Privacy

If you ask for a demo

The form on the demo page stores, in our database:

• Full name, restaurant or brand name, email, phone number and city.
• Number of branches (1, 2–5 or 6+) and an optional short note.
• Which button on our site you came from, a status, and the date and time.

We use this only to contact you about Serva, and the founder sees it in the admin panel. The founder is also notified instantly through Telegram with your name, restaurant, email, phone, city and note. To limit spam we also keep short-lived counters tied to one-way (keyed hash) fingerprints of your email and phone, and of your network address where the hosting platform provides it. They are deleted automatically after about 25 hours.

If you visit our website

To understand how our site is found, we record the page visited, the language, the country, the device type and the referring site without using cookies; we do not store your IP address. If you submit the trial or sign-up form, the source from your first visit to our site (the referring site and campaign tag) is added to your record through a first-party cookie kept for 30 days. The “How did you hear about us?” question is optional.

If you open a restaurant menu

Menus record anonymous usage events so the restaurant can see what guests look at. An event holds only:

• The type: menu opened, category or dish viewed, a search or filter used, or a Servito action.
• The menu, category or dish ID, the language, and the time.
• For Servito: the kind of question (for example allergen or recommendation), never its text.

The event itself has no name, email, IP address or cookie ID, and what you type into search is not recorded.

If you talk to Servito (AI advisor)

• What you type (up to 500 characters), up to the last 6 messages of the conversation, and your language are sent from our server to Anthropic’s AI API (Claude) to understand your request. If Claude is unavailable, NVIDIA’s AI API is used as a backup.
• To write the answer, your question and the menu facts of matching dishes (name, description, price, dietary tags, allergens) are sent to the same provider as well.
• We do not save the conversation in our database. It stays in your browser tab and is gone when you close it.
• We keep a request counter per menu and anonymous session (20 questions per 15 minutes) to stop abuse.

You do not need to type your name or any other detail about yourself. Anthropic and NVIDIA handle what they receive under their own terms; how long they keep it is not something we have defined or verified. Servito is an AI assistant and can be wrong: confirm allergens with restaurant staff.

Allergy and dietary information

If you tell Servito about an allergy or a diet (for example “no gluten”), this can be information about your health. It is used only to answer you in that conversation: it is sent to the AI provider with your question, it is not saved in our database, and it is gone when you close the tab. You can also simply ask the restaurant staff instead.

If you use automatic translation, photo adaptation or menu import (AI)

• Automatic menu translation: the menu texts you choose to translate are sent from our server to Anthropic (Claude API). Translations are machine-made and the restaurant can edit them.
• Photo style adaptation: the dish photos you choose and the restaurant’s style reference photos are sent to Google (Gemini API), which may regenerate the dish image in your style. The restaurant reviews and approves each result before it is published.
• Menu import: the menu photos and PDF pages the restaurant uploads are sent to Google (Gemini API), whose AI models read the dishes, prices and categories. The restaurant checks the result before a draft menu is created. The pages are kept in private storage with the restaurant’s account. Menu import uses Google’s paid API, and Google’s terms for that paid API apply.

Please do not put personal details in menu texts, photos or uploaded menus. Anthropic and Google handle what they receive under their own terms.

If you subscribe or pay

Payments are handled by our payment provider, which acts as Merchant of Record (reseller) for your purchase. The payment provider collects your card or other payment details, billing name, email, country and (for businesses) tax details at checkout, and is the seller of record that issues your invoice. We never see or store your card number.

The payment provider tells us, through signed webhooks, what we need to run your subscription. We store:

• Your payment provider customer ID, email and name.
• Your subscription: plan, billing period (monthly or yearly), status, renewal and cancellation dates, add-ons.
• Each payment and refund: date, amounts, currency, tax and invoice number (no card data).
• The partner link you arrived through, if any (see Cookies below).

If you buy before your restaurant has a Serva account, we keep this as a pending sign-up until we link it to your restaurant. We use it to provide the service, to support you, to meet accounting obligations and, for the partner link, to credit the person who introduced Serva to you.

Cookies and browser storage

• serva_ref (30 days): set only when you open a link that contains a partner name (for example ?ref=name). It records that name so the partner who introduced Serva is credited if you subscribe. It holds no personal data.
• serva_src (30 days, HttpOnly): remembers which site or campaign first brought you to us (and the first page). It is added to your record only if you submit the trial or sign-up form, and it holds no personal identifier.
• serva-landing-language (1 year): your TR/EN choice on this site.
• serva-menu-language-… (1 year): the language you picked for a menu.
• serva_advisor_session (1 hour, HttpOnly): a random ID set when Servito first answers, used only for the request counter.
• Business sign-in only: a session cookie (up to 8 hours, 1 hour of inactivity). Auth0 may also set its own cookies on its login pages.
• Session storage in your browser holds the Servito conversation until you close the tab. Signed-in panels also keep display settings and unsaved form drafts in local storage.

We do not use advertising or analytics cookies.

Business accounts

Business users sign in through Auth0. We keep the account identifier, email and display name Auth0 gives us to decide what you may access. Menu content, photos and models you upload are stored for your restaurant and shown on its public menu.

When the owner invites someone to the panel (Team), we store the invited email address, the role and, for a branch manager, the branch, and we email the invitation link to that address. The owner sees who has access and can take it back at any time; access then ends at once.

Download your data and delete your account

The restaurant’s owner can do both in the business panel, under My account → Your data, without writing to us.

• Download: one ZIP file with every menu and all its translations, the dish photos, the team list and the subscription and payment records, in common formats (JSON, CSV and image files). The 3D models and AR files belong to Serva and are not included (see the Terms).
• Delete: after a confirmation, the subscription ends at once, guests can no longer open the menu and nobody can sign in to the account. We then erase the account’s data within 30 days. Billing records are kept as long as the law requires.

You can still write to founder@servamenu.com for either; we answer within 30 days.

Who handles data for us

• Netlify: hosts the website and its API and sees ordinary request data such as IP address.
• Neon: PostgreSQL database, in Frankfurt (Germany).
• Cloudflare: R2 file storage, and a Worker that serves public demo images and 3D files.
• Auth0: business sign-in.
• Anthropic: Claude API, for Servito and automatic menu translation.
• NVIDIA: backup AI for Servito when Claude is unavailable.
• Google: Gemini API, for photo style adaptation and menu import.
• Dodo Payments, our payment provider (Merchant of Record): payments, invoices, taxes and refunds. It also sets its own cookies inside the checkout window and handles your data under its own privacy notice.
• Telegram: instant notification to the founder of demo requests (name, restaurant, email, phone, city, note).
• Zoho Mail: email at founder@servamenu.com.

Some of these providers process data in the EU, the US and other countries. We are working to make these transfers in line with the methods in Article 9 of the KVKK; you can ask us at founder@servamenu.com for the details and for the providers’ own safeguards. We do not sell personal data.

Who is responsible for your data (KVKK)

The data controller (veri sorumlusu) for the website, the demo form and the Serva service is Serva, run in Türkiye by Barış Aydın, a private individual. Contact: founder@servamenu.com, 0544 868 53 47. Our postal address is provided on request. For payment data, the payment provider is a separate controller of its own records.

We process data to run the service you asked for (performing a contract or taking steps before one), to meet legal and accounting obligations, and for our legitimate interests in keeping the service secure and in contacting people who asked about it.

How long we keep data, and your rights

We keep data for these periods:

• After a subscription ends: restaurant menu content and media for 90 days, so you can come back, then they are deleted.
• 3D models made during a free trial that did not become a subscription: kept in an archive with no end date and hidden from guests; they come back as soon as the restaurant subscribes.
• After the owner deletes the account: everything is erased within 30 days.
• Team invitations: until they are accepted, taken back or expire (14 days).
• Demo requests: 12 months.
• Billing records: as long as Turkish accounting and tax law requires (up to 10 years).
• Counters, cookies and sign-in sessions: they expire on their own as listed above.

Under Article 11 of KVKK you may ask whether we process your data, what for, and who receives it; ask for correction or deletion; object to a result against you; and claim compensation for damage from unlawful processing. Write to founder@servamenu.com and we will tell you what we hold about you and correct or delete it where the law allows. You can also complain to the Personal Data Protection Authority (KVKK Kurulu).

If you are in the European Union or the European Economic Area, the GDPR also gives you the rights of access, correction, erasure, restriction, objection and data portability (your data in a common, machine-readable format, which the download above provides), and you may complain to the data protection authority where you live or work.