Privacy Policy

Effective 9 October 2026

This Privacy Policy explains how ÇayGPT uses personal data about the people it deals with: people who use the ÇayGPT app, business owners who register their venue with ÇayGPT, people who use the web panel (including marketers), visitors to çaygpt.com and people who write to us.

ÇayGPT is a venue discovery network that brings independent tea houses and coffee shops together. In the app you find venues near you, look at their menus, order and book a work table; if you choose, you can say you are at a venue and meet and message other members who are there.

In this policy, "you" means the person the data is about. "We", "us" and "our" mean the ZincirX company that section 1 names as the controller for you. If you are in Türkiye, our Turkish-language KVKK notice (KVKK Aydınlatma Metni) at /kvkk-aydinlatma-metni explains how ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. processes your data. The Turkish version of this policy is at /gizlilik. The rules for using ÇayGPT are in our Terms of Use.

In short

• We show no ads and we do not sell your personal data. The app has no advertising, analytics, tracking or crash-reporting tools; on the website, Google Analytics runs only if you allow it in the cookie settings (section 11).
• Your card details are taken on the payment page by iyzico when you buy from Türkiye, and by Stripe when you buy from anywhere else; your card number never reaches us.
• When you check in at a venue with "Buradayım" ("I'm here"), your coordinates are not stored, and check-ins are deleted after 30 days. Messages are deleted after 365 days.
• Our servers are in Germany (Frankfurt), which is a transfer abroad (section 8).
• You can delete your account in the app. Payment and invoice records are kept, no longer linked to your account, for the 10 years the law requires.
• ÇayGPT is not for anyone under 18.

1. Who is responsible for your data

Which company is responsible for your data depends on where you are:

• If you are outside Türkiye, ZincirX Inc., a corporation established in the State of Delaware, United States, with its address at c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States, is the controller (veri sorumlusu) of the personal data this policy describes. ÇayGPT is operated from Türkiye by ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., a joint-stock company established in Türkiye, at Gülbahçe Mah. Gülbahçe Cad. İYTE Sitesi No: 1/40 İç Kapı No: 51, 35430 Urla/İzmir, Türkiye, which processes that data for ZincirX Inc. as a processor (veri işleyen) under a data processing agreement between the two companies; its people build and run the service and answer support requests.
• If you are in Türkiye, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş. (MERSİS 0999144137300001) is the controller of your personal data. Its KVKK notice (KVKK Aydınlatma Metni), in Turkish, is at /kvkk-aydinlatma-metni.

The seller depends on the billing country (Terms of Use, section 1): buyers whose billing country is Türkiye buy voucher packs, certification and the monthly membership from ZincirX A.Ş., everyone else from ZincirX Inc. Each company is the controller of the payment and invoice details it receives for its own sales (section 6), to take the payment, issue the invoice and keep its financial records.

For any question about this policy or your data, write to bilgi@çaygpt.com or send a letter to either address above.

2. The personal data we process

• Account data: your first and last name, your email address, your phone number if you give it, your password, which we store only as a one-way hash, and your account's role (user, business owner, marketer or administrator).
• Sign-in data: if you sign in with Google, the account identifier Google gives us, your name, your email address and the address of your Google profile photo (shown as your profile photo if you have not uploaded your own). If you sign in with Apple, the account identifier Apple gives us and the name and email address Apple shares; if you chose to hide your email, that is Apple's relay address. If you sign in with Apple, we also store a refresh token Apple issues, encrypted; it is used only to revoke the Apple sign-in when you delete your account, and is deleted with the account. The app keeps you signed in with sign-in tokens issued to your device.
• Profile data: the short name other members see, your "about me" text, your profession, the social media accounts you add, and your profile photo. A photo you upload is stored on our server.
• Business data (business owners): the venue's name, street address, city and district; its phone number, email address and website if you give them; if you use "get location" when registering, your phone's GPS position at that moment (as the venue's place on the map); the menu and products, work areas, membership level and certification status, check-in tags and menu codes, and supply orders. Most of this is about a business, but some of it, such as a sole trader's name or phone number, is personal data.
• Transaction data: your orders (venue, items, amount, payment method and status), your bookings (venue, date, time and other details), your favourite venues, your voucher codes and credit balance, your payments (voucher packs, certification fees, monthly memberships: the dollar amount, for payments from Türkiye the Turkish lira charged and the exchange rate, status, date, the identifiers the payment's taker — Stripe, or ZincirX and iyzico — gives it and the invoice number), your memberships, and the entrepreneur programmes you join with your progress notes.
• Billing details: your billing country (it decides who sells: the venue's for what is bought for a venue, yours for what you buy for yourself); and for business owners, if they give them, the invoice name, tax number or, for a sole trader, Turkish ID number (TCKN), tax office and invoice address. These are used only for payments and invoices and are never shown with the venue.
• Messages: your one-to-one conversations with other members, and who wrote to whom and when. The first 120 characters of a message also appear, with the sender's short name, in the recipient's in-app notifications.
• Notifications: your in-app notification feed about your orders, bookings and messages.
• Reviews: the rating and comment you give a venue. Reviews are shown publicly with your full name and profile photo.
• "Buradayım" (venue check-in): which venue you checked in at, on which day and at what time, when you left, whether you used an NFC tag or a QR code, and whether your location was verified, with the accuracy of the location reading in metres. To verify it, the app sends your phone's current position; the server compares it in memory with the venue's position and does not store your coordinates.
• Social settings and safety records: when and to which version you consented to the social features, which members you chose to show which details to, the people you have blocked, reports you made and reports made about you (reason, note and venue), and our decisions on them.
• Applications: if you fill in the membership application form, your name, email address, phone number, city, business name and the membership level you ask for.
• Marketer programme: a marketer's referral code; if you signed up in the web panel with a marketer's code, which marketer referred you; and referral and commission records.
• Correspondence: what you send us by email.
• Technical data: the IP address, time of request, requested address and browser or device details sent with each request the app and the website make to our server. A website session record contains your IP address and browser details. To list venues near you, the app sends your current position to our server if you have allowed location access; the server uses it only to find venues by distance and does not store it with your account.

What we do not process: we use no advertising, advertising identifiers, tracking or crash-reporting tools; our only analytics tool is Google Analytics on the website, and only with your permission (section 11). We send no push notifications to your phone; notifications exist only inside the app. We do not access your contacts or health data. We do not ask for special categories of personal data (such as health, religion or ethnic origin); please do not put such details in your profile, messages or reviews.

3. How we collect it

Most of it you give us in the app or on the website: when you sign up, edit your profile, order or book, write a message or register a venue. Technical data arrives automatically with each request. If you sign in with Google or Apple, that company gives us an account identifier and, depending on your settings, your name and email address. Stripe tells us whether a payment went through, whether it was refunded and the status of a membership subscription; for payments from Türkiye, ZincirX tells us the result it has from iyzico, the Turkish lira charged, the rate and the invoice number. Data about you also arises when other members message or report you, and when venues update the status of your order or booking. The data is collected electronically, partly by automatic means.

4. Why we use it, and on what legal basis

For each purpose we give the processing condition under Article 5 of the KVKK.

• Opening your account, signing you in and providing ÇayGPT (orders, bookings, favourites, vouchers, credit, messaging, reviews, the business panel): the making and performance of our contract, Article 5(2)(c).
• Passing your order or booking to the venue: Article 5(2)(c).
• Taking payments through Stripe or, from Türkiye, through ZincirX A.Ş. and iyzico, deciding the seller by your billing country, invoicing and keeping financial records: Article 5(2)(c), and the legal obligations of tax and commercial law, Article 5(2)(ç).
• "Buradayım" and the social profile (saying you are at a venue, appearing in the list of members there that day, showing more details to members you choose): your explicit consent, given separately in the app, Article 5(1). You can withdraw it at any time by turning the social features off in the app; your check-in history is then deleted at once.
• Measuring how the website is used (Google Analytics 4), only if you allow it in the cookie settings: your explicit consent, Article 5(1) (and Article 6(1)(a) GDPR where the GDPR applies). You can withdraw it at any time with the "Cookie settings" link at the foot of the pages (section 11).
• Sending password reset codes: Article 5(2)(c).
• Running the marketer programme and calculating commission: Article 5(2)(c).
• Assessing membership applications and contacting applicants: directly related to making a contract, Article 5(2)(c).
• Keeping ÇayGPT and its users safe, preventing misuse, handling reports, blocking and moderation decisions, and fixing faults: our legitimate interest, Article 5(2)(f).
• Answering questions and requests: Article 5(2)(c) or 5(2)(f); for requests under the KVKK, Article 5(2)(ç).
• Complying with orders from courts and authorities, and establishing, exercising or defending legal claims: Article 5(2)(ç) and 5(2)(e).

We send you no marketing emails or commercial electronic messages. We make no decisions about you based solely on automated processing.

5. What you have to give us

To open an account you must give your name, an email address and a password, or sign in with Google or Apple. To register a venue you must give its name and address. Without these we cannot provide ÇayGPT. Everything else is optional.

6. Who we share it with

• ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., which operates ÇayGPT from Türkiye; for people outside Türkiye it does so for ZincirX Inc., and its people reach their personal data on ZincirX Inc.'s instructions under the data processing agreement between the two companies. As the seller to buyers whose billing country is Türkiye, it also receives, on the payment page at zincirx.com, what it needs to take the payment and issue the e-Arşiv invoice: your name and email address, what you are buying, the dollar amount and, for a membership, the period paid for; and for what is bought for a venue, if given, the invoice name, tax number or TCKN, tax office and invoice address. ZincirX A.Ş. issues the invoice and keeps it for its own legal retention period.
• iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.), which takes payments from Türkiye for ZincirX A.Ş., in Turkish lira, on its own payment page opened at zincirx.com. iyzico handles the card details and 3D Secure itself; ZincirX A.Ş. passes it the buyer's name, email address, billing details and the amount. iyzico keeps the records payment-services law requires, under its own privacy policy.
• Hostinger, which provides the servers in Frankfurt, Germany, that hold ÇayGPT's database and uploaded photos.
• Our email service, which receives your email address and the code when we send you a password reset code.
• Stripe, which takes card payments from outside Türkiye through ZincirX Inc.'s Stripe account, in US dollars. For voucher packs and certification fees we send Stripe your email address; for a monthly membership we send the business owner's name and email address (to create a customer record at Stripe); and in each case the amount and what the payment is for. Stripe collects the card details, and the billing address it needs for tax, on its own payment page; it takes the payment and raises the invoice or receipt. Stripe's payment notifications reach us through ZincirX's shared payment server at zincirx.com. Your card number never reaches us.
• Google, which confirms your identity to us if you choose to sign in with Google. On Android, maps are shown with Google Maps. If you allow analytics on the website, Google Analytics receives the usage data section 11 lists.
• Apple, which confirms your identity to us if you choose to sign in with Apple. On iOS, maps are shown with Apple Maps.
• Map providers receive connection details such as your device's IP address in order to load the map. Google and Apple handle what they receive under their own terms.
• Venues: when you order or book at a venue, its business owner sees your name, email address and phone number and the details of the order or booking. Business owners may use these details only to fulfil your order or booking.
• Other members: when you check in at a venue with "Buradayım", members who are there that day see your short name and profile photo. If you choose to show a member more, that member sees, depending on the level you choose, first your full name, about-me text and profession, then your phone number, email address and social media accounts. The person you message reads your messages.
• Everyone: your reviews are public, with your full name and profile photo, and so are the details of approved venues (name, address, phone number, location and menu).
• Marketers: if you signed up with a marketer's code, that marketer sees in their panel your name, the name of the venue you registered, and the related commission record.
• Professional advisers, such as lawyers and accountants, when they need it to advise us.
• Courts and competent public authorities, when they order us to act or to provide information, where the law otherwise requires it, or where we need it to establish or defend a legal claim.

If you ask, we will tell you the names of the specific recipients of your personal data.

7. How long we keep it

• Account and profile data: for as long as your account exists. Section 9 explains deletion.
• Sign-in tokens: the app's access token is valid for 1 day and its refresh token for 30 days. Signing out deletes the access token; resetting your password revokes all your tokens. Expired tokens are deleted by a daily clean-up.
• Password reset code: valid for 15 minutes.
• "Buradayım" check-ins: a check-in ends at the end of that day, and the record is deleted after 30 days. When you withdraw your consent to the social features, your check-in history is deleted at once.
• Messages: deleted after 365 days; conversations with no messages left are removed too.
• In-app notifications: for as long as your account exists. So the preview of a message you received can stay in your notification feed after the message itself has been deleted.
• Orders, bookings, favourites and reviews: for as long as your account exists.
• Payment, invoice and other financial records: for the period Turkish commercial and tax law requires, 10 years. If you delete your account, these records are kept without the link to your account. Stripe also keeps the payment and the invoice in ZincirX Inc.'s Stripe account, for as long as its own privacy policy describes; for payments from Türkiye, ZincirX A.Ş. keeps the invoice and the payment record, and iyzico the payment record, for the periods the law requires.
• Reports and moderation decisions: as long as we need them to prevent misuse and deal with any appeal; when an account is deleted, the record no longer links to it.
• Membership applications and correspondence: as long as we need them to deal with the application or the matter and any follow-up. If you ask us to delete them, we do, unless a legal obligation requires us to keep them.
• Website sessions: a session ends after a period of inactivity, and its record is then deleted.

When a retention period ends, we delete, destroy or anonymise the personal data.

8. Transfers abroad

ÇayGPT's servers are in Germany (Frankfurt); ZincirX Inc., the controller for people outside Türkiye and the seller for billing countries other than Türkiye, is in the United States; and the team that operates the service is in Türkiye. Personal data you give ÇayGPT is therefore transferred abroad. Türkiye's Personal Data Protection Board has not adopted an adequacy decision for these countries.

Personal data leaves Türkiye only on a basis that Article 9 of the KVKK allows. For regular transfers, such as those to our servers and between the two ZincirX companies, that basis is the standard contract announced by the Board, notified to the Personal Data Protection Authority within five business days of its signature.

When you sign in with Google or Apple, open a map or pay by card, your data goes from your device directly to that company, under its own terms; the details section 6 lists also go from us to Stripe. For payments from Türkiye, the payment and invoice details go to ZincirX A.Ş. and iyzico in Türkiye. If you allow analytics on the website, usage data goes to Google LLC through Google Analytics; that transfer rests on the consent you give in the cookie settings (section 11). Google LLC, Apple Inc. and Stripe, Inc. are in the United States. Stripe's own privacy policy, at stripe.com/privacy, explains how Stripe handles payment details.

You can ask for a copy of these safeguards at bilgi@çaygpt.com.

9. Deleting your account

You can delete your account in the app: open Ayarlar (Settings), choose Hesabımı Kalıcı Olarak Sil (Delete my account permanently) and confirm. The account is deleted at once. If you cannot use the app, write to bilgi@çaygpt.com from your account's email address; we will delete it within 30 days and confirm by email.

When an account is deleted, we delete your name, email address, phone number, password, Google and Apple sign-in links, profile details and profile photo, sign-in tokens, orders, bookings, favourites, reviews, "Buradayım" check-ins, the messages you sent, your blocks and sharing choices, your notification feed, your programme enrolments and any unused credit balance. The previews of your messages in recipients' notification feeds are deleted too. If you signed in with Apple, we also revoke the app's access in your Apple account. If you have unused credit, use it before you delete your account, or write to us.

Some records are kept:

• financial records of payments, invoices, vouchers and membership payments, for 10 years as section 7 describes, no longer linked to your account; and the payment and invoice records Stripe keeps;
• reports you made or that were made about you, and our decisions on them, no longer linked to your account; otherwise deleting an account would be a way to erase evidence of misuse.

When a venue owner deletes their account, the venue is not deleted: it is closed and removed from all listings, stops taking bookings, its check-in tags stop working and its membership subscription is cancelled at Stripe. Open orders and upcoming bookings are cancelled and the customers told; orders paid with credit are refunded to the customer's balance. The venue's order, booking and payment records are kept, no longer linked to its owner.

10. Your rights under the KVKK

Under Article 11 of the KVKK, you have the right to:

• learn whether your personal data is processed and, if it is, request information about it;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for it to be corrected if it is incomplete or inaccurate;
• ask for it to be erased or destroyed under the conditions in Article 7 of the KVKK;
• ask for corrections, erasure and destruction to be notified to the third parties it was transferred to;
• object to a result against you that arises from analysis exclusively by automated systems;
• claim compensation if you suffer damage because it was processed unlawfully.

To exercise these rights, write from your registered email address to bilgi@çaygpt.com, or send a written application to ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., Gülbahçe Mah. Gülbahçe Cad. İYTE Sitesi No: 1/40 İç Kapı No: 51, 35430 Urla/İzmir, Türkiye, which also receives applications for ZincirX Inc. If you are in Türkiye, the KVKK notice explains in Turkish how to apply. Include your name, your contact details and what you are asking for. We answer free of charge within 30 days at the latest; if the request involves an additional cost, we may charge the fee set by the Board's tariff. We ask you to prove your identity only if we have reasonable doubt about who made the request. If your request is refused, you find our answer inadequate or we do not answer in time, you can complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your request.

If another data protection law, such as the EU General Data Protection Regulation, applies to you, you can exercise the rights it gives you at the same address.

11. Cookies and what is stored on your device

• The app keeps your sign-in tokens in your phone's secure storage (the Keychain on iOS). It keeps a copy of your profile, your cart, your favourites and the app's settings on your phone. It contains no advertising, analytics or tracking tools.
• Strictly necessary cookies (the website and the web panel): a session cookie that keeps your session (its name ends in -session) and an XSRF-TOKEN cookie that protects forms; both expire after a period without activity. When you sign in to the web panel with Google, a remember-me cookie (its name starts with remember_web_) keeps you signed in on that browser until you sign out, for at most 400 days. The zx_consent cookie keeps your cookie choice (with the version of the cookie text and the date) for 6 months. These are first-party cookies, strictly necessary to provide the service you ask for, and do not depend on your permission.
• Analytics cookies (only with your permission): we use Google Analytics 4 on the website's public pages (the home page, the legal pages, the web panel's sign-in and role-selection pages, and the billing-details and payment-result pages); not on the web panel's inner pages and not in the app. Until you accept analytics in the cookie banner, Google's script is not loaded, no request goes to Google and no analytics cookie is set. If you accept, Google LLC (USA) sets the _ga and _ga_HF2VWFY5F0 cookies for up to 2 years, and Google receives: the address (without its query string and without the ids in it) and title of the pages you visit, the page you came from, browser and device details, an approximate location derived from your IP address, and sign-up, checkout and purchase events (amount, currency, product and payment number; not your name, email address or card details). We keep Google signals and ad personalisation switched off. Google Analytics keeps user- and event-level data in our account for at most 14 months. The legal basis is your consent (KVKK Article 5(1); GDPR Article 6(1)(a) where the GDPR applies). The data is transferred to the United States; Türkiye's Personal Data Protection Board has not adopted an adequacy decision for the United States, so it may not be protected there as it is in Türkiye. You can withdraw your permission at any time with the "Cookie settings" link at the foot of the pages: analytics stops, is not loaded again, and the _ga cookies the site can remove are deleted. Saying no does not affect your use of the site.
• Fonts: the home page's fonts are served from this site; opening it sends no request to Google Fonts or any other font service.
• The payment page you reach when you pay by card is, when you buy from Türkiye, ZincirX's payment page at zincirx.com and iyzico's page, and otherwise Stripe's own page; their own cookie rules apply there.

12. Security

We send personal data over encrypted connections (HTTPS), store passwords only as one-way hashes, use short-lived sign-in tokens that can be revoked, and limit access to each account's role. "Buradayım" location checks never record coordinates. Profile photos are served at an address anyone who knows it can open; other members see your photo at that address. No system is completely secure; if you think your account has been misused, write to bilgi@çaygpt.com straight away.

13. Minimum age

ÇayGPT is not for anyone under 18, and people under 18 may not open an account. If we learn that someone under 18 has opened an account, we delete it. If you know of such a case, please write to bilgi@çaygpt.com.

14. Changes to this policy

We update this policy when ÇayGPT or the law changes; the date at the top shows the version in force. We tell you about an important change in the app or by email before it takes effect. Before we use personal data for a new purpose, we tell you and, where needed, ask for your consent.

15. Contact us

For questions about this policy or your personal data, write to bilgi@çaygpt.com. By post: ZincirX Inc., c/o Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, United States; or, in Türkiye, ZincirX Bilişim Teknoloji ve Danışmanlık A.Ş., Gülbahçe Mah. Gülbahçe Cad. İYTE Sitesi No: 1/40 İç Kapı No: 51, 35430 Urla/İzmir, Türkiye. Our company details are in the Terms of Use.