updated. If a new activity requires separate consent, updating the notice alone does not replace consent.