KVKK — Protection of Personal Data

Under Art. 3(1)(ı) of Law No. 6698 (KVKK) the data controller is Synaltix LLC, operating under the Thmenu brand.

Legal name: Synaltix LLC — a single-member limited liability company formed in New Mexico, USA (New Mexico Secretary of State, Business No 0008091868, file no 3179684)
Authorised representative: Kerim Sağlam (managing member)
Address: 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA
Contact (KVKK requests): contact@synaltix.io
Privacy contact point: contact@synaltix.io (no formal contact person has been appointed under the KVKK)
Formal correspondence: contact@synaltix.io

Legal entity and representative in Türkiye: Synaltix LLC has no legal entity, branch or appointed data-controller representative established in Türkiye. You may send KVKK requests to the address above; they are answered within the period set out in KVKK art. 13.

VERBİS: Synaltix LLC is not registered with VERBİS.

• Identity (first name, surname)
• Contact (email, phone)
• Business (restaurant name, address, tax/MERSİS number)
• Customer account (admin, staff PIN hash)
• Customer/guest (orders, feedback, loyalty — the restaurant is controller, Synaltix is processor)
• Usage/security (IP, user agent, session, audit)
• Payment (Stripe transaction ID; card details are never stored)
• Affiliate (tax number, IBAN/ACH, TOTP — AES-encrypted with pgcrypto)
• Marketing consent (optional)

Service delivery, subscription and billing, authentication, customer support, platform security, legal obligations, service quality, pre- and post-contractual communication, AI content generation (Cloudflare Workers AI; no third-party model training — outputs carry an ai_generated=1 badge), and commercial electronic messages where explicit consent has been given.

KVKK art. 5: 5/2(c) performance of a contract; 5/2(ç) legal obligation; 5/2(f) legitimate interest; 5/1 explicit consent (marketing and optional analytics only).

Transfer abroad (art. 9 — as amended by Law No. 7499, 2024): Sub-processors: Cloudflare, Supabase, Stripe, Resend, PostHog, Sentry, Wise. As the Board has issued no adequacy decision for the USA, transfers are carried out under art. 9(2) appropriate safeguards (a Board-approved Standard Contract or BCR-equivalent agreements). Explicit consent is no longer a standalone basis for ongoing transfers. To request a copy of the contract: contact@synaltix.io.

Active account: for its lifetime + 30 days; invoices: Tax Procedure Law art. 253 (5 yrs) / Commercial Code art. 82 (10 yrs) — the longer period applies; order data: 6 months active, anonymised thereafter; cookie consent: 13 months; support: 3 years; staff audit records: 24 months (a single tier; no separate "cold archive" is kept); affiliate KYC: account closure + 7 years (pgcrypto); AI cache: 7 days.

TLS 1.3, AES-256, MFA (admin/superadmin TOTP, RFC 6238), Supabase RLS, PII-scrubbed logs, and dependency/configuration scanning on every deployment. No independent penetration test has been carried out; one is planned before we open to the EU market, and this page will be updated when it happens.

Breach notification: under Board Decision No. 2019/10 of 24/01/2019, notification to the Authority within 72 hours of becoming aware of the incident, and notification to the data subject without delay where the risk is high.

To be informed, to access, to verify the purpose, to learn the recipients, to have data corrected, to have data erased, to have third parties notified, art. 11(g) — to object to an adverse outcome produced solely by automated analysis (this covers our AI suggestion and decision flows), and to claim compensation for damage.

Write to contact@synaltix.io. As stated in §1, no data-controller representative has been appointed in Türkiye; requests are handled directly by Synaltix LLC. Requests are concluded within 30 days under KVKK art. 13. Right to complain: KVKK art. 14 — an application to the Authority within 30/60 days.