Naponi Global Privacy Policy

Zero-Escrow Architecture, Tokenization & Financial Privacy

Last Updated: October 16, 2026

1. Privacy Commitment

Naponi is committed to upholding international standards of data privacy and cryptographic security across all touchpoints, including our public landing pages, QR client portals, and administrative suites.

2. Cardholder Data Security (PCI-DSS Level 1)

Naponi implements a non-custodial architecture. We do not store, process, or transmit credit card numbers, expiration dates, or CVV codes on our own infrastructure. Payment sessions are encrypted via 256-bit SSL and tokenized directly by PCI-DSS Level 1 certified gateways.

3. Data Retention & Cryptographic Audit Trails

User passwords are stored as one-way bcrypt hashes. Database connections run over encrypted (TLS) tunnels. Agreements accepted by venues are sealed with immutable SHA-256 cryptographic timestamps. The application and database are hosted on Railway infrastructure (abroad, including the United States); site traffic is carried encrypted (HTTPS) over the Cloudflare network. Application errors are reported to Sentry so issues can be fixed quickly; these reports may contain the page URL, browser/device information and IP address.

4. Third-Party Analytics & Heatmaps

Google Analytics 4 (Google LLC) and Microsoft Clarity (Microsoft Corporation) run only if you choose "Accept all" in the cookie notice, and only on promotional pages. If you do not consent, their scripts are not loaded at all. Google Analytics is used for visit statistics and Clarity for click/scroll heatmaps. These tools process IP address, device/browser information and a cookie identifier; anything you type into form fields is masked and not recorded. Data may be transferred to servers in the United States. In addition, Cloudflare Web Analytics may be used for cookieless visit statistics. The business panel, staff screens and guest menu/tipping/loyalty screens are excluded from Google Analytics and Clarity tracking.

5. Artificial Intelligence (AI) Menu Processing & Provider Security

Naponi's AI features use Google LLC's Gemini API service. For menu import, translation, nutrition/dietary suggestions and product image features, only the venue's menu content (menu photos, dish names, descriptions, prices) is processed. If the venue has enabled the menu assistant, the question a guest types and the earlier messages in the same session are also sent to Gemini to generate a reply. The guest's name, contact details, payment details and IP address are not sent to the AI provider; however, the text the guest writes is passed on as written. This data is processed under Google's API terms of service.

Naponi İnternet Alışveriş ve Mağazacılık İthalat İhracat Limited Şirketi (VKN: Tax ID: 6291105866) — World Trade Center Bakirkoy, Istanbul, Turkiye — [email protected]