Draft for legal review. The service operator must supply its legal name, privacy/grievance contact and backup/provider retention policy before launch.
Privacy notice
When you connect through a shop QR, that shop receives your name, phone number, optional date of birth, any submitted rating or comment and visit time. The shop can also record purchases and visits in its workspace.
How your details are used
Your phone number is normalized to avoid duplicates within this shop. Your date of birth helps the shop identify upcoming birthdays. Your registration belongs to this shop; another shop cannot access its customer records.
Remembering your browser
A random, HTTP-only cookie lets this browser recognize your connection for up to 180 days. It does not contain your phone number. Use “Forget this browser” on the registration page to remove it. Owner login uses a separate, time-limited session cookie.
Messages and AI
Connecting does not give consent for marketing. WhatsApp greetings and shop updates are sent only when separate permission is recorded and delivery is configured. Reply STOP or use Stop WhatsApp messages on your remembered shop page to unsubscribe. A shared sender’s STOP request applies to all shops using that sender. Delivery goes through Meta Cloud API; approved templates are required for business-initiated messages. Message drafts remain available without sending. The built-in ASITA AI assistant summarizes the signed-in shop's data; no customer data is sent to an external AI service.
Optional general chat
When general chat is enabled, a shop owner must agree before each message is sent to OpenAI for safety screening and a reply. The message and approved app facts are sent; shop and customer records, login credentials and contact details are not attached automatically. Do not type sensitive or third-party personal information. Replies are AI-generated and may be inaccurate. Conversation text is private to the owner, can be deleted through Saved replies, expires under the configured retention, and is removed by account erasure. Deleting local text does not remove provider logs or retained backups. Provider storage is disabled for Responses requests; provider abuse-monitoring and retention policies still apply. The operator must document provider processing, cross-border transfers, legal basis and retention before enabling this feature. Anonymous daily usage totals are retained for budget monitoring.
Storefront enquiries and public feedback
Enquiries share your name, phone or email, message and selected item only with the business you contact. Feedback shares your rating, comment and optional name with that business. With your consent, approved feedback and its optional name can appear publicly; do not include contact details or sensitive information in a review. Existing private customer ratings are not published automatically. Storefront analytics count page opens and interactions by day, without retaining visitor identities in the counters.
Private shop cards
Shop owners can create greeting, invitation and promotion cards using local templates. Only text supplied for the card is printed; login contact details are not copied automatically. Card inputs and PNGs are private to the owner until downloaded and shared. Owners can delete them at any time. The configured retention expires these records, and account deletion removes them through the data-erasure worker. No card text is sent to an external AI provider. Downloaded copies and retained backups require separate deletion.
Your choices
Date of birth, ratings and comments are optional. Ask the shop owner to correct your details or request removal; the owner can export your individual data or anonymize your personal details through your customer profile. Owners can configure inactivity retention; cleanup runs only through the documented operator command. The administrator must expire backups and handle provider-held data separately. Current registration is adults-only; known dates of birth under 18 are rejected. Verified guardian consent is not available. Keep personal information out of comments that do not need it.
This notice describes the implemented data flow. The business operating this service must provide its contact details and applicable retention policy before public launch.