Privacy policy

1. Who is responsible

Yousual is operated by its founder, Saad Kiker, reachable at support@yousual.app. For the data of business owners and their staff, we are the data controller. For the data of a business's customers (loyalty members, people placing orders), the business is the controller and we process that data on its behalf.

2. Data we collect from businesses

We collect only what the service needs:

• name and email of the account holder and staff;
• establishment details, including its location if you enter it;
• menu content (text, prices, photos);
• device identifiers for push notifications;
• basic technical data (IP address, device type, sign-in log);
• anonymous page-view statistics on the marketing site (Vercel Analytics — cookie-free, no visitor profiles).

We never see or store card numbers. Payments are handled by Paddle, our merchant of record; we only receive confirmation of payment and billing details such as your country.

3. Data of your customers

When your customers use your menu or loyalty card, we process on your behalf:

• for loyalty: name, phone number, stamps or points, rewards, and the messages sent to the card;
• for orders: name, phone number, delivery address when relevant, and the order itself;
• wallet pass registrations, so the card can be updated on the customer's phone.

This data is used only to run your menu and loyalty program. We do not sell it and we do not use it for our own marketing. You are responsible for informing your customers and for how you contact them.

4. Why we process data

• to provide the service you subscribed to (performance of a contract);
• to secure accounts and prevent abuse (legitimate interest);
• to send service emails such as password resets and subscription notices;
• to comply with legal obligations.

5. Who has access

Data is hosted and processed by providers acting under our instructions:

• Vercel (application hosting) and Neon (database);
• Cloudflare (domain, content delivery and image storage);
• Resend (transactional email);
• Paddle (payments, invoicing and tax, as merchant of record);
• Apple and Google (wallet passes, only the data needed to display and update the card);
• WhatsApp, when a business chooses to receive orders there.

Some of these providers process data outside the UK and the European Economic Area, mainly in the United States. Those transfers are protected by recognised safeguards: the providers are certified under the EU-US Data Privacy Framework and/or bound by Standard Contractual Clauses.

6. Retention

Account and establishment data is kept while the account exists. Deleting an establishment or an account removes its menus, orders, customers and loyalty cards immediately. Wallet passes already on customers' phones stop updating and are marked as removed.

Technical logs (sign-ins, IP addresses, errors) are kept for up to 12 months for security purposes, then deleted. Hosting backups are rotated out within 30 days, after which deleted data is gone from them too.

7. Your rights

Under the GDPR, the UK GDPR and similar laws, you have the right to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw consent where processing relies on it. Write to support@yousual.app; we answer within one month. You can also lodge a complaint with the data protection authority of your country (in the UK, the ICO).

Customers of a business should address their requests to that business first; we help the business fulfil them.

8. Cookies

We use only the cookies the service needs: session cookies to keep you signed in, and a preference cookie on public menus to remember the chosen language. There are no advertising cookies.

9. Changes

We may update this policy. Material changes are announced in the dashboard or by email. Questions: support@yousual.app.