Privacy Policy

Last updated on Oct 25, 2026

Welcome! We appreciate you choosing QRbox. This privacy policy and personal data protection notice outlines the types of data QRbox collects, how it is utilized, and the measures we take to protect it.

Information We Collect

When you visit QRbox or use our services, we may automatically gather certain information, or ask you to provide it. The types of information we may collect include, but are not limited to:

• Operating system used
• URLs of pages you visit
• Internet Protocol (IP) address
• Type and features of the device you are using
• Duration of your visit
• Areas interacted with on the site
• Type and version of your browser

This data helps us understand user interactions with our site, improve the website, and enhance the user experience.

Use of Cookies and Similar Technologies

QRbox may use cookies and similar tracking technologies. These tools are used to remember your preferences, analyze website performance, monitor user activities, and present targeted advertisements. You can modify your browser settings to accept or reject cookies, though disabling cookies might prevent certain features from functioning properly.

Third-Party Services and Links

QRbox may incorporate third-party services or provide links to external websites. Each of these third-party services or websites has its own privacy policies. We strongly encourage you to review and understand these policies, as we are not responsible for the content or practices of these third-party sites.

Data Protection

QRbox takes appropriate technical and organizational steps to ensure the security of the personal data we collect. We implement measures to prevent unauthorized access, alteration, or distribution of data.

How We Use and Share Your Data

The personal data we gather may be used for the following purposes:

• To personalize the user experience
• To respond to user inquiries and provide services
• To operate, enhance, and improve our website
• To communicate information regarding our content and services

Account and Menu Information

When you create a QRbox account and use it, we store:

• Your name and email address
• Your password, kept only in hashed form, so that nobody, including us, can read it
• Your phone number and country, if you give them
• The menus you create: their content, photos you upload, settings and languages
• Your subscription status. Payments are handled by our payment provider, Lemon Squeezy; we do not receive your card details
• Records of your sign-ins (IP address, country and browser) and of the changes you make, so that you and our support team can see recent activity and spot misuse

Table Orders

When a restaurant uses QRbox's table ordering, guests can send orders from its menu with their phone:

• An order holds the table, the dishes, any note the guest writes, the total and its status. It holds no name, phone number, email address or account. Please don't write personal details in a note.
• The guest's browser keeps a random key so it can show and cancel its own orders. We store only a scrambled (hashed) form of this key, which can't be turned back into it.
• The guest's IP address is used only in memory, for a short time, to stop floods of orders. It is not stored with the order.
• The restaurant sees the orders on its staff screens, which it names itself. The orders are the restaurant's records; QRbox keeps them on its behalf.
• Guests at a table can also call a waiter or ask for the bill (saying whether they'll pay in cash or by card). A call holds the table, what was asked and when. Like an order, it holds no name or contact details, and the browser's key only in its hashed form.

Card Payments for Table Orders

When a restaurant also takes card payments for table orders, guests can pay for their order by card:

• The guest pays on the page of the restaurant's own payment provider (iyzico in Turkey, Stripe elsewhere), not on QRbox. Card details go straight to the provider; QRbox never sees or stores them.
• With a paid order we store the provider's reference for the payment, the amount, the currency and whether it was paid or refunded. Nothing about the card.
• The provider may ask the guest for details on its own page (for example an email address for the receipt). Its own privacy policy covers these.
• iyzico asks for a buyer with every payment. QRbox gives it the restaurant's own business details, and the guest's IP address, which iyzico uses against fraud. The guest's name and contact details are not asked for.
• The restaurant connects its provider account with its own keys. We store them encrypted, use them only on our servers to open the payment page, confirm the payment and refund it, and delete them when the restaurant disconnects the account, removes online payment or deletes the menu.
• The restaurant is the seller and the provider's customer: refunds and questions about a payment go to the restaurant.

Home Delivery Orders

When a restaurant takes home delivery orders through QRbox, the guest gives their name, phone number, email address and delivery address with the order:

• The restaurant is the seller and the data controller for this data. QRbox provides the software and processes the data on the restaurant's behalf, to show the order to the restaurant's staff and to the guest, and to send the guest the order's contract and pre-information form by email.
• Before paying, the guest reads the restaurant's pre-information form, distance sales contract and privacy notice. We keep which versions the guest accepted, with the order.
• The guest pays on the restaurant's own payment provider's page (iyzico or Stripe). For a delivery order, iyzico is given the guest's name, phone number, email and address as the buyer. QRbox never sees or stores card details.
• QRbox doesn't use this data for anything else, and never for marketing.

How Long We Keep Data

• Your account and menus: for as long as your account exists. When you ask us to delete your account, we delete it together with its menus, except records we are required by law to keep.
• A menu you delete: kept in an archive so it can be restored if it was deleted by mistake, until you ask us to remove it permanently.
• Sign-in records: 90 days after the sign-in was last used.
• Records of changes made in your account: one year.
• Table orders, with their card payment details: 13 months, then they are deleted automatically. Test orders: one day.
• Calls to a waiter from a table: 30 days, then they are deleted automatically.
• Home delivery orders: the guest's name, phone number, email and delivery address 30 days after the order; the order itself, without them, 13 months.
• Connected apps: as described in the section below.

Your Rights and Choices

You can see and correct your name and password on your account page, and end any connected app's access there. You can also ask us to:

• Give you a copy of the personal data we hold about you
• Correct data that is wrong
• Delete your account and its data
• Stop using your data for a particular purpose

Write to the address under "Contact Us" below. We reply within 30 days. You can also complain to the data protection authority in your country.

Children

QRbox is a service for businesses and is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.

Connected Apps and AI Assistants

You can connect an AI assistant, such as Claude by Anthropic or ChatGPT by OpenAI, to your QRbox account so that it can read and edit your menus for you. This is optional. Nothing is shared until you approve the connection on our consent screen while signed in.

When a connected assistant asks for it, we send it:

• The content of your menus: the names, descriptions, prices, badges, calories, allergens and ingredients of your categories and items
• Your menu's settings: its name, languages, currency, address, phone number, email, social accounts, Wi-Fi password, working hours and appearance
• How many times your menu was opened, per day and per language. These are counts only and identify no guest

We do not send your password or your payment details.

For each connection we store:

• The name and return address of the app you approved
• Access keys for the connection, kept only in hashed form. A connection that is no longer used expires within 60 days
• A record of the changes made to your menus through the connection (what was changed and when, with the IP address and software identifier of the request), kept for up to one year

We use this data only to carry out what you ask the assistant to do with your menus, to keep the connection secure, and to show you and our support team what was changed. QRbox keeps no separate copy of what it sends to the assistant.

The assistant's provider handles the content it receives under its own terms and privacy policy: Anthropic's for Claude, OpenAI's for ChatGPT. We do not sell this data or use it for advertising.

You can end a connection at any time under "Connected apps" on your QRbox account page, or by removing QRbox from the assistant's connector settings. Changing your QRbox password also disconnects every connected app. You can also ask us to disconnect an app or delete these records at the address below.

Policy Updates

We may update this privacy policy as necessary. Any changes will be communicated to you via a notification on this page. It is important to periodically review this policy to stay informed of any updates.

Contact Us

If you have any questions or comments regarding this privacy policy or our data processing practices, please feel free to reach out to us. You can contact us using the following details:

Email: [email protected]