Privacy Policy

Your personal data is processed by the company below, acting as the data controller within the meaning of KVKK Art. 3(1)(i).

Legal name

Diyojen Yazılım

Email

iletisim@winkapp.com.tr

Businesses such as cafes, restaurants and salons use Wink to communicate with their own customers. For information you send to a business through its page (for example a job application, a reservation or feedback), that business may also be a data controller; we host this information on the business's behalf and deliver it to the business. For questions about a business's own practices, please contact that business directly.

For anything related to privacy, write to iletisim@winkapp.com.tr.

The data we collect depends on which app or page you use.

Wink customer app

• Account data: your full name, email address and password. Your password is not stored in plain text; the authentication infrastructure keeps only an irreversible hash.
• Profile photo: only if you upload one. Gallery or camera permission is requested only for this choice.
• Loyalty data: per business, your point balance and point history, the point codes you scan or enter, the reward coupons you earn and their usage status, and your visit history.
• Preferences and interactions: your favorite businesses; the 1-5 star ratings and optional comments you give to businesses; events for viewing campaign stories and tapping their buttons (linked to your account if you are signed in, otherwise to a hash of your device ID).
• Location: used only if you grant permission and only while the app is open, to show nearby businesses. Your location is sent to our server so the query can be answered; it is not saved to your account or our database. The last location is cached only on your device for faster startup. We do not track your location in the background.
• Camera: used to scan the QR code on a receipt. The image is not saved or sent to our server; only the code inside the QR is read.
• Device and security data: a random device ID generated when the app is first opened, operating system type (Android/iOS), app version, your IP address and the request time. Used to prevent fraud and abuse. We do not collect an advertising ID.
• Stored on your device: your session data and your latest profile, points and business data are kept in your device's local storage for faster startup.

Wink Business app and business dashboard

• Business owner registration: email address, password (as a hash), business name, page link, business category and an optional phone number. Accounts become active after administrator approval.
• Staff accounts: for employee accounts created by the business owner, a username, a role (for example waiter, cashier, editor) and a system-generated virtual sign-in email. A real email address is not required.
• Business content: menus, prices and images; contact and payment details you choose to publish on your business page (for example phone, address, social media links, IBAN); loyalty program settings; campaign stories; table and order (POS) records.
• Reservation records (for businesses that use the feature): guest name, party size, date and time, optional phone and email, notes and answers to form fields defined by the business. The business manages these records.
• Incoming applications and feedback: job applications and review-funnel feedback submitted through your business page are shown in the dashboard (see below).
• Audit logs: for important actions (sign-in, settings changes and so on), the actor's email and role, IP address, device/browser information and a timestamp. These are for account security; a user can see only their own records.
• Payments: paid features (for example VIP or theme purchases, when enabled) are paid through PayTR. Your card details never reach us and are not stored by us. We send PayTR your email address, business name, IP address and the order and amount for the payment.
• Camera and gallery: to scan table and loyalty QR codes and to pick menu and business images, only if you grant permission.
• Device and security data: a random device ID, operating system type, app version, IP address and request time. In the business app, session data is kept in the device's secure storage.

Website visitors and business pages (people who tap NFC/QR cards)

• Card taps: when you tap an NFC card or scan a QR card, we record the card and business, the source (NFC or QR), browser information (User-Agent), country, and an irreversible SHA-256 hash of your IP address. The raw IP address is not stored in this statistics record.
• Wheel of fortune and scratch card campaigns: to prevent the same person from claiming prizes repeatedly, we store, together with the prize record, your IP address, a device hash generated from your browser (calculated from values such as screen size, time zone, language and number of touch points), the prize you won and the coupon code. No name, phone number or email is requested.
• Review funnel: the 1-5 rating and optional written feedback you provide. Your name or contact details are not asked for or stored. Request details (IP address, browser information) may be processed to prevent abuse. If you give a high rating you may be redirected to the business's Google review page.
• Job applications: when you apply to a posting on a business page, your full name, email, phone, an optional cover letter and resume link, and your IP address to prevent abuse. The application is delivered to the relevant business.
• Server logs: while running the website and the API, standard server logs such as IP address, request time and browser information arise in the hosting infrastructure. Per-IP request counters for rate limiting are kept for a short time.

Data we do not collect

• We do not request special categories of personal data (health, religion, biometric data and so on). Please do not type such information into free-text fields.
• We do not receive or store payment card numbers or security codes.
• Our apps do not use advertising or third-party behavioral analytics/tracking SDKs.

We process your data for the purposes below, relying on the legal bases in KVKK Art. 5(2).

Creating accounts, authentication and session management

Establishment or performance of a contract (Art. 5(2)(c)).

Providing the points, reward and coupon service; letting a business verify your coupon and points at the register

Establishment or performance of a contract (Art. 5(2)(c)).

Providing the business dashboard and its menu, POS, reservation, loyalty and staff features

Establishment or performance of a contract (Art. 5(2)(c)).

Showing businesses near you (location)

Your device location permission and explicit consent (Art. 5(1)). You can turn the permission off at any time in your device settings.

Campaign statistics (provided to businesses in aggregate form)

Legitimate interest (Art. 5(2)(f)). Linking the data to a device or account relies on the explicit consent text in the app.

Security, fraud and abuse prevention, rate limiting, audit logging

Legitimate interest (Art. 5(2)(f)).

Payment processing

Performance of a contract (Art. 5(2)(c)) and legal obligation (Art. 5(2)(ç)).

Responding to your requests and applications

Contract (Art. 5(2)(c)) or legitimate interest (Art. 5(2)(f)).

Legal obligations and protecting our rights in disputes

Legal obligation (Art. 5(2)(ç)) and establishment, exercise or protection of a right (Art. 5(2)(e)).

We do not send commercial electronic messages without your consent, and we do not sell your personal data.

If you are established in the EU/EEA and the GDPR applies to you, the bases above correspond to GDPR Art. 6(1): contract (b), legal obligation (c), legitimate interests (f) and consent (a). You can exercise your rights through the contact method in this policy.

To provide the service we work with the service providers below. They process data only as far as the service requires.

Supabase

Database, authentication (accounts and password hashes) and file storage (profile photos, menu and business images).

Vercel

Hosting of the website and API. Request logs (IP address, time, browser information) and country information are processed by the infrastructure.

PayTR

Payment infrastructure for paid business features. Card details are entered directly with PayTR and are not stored by us.

Google Cloud Translation

When a business wants to translate its menu texts automatically, only the menu text to be translated is sent to Google. Customer account data is not sent.

Esri (ArcGIS), OpenStreetMap and Cloudflare

The in-app map screen loads the map library through Cloudflare (cdnjs) and fetches map images from Esri and OpenStreetMap servers. With these requests, your IP address and the map area you view reach these providers.

Google (review page)

If the review funnel redirects you to a business's Google review page, Google's own privacy policy applies there.

Where required by law we may disclose information to competent public authorities and courts. We update this list when we add a new service provider.

• When you collect points or win a reward at a business through the customer app, that business can verify your points and coupon code at the register.
• Campaign story statistics are provided to the business only as aggregated numbers; no individual is identified.
• The review and rating you submit on a business page, your job application and, if applicable, your reservation details are shared with that business.
• The rating you give in the customer app is shown publicly as the business's average rating; your comment text is not shown publicly.
• A business's staff can access only their own business's data; this is enforced through account and permission checks.

Our infrastructure providers' servers may be located outside Türkiye, so your data may be transferred abroad. Transfers are made in line with KVKK Art. 9 with appropriate safeguards such as an adequacy decision or standard contractual clauses. For people covered by the EU/EEA rules, the GDPR transfer mechanisms apply.

• Account, profile and loyalty data: while your account is open. They are deleted when you delete your account (see Account and data deletion).
• Point codes: valid for 24 hours. Expired or used codes are deleted by a cleanup process.
• Rate-limit counters: deleted shortly after the relevant time window ends.
• Business accounts: for the duration of the agreement and, after it ends, for the legal retention periods.
• Other records (audit logs, card-tap statistics, prize and coupon records, applications, reservations, reviews): for as long as the account or relationship lasts and for the legal periods in the relevant legislation. At the end of the period they are deleted, destroyed or anonymized.

• Passwords are not stored in plain text; only an irreversible hash is kept.
• Web and API traffic uses HTTPS.
• Row-level security (RLS) and per-business permission checks are applied in the database: a customer sees only their own data and a business sees only its own business's data.
• Rate limiting, account lockout after failed sign-ins and abuse detection are applied.
• In card-tap statistics, the IP address is stored as an irreversible hash.
• In the business app, session data is kept in the device's secure storage.
• No system is completely secure. In the event of a data breach we make the notifications required by law.

Under KVKK Art. 11 you can apply to the data controller to exercise the following rights:

• Learn whether your personal data is processed and, if so, request information about it,
• Learn the purpose of processing and whether it is used in line with that purpose,
• Know the third parties to whom your data is transferred in Türkiye or abroad,
• Request correction if it is incomplete or inaccurate,
• Request deletion or destruction under KVKK Art. 7 and request that this be notified to the third parties the data was transferred to,
• Object to a result against you arising from analysis of your data exclusively by automated systems,
• Claim compensation if you suffer damage due to unlawful processing.

Send your request to iletisim@winkapp.com.tr from the email address registered in the app or your account, clearly stating your identity and your request. Requests are answered free of charge within 30 days at the latest, depending on the nature of the request; if the process requires a separate cost, a fee according to the tariff set by the Personal Data Protection Board may be charged.

If your application is rejected, if you find the reply insufficient or if no reply is given in time, you may lodge a complaint with the Personal Data Protection Board. If you are in the EU/EEA you may also contact the data protection authority in your country.

Wink customer app (in the app)

1. Open the Wink app and sign in to your account.
2. Go to the Profile tab in the bottom menu.
3. Scroll down on the Profile page and tap "Hesabı Sil" (Delete account).
4. For security, enter your password and confirm with "Hesabımı Kalıcı Olarak Sil" (Delete my account permanently).

Wink customer account (on the web)

If you cannot access the app, you can also delete your account with your email and password on the page below (in Turkish). This page also serves as the store account deletion link.

Account deletion page

What is deleted: your account and profile data, profile photo, favorites, point balances and history, reward coupons, the ratings and comments you gave, the device data registered for notifications, and the campaign story view/tap events linked to your account. This cannot be undone. Records we are legally required to retain may be kept for the duration of that obligation. Information held in businesses' own records (for example reservation history) may remain with the business with its link to your account removed; to have it deleted, write to iletisim@winkapp.com.tr.

Wink Business and business dashboard accounts

There is no automatic in-app or web-page deletion for these accounts. Send a deletion request to iletisim@winkapp.com.tr from the email address registered to the account; after verifying your identity we delete the account and related data within 30 days at the latest (except records we are legally required to retain). Business owners can remove staff accounts from the dashboard.

Data created without an account

For data created by actions that need no account, such as card taps, campaign prize records, reviews or job applications, write to iletisim@winkapp.com.tr describing the action (the business and the approximate date). We delete the data we can match to our records.

Our services are not directed at people under 18. If you are under 18, use the apps only with the knowledge and consent of your legal guardian. If we learn that a child's data has reached us without a guardian's knowledge, we take the necessary steps to delete it. Guardians can write to iletisim@winkapp.com.tr about this.

• Session cookies (essential): when you sign in to the business dashboard or the admin panel, Supabase authentication cookies are used to keep your session. Cookies are set as secure (HTTPS) and SameSite=Lax.
• Campaign participation record: when you play the wheel of fortune or scratch card, a participation record is kept in your browser's local storage and in a 24-hour cookie to check repeat participation from the same device.
• Sign-in convenience: on the business sign-in page, the last email and business code you used are remembered in your browser. You can delete them by clearing your browser data.
• Dashboard preferences: preferences such as receipt paper width and dismissed announcements are kept in the browser's local storage.
• We do not use advertising, marketing or third-party analytics cookies.
• The mobile apps use the device's local storage instead of cookies (session, cache and device ID).

We may update this policy. We announce important changes in the app or on the website. The current version is always on this page; the last updated date appears at the top.