Now opening in the UAE 30 days free, no card required

Privacy Policy

Last updated 16 September 2026

This policy explains what personal data the Kafe360 website and service collect, how it is used, who it is shared with and where it is kept.

1. Who is responsible for your data

  • Controller: Deniz Işık, a sole proprietorship registered in Ankara, Türkiye, trading as Kafe360.
  • Address: Kavaklıdere Mah. Esat Cad. 12/1, Ankara, Türkiye
  • Email: [email protected]

2. What we collect

  • Identity: first and last name.
  • Contact: email address, phone number.
  • Transaction: subscription history and payment records. Card numbers are never stored by us.
  • Technical: IP address, browser, device type, session information.
  • Usage: activity inside the service, sign-in times, which features are used.

Your operating data — menu, orders, tables, staff, customer accounts and reports — belongs to your business. We process it to run the service for you, we do not sell it, and we do not use it to build a product for anyone else.

3. How it is collected

  • registration and sign-up forms
  • during payment, through the payment provider
  • automatically while the service is used — cookies and server logs
  • support requests and messages you send us

4. Why we use it

  • to provide and operate the service
  • to handle subscriptions and payments
  • to create and authorise user accounts
  • to give technical support
  • to improve the quality of the service
  • to meet legal obligations
  • for security — detecting fraud and blocking unauthorised access

5. Where your data is stored

The servers that run Kafe360 are in Germany, operated by Hetzner Online GmbH. Your data is stored and processed there, inside the European Union, under that jurisdiction's data protection regime.

The company behind Kafe360 is based in Türkiye, so our own staff access the systems from Türkiye when they provide support or maintenance. Daily backups are taken and kept off-site with a separate provider, encrypted in transit and at rest.

6. Who else sees it

Your data is not shared with third parties except in the situations below. Each of these providers processes only what it needs in order to do its part.

  • Hosting: Hetzner Online GmbH, Germany — the servers and the database.
  • Network and security: Cloudflare — protects the site and speeds it up; it sees traffic metadata such as IP addresses.
  • Payments: a bank virtual POS gateway handles card payments. Card details go directly to the gateway and are never stored on our systems.
  • Email and SMS: our mail provider and SMS provider deliver account emails and verification codes.
  • AI assistant: if you use the built-in assistant, your question and the panel data needed to answer it are sent to an external AI provider to generate the reply. The assistant is read only — it cannot change anything in your account.
  • Legal requests: data may be disclosed where a competent authority lawfully requires it.

7. How it is protected

  • all traffic is encrypted with TLS
  • card payments go through 3D Secure verification
  • passwords are stored as one-way hashes (bcrypt)
  • access is limited by role, and every business only ever sees its own data
  • backups run daily so that data loss is recoverable

8. How long it is kept

Personal data is kept for as long as the purpose it was collected for requires. After a subscription ends, records we are legally required to retain — accounting and invoicing records in particular, which we must keep for several years under the law we are established in — are kept for that period. Once those periods end the data is deleted or anonymised.

If you want your account data deleted sooner than that, ask us and we will tell you exactly what can be removed and what has to stay.

9. Cookies

The website uses cookies. What they are and how to control them is set out in our cookie policy.

10. Your rights

You can ask us to

  • tell you what personal data we hold about you
  • correct anything that is wrong or out of date
  • delete data we are not required to keep
  • give you a copy of your business data in a usable format
  • stop sending you marketing messages

Write to [email protected] and we will act on it. We aim to answer within 30 days and will tell you if something takes longer. You do not need to quote a statute to make a request — asking is enough.

11. Changes

This policy may be updated. Changes take effect when published here, and the date at the top changes. Significant changes are emailed to registered users.

12. Contact