Privacy policy

This is a translation; only the German version is legally binding.

This policy explains which personal data we process when you use the MeLocaly app, the MeLocaly dashboard for venues (panel.melocaly.com) or our website melocaly.com, why we do it and what rights you have.

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Bambu Games Yazılım Sanayi ve Ticaret A.Ş.
Altınşehir Mah. Muammer Aksoy Cad. Bina No:79 Neva Suite No:84
16230 Nilüfer/Bursa
Türkiye
Email: [email protected]

For any question about data protection, write to us at [email protected].

2. In brief

• We process data only as far as MeLocaly needs it, the law requires it or you have consented.
• We do not sell data, show no ads and use no analytics or tracking tools.
• Our servers are in Frankfurt am Main; photos, images and backups are kept in data centres in the EU. We ourselves are based in Turkey (section 17).

3. Account and sign-in

For your account we store your email address, your phone number (required when you sign up with email), your password (only as a hash, never in plain text), your first and last name, your language and your profile picture (an emoji on a background colour). Your date of birth is optional; we only use it so that venues can credit you birthday points.

To confirm your email address and to reset your password we send you a code. It is valid for 15 minutes; we store it only as a hash and delete it one day after it expires.

If you choose “Sign in with Apple”, Apple sends us an identifier of your Apple account, your email address (if you wish, an anonymous relay address from Apple) and, at the first sign-in, your name. Apple’s privacy policy applies to the processing at Apple.

The purpose is to provide your account and the features of MeLocaly; the legal basis is Art. 6(1)(b) GDPR (contract of use). We keep the data until you delete your account. Sign-ups whose email address was not confirmed are deleted 30 days after sign-up.

For each sign-in we store a record with its time and validity. We use it to renew and end sign-ins, and to count how many users actively used MeLocaly in a period. The legal basis is Art. 6(1)(b) and (f) GDPR; our legitimate interests are the security of accounts and statistics on use. We delete these records 180 days after they were created.

4. Storage on your device

The app keeps your sign-in keys and settings such as language, appearance, the chosen mode and the radius for offers in your device’s protected storage (iOS Keychain or Android Keystore). A sign-in key is valid for 15 minutes, the key that renews the sign-in for 30 days. This storage is strictly necessary for the use you request (§ 25(2) no. 2 TDDDG).

The app contains no advertising or analytics services. It sends push notifications only with your permission (section 11).

If the app closes on an error, it sends the error message and its technical details, the screen it happened on, its own and the operating system’s version and the device model to our server. We use this report only to fix the error, without linking it to your account, and delete it after 30 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is an app that works properly.

5. Location

If you allow it, the app determines your location while you use it and sends it with the request to our server, so that we can sort venues and offers by distance. We neither store nor log your location. The app never asks for your location in the background.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give through your device’s location permission and can withdraw there at any time. Without it you can keep using the app; distances and the list of offers near you are then left out.

6. Camera and photos

The app uses the camera only to scan QR codes (venue, table, reservation; in business mode also customers’ QR codes). The images are read only on your device and are neither stored nor sent.

You choose photos through the system photo picker; the app receives only the photo you add to a review. Before uploading, the app removes the photo’s metadata (Exif), including where it was taken. The legal basis is Art. 6(1)(b) GDPR.

7. Venues, points and rewards

When you scan a venue’s or a table’s QR code, you connect to that venue. We store the connection with its time, your point balances and every points entry (type, amount, time, any note and the person who made it). Your personal QR code for points is valid for 120 seconds and is not stored. Section 12 describes what the venue sees about you.

If a venue uses member tiers (Bronze, Silver, Gold, Platinum), we work out from the points you earned there in the current period which tier you have reached. When the period ends, this count starts again; your point balance stays. When you reach a new tier, you get a notice.

You can disconnect from a venue at any time. We ask for a reason and, optionally, a note; the venue learns both and keeps them. If you wish, we also delete your reviews, reservations, points entries, balances and messages of that venue.

The legal basis is Art. 6(1)(b) GDPR.

8. Orders and bills at the table

At the table you can order rounds (items, quantities, optional notes) and ask for the bill, including the payment method you want to use. We store orders, bill requests, table moves and bills (amounts, payment method, cash and card split, who paid). You pay at the venue; MeLocaly processes no payment or card data.

Guests at the same table see the table’s rounds (not who ordered them) and bill requests with the short name (“First L.”) and payment method.

If you ask, we email you a receipt. Staff can also send a receipt to an address you give them; we do not store that address. The receipt shows the venue’s logo, which is loaded from our server when you open it.

The legal basis is Art. 6(1)(b) GDPR. We keep bills and orders for the venues, which are subject to statutory retention duties, usually for up to ten years (Art. 6(1)(c) and (f) GDPR).

9. Reservations

For a reservation we store date, time, party size, your optional note, the status (e.g. confirmed, declined, cancelled, no-show), a check-in code and any message from the venue. The venue sees your name, phone number, email address and language, so it can reach you with questions. The legal basis is Art. 6(1)(b) GDPR.

Notes in reservations and orders are optional and go to the venue. Please only write what the venue needs to know.

10. Reviews, reports and blocks

You can rate venues and products with stars and optionally add a text and a photo. Reviews are visible to all app users, with your short name (“First L.”), your profile picture and, if the venue uses member tiers, your current tier there; photos can be opened through their web address without signing in. Who marked a review as helpful is not shown. The venue can reply publicly. An automatic filter turns down texts with offensive words.

You can report other people’s reviews (with a reason and an optional note) and block people; you then no longer see their reviews. Reports and blocks reach only the MeLocaly team, not the person concerned and not the venue. We review them, hide unlawful or objectionable content and may suspend accounts.

The legal basis is Art. 6(1)(b) GDPR, and for moderation also Art. 6(1)(c) GDPR together with the Digital Services Act and Art. 6(1)(f) GDPR (protecting users and venues from unlawful and objectionable content). We keep reviews until you delete them or your account; reports as long as the reported review exists, at most until your account is deleted; blocks until you lift them or delete your account.

11. Messages in the app

Your inbox shows notices about your reservations and points, and messages from the venues you are connected to. Venues can message all connected customers or groups of them (e.g. new customers, customers above a number of points, customers who have not visited in 30 days). Once you disconnect, you get no more messages from that venue. The legal basis is Art. 6(1)(b) GDPR.

If you allow it, these messages also reach your phone as push notifications. The app asks when you first connect to a venue; you can also allow it later in the app’s settings. For this we store a push token with your account, through which the push service reaches your device; the app also keeps it in your device’s protected storage. The token is deleted when you sign out, delete your account or your device stops accepting notifications. In the app you can switch off venue announcements and notices about reservations, points and orders separately, and all of them in your phone’s settings; they stay in your inbox either way. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw in these ways at any time.

12. What venues see about you

While you are connected to a venue, its owner and staff see, depending on their permissions:

• when they scan your QR code or search at the counter: your first and last name, the last four digits of your phone number, your profile picture, your point balance and any member tier at this venue, and bill points from the last 12 hours;
• the latest points entries with names;
• for reservations: name, phone number, email address, language, party size, note and status;
• at the table: your short name, your orders with notes, bill requests with payment method, and table moves;
• your reviews like all users, with short name, profile picture and any member tier;
• in reports: your short name with the number and time of your visits;
• notices that you connected or disconnected (with reason and note), and new reviews.

Venues do not see your date of birth, although a birthday credit shows the day. They see your full phone number and email address only for reservations.

Venues receive this data so you can use their services (Art. 6(1)(b) GDPR). For their own processing, such as keeping bills under tax law, the venues are responsible themselves.

13. Deleting your account

You can delete your account in the app at any time (Profile → Edit profile → “Delete my account”) or write to us at [email protected] from your account’s email address; we then delete it within a month. More under Delete your account.

We delete your name, email address, phone number, password, date of birth and profile picture, your sign-ins and the link to Apple, your inbox, your connections to venues and tables, your reviews with their photos, your helpful marks, and your reports and blocks. At the venues we delete the notices about you, the notes in your reservations, your notes on disconnecting, your name in logs of table moves and your email address in invitations. Upcoming reservations are cancelled and the venue is told.

Bills, orders, points entries and past reservations that venues must keep stay without your name and contact details, as do the reasons for disconnecting. If you worked for a venue, your name stays in its end-of-day reports, which are kept as accounting records. Your points lapse. If you own a venue, please hand it over first; write to us about it.

14. Dashboard for venues and the app’s business mode

For owners and staff of venues we process name, email address, phone number, password (as a hash), role and permissions. Owners see these details of their staff. We invite new venues by email; for this we store the email address, the venue’s name and how long the invitation is valid (14 days).

What a venue states about itself, such as its address, opening hours, phone and WhatsApp number, is shown to all users of the app.

We log important actions in the dashboard (e.g. bills, table moves, day closings) with the person who took them, so venues can trace their work. We store support requests to MeLocaly with their messages and up to three screenshots.

When a venue imports a menu, we send the uploaded file (PDF or image) or the text of the web page it names to OpenAI to read out categories, products and prices. It contains no guest data; we do not store the file. We turn venue addresses into coordinates with the OpenStreetMap Foundation’s Nominatim service; only the address is sent.

The dashboard keeps your sign-in keys and settings such as the appearance in your browser (local storage), and the language you chose in a cookie valid for one year. This storage is strictly necessary for the use you request (§ 25(2) no. 2 TDDDG).

The legal basis is Art. 6(1)(b) GDPR, and for logs Art. 6(1)(f) GDPR (traceability and security).

15. Website

When you open the website, our servers process technically necessary data such as IP address, time, the address requested and browser details to deliver the pages and protect them from attacks. We keep no access log. We pick the language from your browser’s language setting without storing it. The legal basis is Art. 6(1)(f) GDPR (secure and stable operation).

The website sets no cookies, uses no analytics or advertising services and loads no content from third parties; we serve the fonts ourselves. Our service provider Cloudflare may set technically necessary cookies to protect against attacks.

When you send the contact form for venues, we store name, the venue’s name and type, phone number, email address, city, your message, the page language and, if you came through an ad, its campaign details from the address (utm parameters). The MeLocaly team is notified by email. The purpose is to handle your request and prepare a contract (Art. 6(1)(b) GDPR). We delete requests 24 months after they arrive, or earlier if you ask.

16. Emails

We send emails through the Resend service from its EU region: codes, receipts, invitations and notices to the MeLocaly team (e.g. about support requests, contact requests and reported reviews). We send no advertising emails.

When you write to us at [email protected], we process your message to answer it (Art. 6(1)(b) or (f) GDPR). A provider in Turkey (mnic.tr) runs this mailbox for us.

17. Recipients and service providers

The following service providers process data on our behalf (Art. 28 GDPR):

• Amazon Web Services EMEA SARL, Luxembourg (servers in Frankfurt am Main): running the app server, database, dashboard and website;
• Cloudflare, Inc., USA: delivering and protecting all MeLocaly addresses (proxy, TLS encryption) and storing photos, images and database backups in data centres in the EU. As a proxy, Cloudflare processes IP addresses and request data, including location details in the app’s requests;
• Resend, USA (sending from its EU region): email delivery;
• 650 Industries, Inc. (Expo), USA: delivering push notifications through Apple Push Notification service or Google’s Firebase Cloud Messaging;
• OpenAI, USA: reading menus during import (venue data only);
• mnic.tr, Turkey: the mailbox [email protected].

Data also goes to the venues you are connected to (section 12), to the OpenStreetMap Foundation, United Kingdom (venue addresses only), and to Apple if you sign in with Apple. When you download the app, Apple or Google process data under their own responsibility. Authorities receive data only where the law obliges us.

Where service providers are based in the USA or can access data from there, we base the transfer on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

We are based in Turkey and look after MeLocaly from there, so we access the data stored in the EU. There is no adequacy decision of the European Commission for Turkey. Where our service providers in the EU transfer data to us there, we base this on the EU standard contractual clauses (Art. 46(2)(c) GDPR); you can get a copy by writing to [email protected].

18. Security, logs and backups

All connections are TLS-encrypted. We back up the database every night to encrypted storage in the EU and delete each backup after 30 days, so deleted data also leaves the backups within 30 days.

Error messages of our server can in single cases contain an email address, for example when an email could not be delivered; these logs are overwritten continuously by size. To prevent abuse we count requests per IP address in memory only, for 60 seconds at a time. The legal basis is Art. 6(1)(f) GDPR (security and availability).

19. Retention at a glance

• account and profile: until the account is deleted;
• unconfirmed sign-ups: 30 days;
• codes sent by email: valid for 15 minutes, deleted one day after they expire;
• sign-in records: 180 days;
• location: not stored;
• crash reports: 30 days;
• contact requests from venues: 24 months;
• bills, orders and points entries: for the venues’ retention duties, usually up to ten years, without name and contact details once the account is deleted;
• backups: 30 days.

20. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)), the location permission for example in your device’s settings. Write to us at [email protected].

You can complain to a data protection supervisory authority, in particular in the member state where you live, work or where the alleged infringement took place (Art. 77 GDPR).

21. Right to object

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing the data unless we demonstrate compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims.

22. Other information

The details asked at sign-up are required for an account; without them we cannot provide the app. All other details are optional.

MeLocaly is meant for people aged 16 and over.

We make no decisions based solely on automated processing within the meaning of Art. 22 GDPR. The word filter for reviews only stops a text from being published; you can change it and send it again.

We update this policy when MeLocaly or the law changes. The version published here applies.