Privacy
This is an MVP stub, not legal advice. Replace it with a counsel-reviewed policy before a public launch.
Who this covers
Business owners authenticate with Supabase Auth. The auth provider stores the account email. Customers who open a QR link do not create accounts.
What we store
For a customer visit we store ratings, an optional free-text comment, the generated draft, and anonymous analytics events tied to the business and QR. We do not ask for a customer email or phone number in the public flow.
Draft generation
Drafts are produced by Google Gemini on the server. The customer comment is sent to Gemini so the draft can reflect what they wrote. They can edit the draft before copying it.
Deletion
Deleting a business cascades related feedback, drafts, QR codes, and analytics in the application database. Until a formal contact is published, send deletion requests to the business owner or the operator of this deployment.
Not legal advice
This page describes the MVP data flow. It is not a complete privacy policy and should be replaced before production launch.