Privacy Policy
This English text is a translation provided for convenience. Where the Turkish version differs, the Turkish version prevails for users in Türkiye.
- Controller: Hasan Akgül (Pingel).
- We process account data of business owners and staff, the business's order/checkout records and customer data entered by the business; the business is the controller for its customers' data.
- We do not sell your data; advertising and analytics cookies run only with your consent.
- To exercise your rights: [email protected]
Who we are
Masip POS is a cloud-based ordering, kitchen display (KDS), checkout, stock and management system for restaurants, cafés and similar businesses; it runs in the browser and as a mobile app. This policy applies to the service provided at masippos.com and related apps.
| Data controller | Hasan Akgül (an individual developing software products under the Pingel brand; “Pingel”) |
|---|---|
| Location | Istanbul, Türkiye |
| [email protected] | |
| Web | pingel.dev |
What we process and why
The table below lists the categories of data we process, why, the legal basis under Turkish law (KVKK) and how long we keep it. Legal bases for other regions are in the section for your region below.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data Name, e-mail, phone, role, PIN (hashed) and sign-in times of owners and staff | Creating your account, signing you in, providing the service and service notices | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | While your account is open; within 30 days after deletion |
| Business and transaction records Business name, address, tax details; menu, tables, bills, orders, payments, cash and stock movements | Providing the POS service, reporting, backing up data | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | During the subscription; 30 days for export after it ends, then deletion |
| Data about the business's customers Customer name, phone, address, order history, points/coupons entered by the business | Running orders and loyalty on the business's behalf (as processor) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | As instructed by the business; deleted 30 days after the subscription ends |
| AI inputs Smart Waiter spoken-order transcript, menu photo/text | Turning spoken orders and menus into structured data (Google Gemini) | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | Processed at the time of the request; raw audio is not stored |
| Device and notification data Device ID, printer pairings, push token | Kitchen/printer routing and sending notifications | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)) | Until the device is removed |
| Payment and billing data Name/organisation, phone, e-mail, chosen plan, amount, reference code, payment notice date, sender name/IBAN (from the bank statement) | Taking the purchase request, matching the bank transfer, activating the plan, keeping income and accounting records | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Compliance with a legal obligation (KVKK Art. 5(2)(ç)) | 10 years under Turkish tax and commercial law |
| Agreement and consent records Documents you accepted, their versions, date and time | Proving that the agreement was concluded and you were informed | Necessary to conclude or perform a contract (KVKK Art. 5(2)(c)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 10 years after account closure (limitation period) |
| Contact and support Name, e-mail, message content | Answering your questions and requests | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Establishment, exercise or protection of a right (KVKK Art. 5(2)(e)) | 2 years after the conversation ends |
| Technical and security logs IP address, browser/device info, request time, error logs | Running the service, keeping it secure, preventing abuse and attacks, obligations under Law No. 5651 | Our legitimate interests, provided your fundamental rights are not harmed (KVKK Art. 5(2)(f)); Expressly provided for by law (KVKK Art. 5(2)(a)) | Hosting provider logs 30 days; records under Law 5651 for the statutory period (1–2 years) |
| Usage statistics Pages visited, session duration, approximate location (country/city), device type, cookie ID | Anonymised statistics to improve the site (Google Analytics) — only if you consent | Your explicit consent (KVKK Art. 5(1)); you may withdraw it at any time | 14 months in Google Analytics |
We do not ask for sensitive data such as national ID numbers, health, religion or biometrics; please do not enter them in free-text fields either.
Voice ordering (Smart Waiter)
Smart Waiter listens to what the waiter says into the microphone only to resolve the current order. Speech is converted to text by the device's or browser's own speech recognition service (e.g. Google in Chrome, the device service on Android); the resulting text is sent to Google Gemini to turn it into an order. We do not store or listen to recordings; the text is discarded once added to the bill.
Google Analytics runs only on public marketing and blog pages, and only with your consent. POS screens and the mobile app use no analytics; your orders, revenue and customer data are never sent to analytics.
How we collect data
We collect personal data electronically, partly by automated means, through the forms you fill in, the actions you take in your account, the e-mails you send us and the technical information your browser or device sends automatically (including cookies and similar technologies).
Who we share data with
We do not sell or rent your data to anyone for their own purposes. To run the service we share data only with the following providers, and only as far as their service requires:
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase / Google Cloud (Google Ireland Ltd., Google LLC) | Hosting, authentication, database, server functions | EU and/or US data centres |
| Google Gemini API (Google LLC) | AI features: the text or transcript you submit is processed | United States |
| Firebase Cloud Messaging (Google) | Push notifications (if you allow them) | EU and/or US |
| Google reCAPTCHA / Firebase App Check | Bot and abuse protection | United States |
| E-posta hizmet sağlayıcısı (SMTP) | Transactional e-mail | EU and/or US |
| Banks | Receiving and verifying bank-transfer payments | Türkiye |
| Google Analytics 4 (Google Ireland Ltd., Google LLC) | Visit statistics — only with your consent | EU and/or US |
We also disclose information to competent public authorities and courts only where there is a lawful request or legal obligation.
International transfers
Some of the providers above process data on servers outside Türkiye (in the EU, the US and other countries). Under Article 9 of the KVKK these transfers rely on appropriate safeguards such as standard contracts and the providers' data processing terms, and, for occasional transfers where these cannot be used, on the cases in Article 9(6) (necessity for the performance of a contract or explicit consent). For users in the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
How long we keep data
We keep data for the period stated in the table above or, if none is stated, for as long as the purpose requires. We then delete, destroy or anonymise it. Copies in backups are removed within the backup cycle (at most 35 days). Payment records that tax and commercial law require us to keep are retained for the statutory period (up to 10 years).
Security
Connections are encrypted with HTTPS; database access is restricted by roles and rules; administrative access is kept to a minimum and logged. No system is perfect; if a breach affects your personal data we will notify the competent authority and you as required by KVKK Art. 12(5) and GDPR Arts. 33–34.
Children
Masip POS is a service for businesses; it is not intended for people under 18 to open accounts.
Cookies
The cookies we use and how to change your choice: Cookie Policy
Your rights — by region
The section for your location opens automatically; you can open any section. Wherever you are, you can write to [email protected] for any request; we reply free of charge within 30 days.
Türkiye — KVKK (Law No. 6698)
Under Article 11 of the KVKK you may ask whether your data is processed, request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, request correction, deletion or destruction (under Art. 7) and notification of these to recipients, object to an adverse result arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.
Send your request from the e-mail address registered with us to [email protected], or in writing. We reply free of charge within 30 days. If you are not satisfied you may complain to the Turkish Personal Data Protection Board. Details: KVKK Privacy Notice (Türkiye).
European Union / EEA, United Kingdom and Switzerland — GDPR
In these regions your data is protected under the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss FADP. Our legal bases are:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data Name, e-mail, phone, role, PIN (hashed) and sign-in times of owners and staff | Creating your account, signing you in, providing the service and service notices | Performance of a contract (GDPR Art. 6(1)(b)) | While your account is open; within 30 days after deletion |
| Business and transaction records Business name, address, tax details; menu, tables, bills, orders, payments, cash and stock movements | Providing the POS service, reporting, backing up data | Performance of a contract (GDPR Art. 6(1)(b)) | During the subscription; 30 days for export after it ends, then deletion |
| Data about the business's customers Customer name, phone, address, order history, points/coupons entered by the business | Running orders and loyalty on the business's behalf (as processor) | Performance of a contract (GDPR Art. 6(1)(b)) | As instructed by the business; deleted 30 days after the subscription ends |
| AI inputs Smart Waiter spoken-order transcript, menu photo/text | Turning spoken orders and menus into structured data (Google Gemini) | Performance of a contract (GDPR Art. 6(1)(b)) | Processed at the time of the request; raw audio is not stored |
| Device and notification data Device ID, printer pairings, push token | Kitchen/printer routing and sending notifications | Performance of a contract (GDPR Art. 6(1)(b)) | Until the device is removed |
| Payment and billing data Name/organisation, phone, e-mail, chosen plan, amount, reference code, payment notice date, sender name/IBAN (from the bank statement) | Taking the purchase request, matching the bank transfer, activating the plan, keeping income and accounting records | Performance of a contract (GDPR Art. 6(1)(b)); Legal obligation (GDPR Art. 6(1)(c)) | 10 years under Turkish tax and commercial law |
| Agreement and consent records Documents you accepted, their versions, date and time | Proving that the agreement was concluded and you were informed | Performance of a contract (GDPR Art. 6(1)(b)); Legitimate interests (GDPR Art. 6(1)(f)) | 10 years after account closure (limitation period) |
| Contact and support Name, e-mail, message content | Answering your questions and requests | Legitimate interests (GDPR Art. 6(1)(f)); Legitimate interests (GDPR Art. 6(1)(f)) | 2 years after the conversation ends |
| Technical and security logs IP address, browser/device info, request time, error logs | Running the service, keeping it secure, preventing abuse and attacks, obligations under Law No. 5651 | Legitimate interests (GDPR Art. 6(1)(f)); Legal obligation (GDPR Art. 6(1)(c)) | Hosting provider logs 30 days; records under Law 5651 for the statutory period (1–2 years) |
| Usage statistics Pages visited, session duration, approximate location (country/city), device type, cookie ID | Anonymised statistics to improve the site (Google Analytics) — only if you consent | Consent (GDPR Art. 6(1)(a)) | 14 months in Google Analytics |
Your rights: access, rectification, erasure (“right to be forgotten”), restriction, data portability, objection to processing based on legitimate interests and to direct marketing, withdrawing consent at any time, and not being subject to solely automated decisions. You may lodge a complaint with the data protection authority in your country. We have no EU representative; you can contact us directly at [email protected].
United States — California (CCPA/CPRA) and other states
In the last 12 months we collected personal information in the categories listed in the table above, from the sources and for the purposes shown there. We do not sell your personal information and we do not use sensitive personal information to infer characteristics about you. Advertising cookies run only with your consent; without it no data is shared for targeted advertising.
Under the laws of California, Colorado, Virginia, Connecticut, Utah, Texas, Oregon and similar states you have the right to know/access, correct, delete, obtain a portable copy and opt out of sale/sharing or targeted advertising. We will not discriminate against you for exercising these rights. We honour the Global Privacy Control (GPC) signal as an opt-out request. Send requests to [email protected]; you may also use an authorised agent, and we will reasonably verify your identity.
Brazil — LGPD
Under the Lei Geral de Proteção de Dados (LGPD) you may confirm processing, access, correct, anonymise, block or delete data, obtain portability, learn with whom data is shared, withdraw consent and complain to the ANPD. Our legal bases are the same as in the GDPR section (contract, legal obligation, legitimate interests, consent). Requests: [email protected].
Canada — PIPEDA
You may access and request correction of your personal information and withdraw consent. Your information may be processed outside Canada and be accessible to authorities there. Please raise concerns with us first ([email protected]), then with the Office of the Privacy Commissioner of Canada.
India — DPDP Act 2023
Under the Digital Personal Data Protection Act you may obtain a summary of the data processed, request correction and erasure, have grievances redressed and nominate a person to exercise your rights. Grievance contact: [email protected]. If you are not satisfied you may approach the Data Protection Board of India.
Other countries
The laws of your country may give you additional rights. Wherever you are, you can ask us at [email protected] to access, correct or delete your data or to withdraw consent. We reply within the period required by local law and at most 30 days.
Changes
We may update this policy. We announce material changes on the site and notify account holders. The date and version at the top show the current text.
Contact
For any privacy question or request: [email protected]