Aidisyon Privacy Policy
Last updated: 9 October 2026 · Version: 1.3
This policy explains how your personal data is processed when you use the Aidisyon service (aidisyon.com, the business panel, QR menu and online ordering pages, the voice ordering agent, the WhatsApp ordering agent and food platform integrations). Detailed KVKK privacy notice for business users: aidisyon.com/kvkk.
1. Who we are#
Aidisyon is an order management service for restaurants developed by MEACH TEKNOLOJİ VE DANIŞMANLIK LİMİTED ŞİRKETİ ("Aidisyon", "we").
- Address: Çınarlı Mah. 1572 Sokak No:33, 35170 Konak / İzmir
- MERSİS No: 0613213421900001
- KEP: meachteknoloji.ltd@hs01.kep.tr
- E-mail: kvkk@aidisyon.com
2. We have two different roles#
a) Where we are the data controller. The data of business owners and employees who register with Aidisyon (business users) and of visitors to our website. We determine the purpose and means of processing this data.
b) Where we are the data processor. The data of customers who order from restaurants (end customers). This data is processed on behalf of the restaurant and on its instructions. In this case the data controller is the restaurant. As an end customer, you can first direct your rights to the restaurant you ordered from. We forward applications we receive to the relevant restaurant and give the restaurant the support it needs.
3. What data we process#
3.1 Business users#
| Category | Example |
|---|---|
| Identity | first name, last name |
| Contact | mobile phone, e-mail |
| Account and login | password (only as an irreversible hash), SMS verification record, when signing in with Google or Apple the user ID, name and e-mail provided by these services |
| Business information | business name, address, opening hours, menu, delivery zones, branch and role information |
| Billing | company name, tax number and tax office, billing address and e-mail (when the subscription starts) |
| Transaction security | IP address, browser/device information, session logs, transaction and access logs |
| Consent records | the text you accepted and its version, the time of acceptance, IP address |
| Linked accounts | WhatsApp Business account and number; food platform store IDs and API keys (stored encrypted) |
3.2 End customers (on behalf of the restaurant)#
| Category | Example |
|---|---|
| Identity and contact | name, telephone, WhatsApp user ID or username |
| Address and location | delivery address, directions, map point |
| Order | products, notes, amount, payment method, order history |
| Voice order | call audio recording, written transcript of the conversation, call time and duration |
| Callback | if the voice assistant cannot complete your request or you want to speak to a person in charge: your telephone number, the time of the call, the restaurant you called and a short note summarising your request (e.g. "complaint", "wants to speak to a person in charge") |
| conversations with the restaurant's WhatsApp Business number | |
| Platform orders | order and delivery information coming to the restaurant from platforms such as Trendyol Go, Yemeksepeti, Migros Yemek |
3.3 Website visitors#
Technical logs required for the site to work (IP address, browser information) and browser storage that remembers your preferences (theme, cookie choice). With Cloudflare Web Analytics we keep aggregate visit statistics without using cookies (which pages are opened, where visitors come from, country, browser and device type). If you consent, we measure how you use the site with Microsoft Clarity (clicks, scrolling, session recording; form fields are masked); if you do not consent, Clarity is not loaded at all. No marketing or advertising cookies are used. Details and changing your choice: Cookie Policy.
If you apply through the "Biz sizi arayalım" ("We'll call you") form on the site, the information you provide (name, telephone, business name, province/district, note) is used only to call you; details in the Application Privacy Notice.
4. Why we process it and legal grounds#
| Purpose | Legal ground (KVKK Article 5) |
|---|---|
| Opening the account, verifying login, providing the service | establishment and performance of a contract (Article 5(2)(c)) |
| Billing and keeping legal records | legal obligation (Article 5(2)(ç)) |
| Security, preventing misuse, debugging, improving the service | legitimate interest (Article 5(2)(f)) |
| Aggregate visit statistics of the site (Cloudflare Web Analytics) | legitimate interest (Article 5(2)(f)) |
| Measuring and improving site use (Microsoft Clarity) | only with the explicit consent you give in the cookie banner (Article 5(1)); you can withdraw it under "Çerez ayarları" ("Cookie settings") |
| Establishing and protecting a right in a dispute (consent records, transaction logs) | Article 5(2)(e) |
| Campaign and promotional messages | only with the explicit consent / consent to commercial messages you give separately; you can withdraw it at any time |
| End customer data | the purposes determined by the restaurant (taking, preparing and delivering the order); based on the restaurant's legal ground |
| The restaurant calling you back if the voice assistant cannot complete your request or you need to be referred to a person in charge | announced by voice during the call; processed on behalf of the restaurant, based on the restaurant's legal ground |
| Call recording for telephone orders | taking the order correctly, checking the quality of service, evidence in a dispute about the order; announced by a voice announcement at the start of the call; processed on behalf of the restaurant, based on the restaurant's legal ground |
5. Processing with artificial intelligence#
The voice ordering agent and the WhatsApp ordering agent use AI models to talk to the restaurant's customer and take the order:
- In voice orders, the audio is sent to services that convert speech to text and text to speech, and to a language model. Telephone calls are recorded; this is announced by voice at the start of the call.
- On WhatsApp, the message content is sent to a language model.
- To recognise you and suggest "the same as last time?", the assistant may use your previous orders at that branch (including products and delivery address) and addresses you have used at branches of the same business; this information also goes to the language model. Orders from food platforms are not included in this history. The address list and allergy information you have saved to your Aidisyon customer account are not sent to the assistant.
- Customer personal data in orders from food platforms is not sent to AI models.
- The AI output does not make an automated decision that produces legal effects concerning a person; the order appears in the restaurant's panel and is managed by the restaurant.
- Voice is not used to recognise or verify a person (voiceprint/biometrics).
- With the AI providers we use, terms providing that the data is not used for model training are preferred.
6. Who we share it with#
We do not sell data. We share it only to the extent necessary to provide the service, with these groups of recipients:
| Recipient | Why | Location |
|---|---|---|
| Hosting and backup (OVH) | servers, database, encrypted backups, media | Italy (EU) |
| Network and security (Cloudflare) | domain name, traffic routing, attack protection | based in the USA, global |
| SMS and telephone line (Verimor) | verification code, order notification, voice ordering line (recipient number and message text) | Türkiye |
| E-mail (Resend) | verification and notification e-mails | based in the USA; EU (Ireland) region |
| WhatsApp (Meta Platforms) | messaging with the restaurant's WhatsApp Business number | USA / Ireland |
| Login services (Google, Apple) | "Sign in with Google", "Sign in with Apple" | USA |
| Maps (Google Maps Platform) | finding the address on the map, calculating the delivery zone | USA |
| AI providers | speech-to-text, language model, text-to-speech | USA / EU |
| Backup language model (DeepSeek) | continuing the telephone order conversation when the main language model does not work (WhatsApp conversations do not go to this provider); in that case the conversation content (including name, telephone, address, order) goes to this provider | China |
| Error monitoring (Sentry) | technical error logs (personal data is masked) | EU (Germany); company based in the USA |
| Site analytics (Microsoft Clarity) | usage recording only for site visitors who consent; IP address for location estimation | Ireland and USA |
| Internal instant notifications (Telegram) | notifying our team of new applications and system alerts (for applications: business name, province/district, partially hidden telephone) | abroad |
| Food platforms (Trendyol Go, Yemeksepeti, Migros Yemek) | exchanging orders and menus with the platform the restaurant has connected | Türkiye |
| Payment and e-invoice services | subscription payment and invoice (when the subscription starts) | Türkiye |
| Authorised public institutions | where required by law | Türkiye |
End customer data is shared with the restaurant the order relates to; one restaurant's customer data is not shown to another restaurant.
7. Transfer abroad#
Our servers are located in the European Union (Italy); the service providers whose location is abroad in the table above also access the data. Personal data is therefore transferred abroad. Which data goes to which recipient, for what purpose and to which country is set out in the table above; the transfer is limited to these purposes.
8. How long we keep it#
| Data | Period |
|---|---|
| Business user account data | as long as the account is open; after closure, deleted or anonymised at the end of the legal periods below |
| Invoices and commercial records | 10 years (Turkish Commercial Code and tax legislation) |
| Transaction security logs | 1 year (Law No. 5651) |
| Consent records | as long as the consent remains valid and 10 years thereafter (general limitation period) |
| Telephone number and note in the callback list | deleted after 90 days |
| Call audio recordings | deleted after 90 days (during the call, the telephone line goes to Verimor and to the voice services that convert speech to text/text to speech and to the language model — see §6) |
| Call transcripts (written form of the conversation) | completely deleted after 90 days |
| Raw data from platforms (Trendyol Go, Yemeksepeti, Migros Yemek) and WhatsApp | cleared of personal fields after 30 days |
| In platform orders, the link between the customer ID provided by the platform and the restaurant's customer record | deleted if the customer does not order for 2 years |
| Customer personal information in platform orders (name, telephone, address) | deleted after 30 days; the order record remains without personal information |
| Other end customer orders (QR, online, telephone, WhatsApp, panel) — amount and items | 10 years (the restaurant's commercial record obligation) |
| Name, telephone, address in these orders | anonymised after 2 years |
| End customer profile | the profile of a customer who has not ordered for 2 years is anonymised |
| WhatsApp message texts | completely deleted after 90 days; only the message count, time and charge record remain. The chat in the restaurant's own WhatsApp app is not affected |
| WhatsApp conversations before the account is connected | not stored |
| SMS sending records (recipient number, text) | after 90 days the recipient number is masked and the text deleted |
| Text of login code (OTP) SMS messages | not stored |
| Name, telephone, district, note in a "Biz sizi arayalım" ("We'll call you") application | deleted after 180 days; the business name, province and outcome of the application remain for sales statistics |
| Microsoft Clarity session recordings (only those who consent) | 30 days at Microsoft; recordings sampled by Microsoft and marked recordings up to 9 months |
End customer data is stored on behalf of the restaurant and on its instructions; the end customer may request deletion before these periods at any time (§12). Data whose period has expired is deleted, destroyed or anonymised periodically (at least every 6 months).
9. Security#
We take technical and organisational measures such as encryption in transit (HTTPS), storing secrets (API keys, access tokens) encrypted in the database, keeping passwords as irreversible hashes, authorisation and role control, separation of data between businesses, masking personal data in logs, encrypted backups and access logging. Without logging in, the order tracking link shows only the restaurant name, the order status and the estimated time; order details and personal information are shown after telephone verification. In the event of a data breach, we notify the Board and the persons concerned as provided for in the KVKK.
10. Sign in with Google and Apple#
If you use "Sign in with Google" or "Sign in with Apple", we receive from these services only the basic information needed to verify your identity: user ID, name and e-mail address. From Google we request only the openid, email and profile permissions.
- We use Google user data only for login and to recognise your account; we do not use it for advertising, do not sell it and do not use it to train AI models.
- Aidisyon's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
- If you use Apple's "Hide My Email" option, we reach you at the relay address provided by Apple.
- You can remove the connection at any time in your Google or Apple account settings.
11. Your rights (KVKK Article 11)#
You have the right to learn whether your personal data is processed, to request information if it has been processed, to learn the purpose of processing and whether it is used in accordance with its purpose, to know the third parties to whom it is transferred, to request rectification if it is incomplete or inaccurate, to request its erasure or destruction and to request that these be notified to the third parties to whom it was transferred, to object to a result against you arising from analysis exclusively by automated systems, and to claim compensation if you suffer damage due to unlawful processing.
Application: to kvkk@aidisyon.com, by registered electronic mail (KEP) to meachteknoloji.ltd@hs01.kep.tr, or in writing to our address above. We conclude your application free of charge within 30 days at the latest (if the process requires an additional cost, the fee set by the Board may apply).
12. Deletion of your data#
- Business user: you can close your account with the "Hesabımı sil" ("Delete my account") option in the panel or by writing to kvkk@aidisyon.com. After the deletion request your account remains "pending deletion" for 30 days; during this period you can cancel your request by logging in. At the end of 30 days your data, except records subject to a legal retention obligation, is permanently deleted or anonymised; in transaction records that must be retained, your name appears only with its initial in the form "M. (silinmiş kullanıcı)" ("M. (deleted user)"). If you are the sole owner of the business, you must first transfer ownership or close the business account; when the business account is closed, the closure takes effect immediately, the data can be downloaded for 30 days and is then deleted or anonymised (details in Terms of Use §13).
- End customer: apply to the restaurant you ordered from or write to us; we forward your request to the restaurant and delete on the restaurant's instructions.
- If you corresponded via WhatsApp: you can write "delete my data" to the restaurant or to us; the same process applies.
13. Children#
Aidisyon is intended for businesses; the business account is not for persons under 18.
14. Changes#
We may update this policy. We announce important changes in the panel or by e-mail; where necessary we ask for your consent again. The date of each version is written at the top of this page.
15. Contact#
kvkk@aidisyon.com · MEACH TEKNOLOJİ VE DANIŞMANLIK LTD. ŞTİ., Çınarlı Mah. 1572 Sokak No:33, 35170 Konak / İzmir · KEP: meachteknoloji.ltd@hs01.kep.tr
The Turkish text is authoritative.
Versions
- Version 1.3 — 9 October 2026 (current)
- Version 1.2 — 27 September 2026
- Version 1.1 — 26 September 2026
- Version 1.0 — 26 September 2026