Legal
Privacy Notice
Last updated:
Data controller
Under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), the data controller is Berkay Recep Tekin (sole proprietorship, brand: Fincanda). Contact: iletisim@fincanda.com · Cibali Mah. Salihpaşa Cad. No: 53 İç Kapı No: 3, Fatih / İstanbul, Turkey.
This notice covers three groups: guests who scan a QR card at a café, staff of cafés that use Fincanda, and visitors of fincanda.com (including people who fill in the setup form).
Cafés do not process guests’ personal data in this flow and do not act as processors for Fincanda; Fincanda decides the purposes and means of processing guest data.
Café guests’ data
| Data | Why | How long |
|---|---|---|
| Cup and saucer photos | To write your story | Not stored. Held in memory only during the request. Google may keep limited logs for a short time to detect abuse. |
| The story text | To show you the story and measure quality | While the café uses the service. The text does not identify you. |
| Anonymous feedback (rating and optional text) | So the café can evaluate its service | While the café uses the service. The written part is deleted automatically 30 days after the café leaves; the rating stays as statistics that identify no one. |
| Device cookie (fal_cihaz, random ID) | To prevent excessive use from one device | 1 year in your browser; daily count on our server 7 days. |
| IP address | Security and blocking excessive requests | In the logs of our infrastructure provider Cloudflare, for its retention period. |
| Language preference (fal_dil) | To show pages in your chosen language | Only in your browser, 1 year. |
Please do not write your name, phone number or other identifying details in feedback. When taking photos, keep your face and other people out of the frame.
Fincanda is not intended for people under 18. Before a story starts you are asked to confirm that you are over 18.
Café staff data
| Data | Why | How long |
|---|---|---|
| Café name, phone, contact email, Google place ID | To set up and perform the contract, show the Google rating in the panel | During the contract and 10 years after it ends (Turkish Commercial Code art. 82). |
| Login email, password hash | Secure access to the panel | While the account is open. Passwords are never stored in plain text. |
| Session record and IP address | Account security | For the session, at most 30 days. |
| Failed login attempts (email, IP) | To stop password-guessing attacks | 1 day. |
| Balance and payment records | Accounting and invoicing obligations | 10 years (Turkish Commercial Code art. 82). |
Card details are entered on the page of the payment institution PayTR; Fincanda never sees or stores card details.
Site visitors and the setup form
Details you enter in the setup form (business name, location, contact name, phone, email, note) are not saved in our database; they are emailed to us so we can get back to you. To prevent form abuse your IP address is counted for 1 day.
We use Cloudflare Web Analytics for visit statistics. It uses no cookies and does not track you across sites.
Legal bases
Your data is processed on the following bases under KVKK art. 5(2):
- Writing and showing your story: necessary to perform the service you request (art. 5/2-c).
- Setting up and performing the contract with the café (art. 5/2-c).
- Invoices and accounting records: compliance with our legal obligations (art. 5/2-ç).
- Abuse prevention, security logs and the device cookie: our legitimate interests, provided your fundamental rights are not harmed (art. 5/2-f).
- Records needed to protect our rights in a dispute (art. 5/2-e).
Who receives the data
| Recipient | Purpose | Location |
|---|---|---|
| Google (Gemini API) | Writing the story from the photos | Abroad (USA) |
| Cloudflare | Hosting, security, email routing, visit statistics | Abroad (global network) |
| Microsoft (Outlook/Hotmail) | Mailbox for setup form and contact emails | Abroad |
| PayTR | Card payments for balance top-ups | Turkey |
| Accountant, Turkish Revenue Administration | Invoicing and tax (café data only) | Turkey |
| Competent authorities | Requests required by law | Turkey |
These are transfers abroad within the meaning of KVKK art. 9 and take place under the providers’ data processing agreements and security commitments. On the paid Gemini API, Google commits not to use submitted content to train its models.
Automated processing
The story is written automatically by an AI model. This is for entertainment; it makes no decision about you and has no legal or similar effect on you.
Your rights
Under KVKK art. 11 you may ask us:
- whether your personal data is processed and, if so, for information about it,
- the purpose of processing and whether it is used accordingly,
- which third parties in Turkey or abroad receive it,
- to correct incomplete or inaccurate data,
- to delete or destroy it under the conditions of KVKK art. 7,
- to notify recipients of any correction or deletion,
- to object to an outcome against you that results solely from automated analysis,
- for compensation if you suffer damage from unlawful processing.
How to make a request
Email iletisim@fincanda.com or write to the address above. State your name and your request clearly so we can verify you; if you are a guest, the card code and date help us find the record.
We answer free of charge within 30 days (KVKK art. 13). If you are not satisfied, you may complain to the Turkish Personal Data Protection Board (KVKK art. 14).
Changes
We update this notice when the way we process data changes. The current version is always on this page, with its date at the top.