Data processing addendum

This applies to personal data we process on your behalf: your customers, their bookings, their purchases and anything you record about them. It does not apply to data we hold as controller — your own operator account, and site visitors — which the privacy policy covers.

We process this data only to provide the service, and only as your configuration of it directs. We do not process it for our own purposes, do not sell it, and do not use it to train models.

Access by our staff is limited to what support requires, is time-limited, and requires you to open it: the support switch in Settings → Health grants a read-only window that expires by itself and that you can revoke early. Every read taken through it is written into your own audit log, which is yours to inspect.

Data is isolated per store at the database level, enforced by row security rather than by application code, so a query that forgets a filter returns nothing rather than somebody else’s rows. Credentials and PINs are stored hashed or encrypted and are not readable by the application role that serves your dashboard.

Data is encrypted in transit and at rest. We will tell you without undue delay if we become aware of a breach affecting your data, with what we know and what we are doing about it.

We use the subprocessors listed here, each under terms no less protective than these, and will give 30 days’ notice before adding one that handles personal data.

Your dashboard can export and erase a customer’s record without us being involved — that is the intended route, because it is faster for you and involves fewer people. Where a request needs something the dashboard cannot do, we will help within the statutory window.

You can export at any time. On termination the data stays available for export for 30 days and is then deleted, except where we must keep something to meet a legal obligation — in which case we will say what and why rather than keeping it quietly.