Privacy Policy

This notice is written for the EU General Data Protection Regulation and for people who use sbizz in Mexico and elsewhere. Fields in square brackets are not filled in yet. Replace them with the real company before this page is treated as the final notice.

1. Who is responsible

The controller of the sbizz platform is:

• Legal name: [COMPANY LEGAL NAME]
• Address: [STREET AND NUMBER], [POSTAL CODE AND CITY], [COUNTRY]
• Register: [REGISTER COURT AND NUMBER]
• Managing director: [MANAGING DIRECTOR]
• VAT ID: [VAT ID]
• Email: support@sbizz.com

A shop that uses sbizz decides why visits, plates, and staff accounts exist for that shop. [COMPANY LEGAL NAME] runs the system on the shop’s instructions for that data, and is the controller of the login account itself (email, password, and the profile you create in the app).

2. What we collect

• Account: name, email, phone if you add one, and sign-in credentials.
• Pass and loyalty: member code, points, tier, and redeemed offers. Points and benefits are a shop promotion. They are not money and have no cash value.
• Visits: shop, time, service, amount, payment status, discount, and points. The amount stays on the shop’s books after you delete your account. Your name does not.
• Vehicle, only if that shop uses vehicles: plate, make, and model. Shops can turn this off and use the member code instead.
• Staff: name, work email, and role at a shop.
• Camera: staff devices may use the camera to scan a member QR. We do not store photos or video.
• Location, only if you allow it: used to show nearby shops. Turning the permission off in the phone stops it.
• Shop setup: a Maps link the shop pastes can be sent to Google to fill the shop’s name, address, phone, and hours. Card numbers are not collected. In-app card payment is not live.

3. Why we use it, and the legal basis

• Account, pass, points, and visits — to perform the contract with you (Art. 6(1)(b) GDPR). Points are a promotional benefit of that service. They are not money, not a stored balance, and not a claim against us or a shop. To the extent the law allows, we and the shops are not liable if points or benefits are changed, reduced, expire, are erased, lose value, cannot be redeemed, are lost because of a technical error, or are not honored by a shop.
• Location — only with your consent (Art. 6(1)(a)). You can withdraw it in the phone settings.
• Security, fraud checks, and keeping sale amounts after an account is deleted — legitimate interest in running a safe service and letting the shop keep its books (Art. 6(1)(f)). The kept record has no name, email, phone, or plate.
• Legal duties such as tax records the shop must keep (Art. 6(1)(c)), where those duties apply.

An email is required to create an account. A plate is required only at shops that use vehicles. Loyalty tiers follow point rules. They are not an automated decision that produces a legal effect.

4. Who receives it

We do not sell personal data. These providers process it to run the service:

• Supabase — account sign-in and the database.
• Railway — the API.
• Cloudflare — the public website.
• Resend — sign-in and account email.
• Google — only when a shop uses “Fill from Google Maps”.
• Stripe — not charging cards today. If card payment is turned on later, Stripe Connect charges the shop’s own account. We do not store the card number.

The database region is [DATABASE REGION]. Where that region is outside the EU, the transfer relies on the provider’s standard contractual clauses. Say the real country here once the project region is chosen. A later market that uses its own database names that country on its own notice. An account in one database is not an account in the other.

5. How long we keep it

• Account, pass, points, vehicles, and phone: until you delete the account, or we no longer need them to provide the service.
• Sale amounts, payment status, service, and time: kept for the shop’s statistics and books, without your name, email, phone, member code, or plate.
• Sign-in credentials: deleted the same day as the account.
• Backups: residual copies are removed within 30 days. Set the Supabase backup window to 30 days so this sentence stays true.

6. Your rights

You can ask to access, correct, delete, restrict, or export your data, and you can object to processing based on legitimate interest. You can withdraw consent for location at any time. You can complain to [SUPERVISORY AUTHORITY — the data-protection authority of the German state where the company is registered].

We answer requests within one month. Email support@sbizz.com from the address on the account.

Signed-in people delete the account in the app (Account) or in the dashboard under My Digital Pass. Both ask you to confirm before anything is removed. Deletion calls DELETE /v1/me. It deletes your name, email, phone, plate, pass, and all points and benefits at every shop. Those points and benefits are not restored. Sale amounts remain on the shop’s books without your name.

7. Age

sbizz is not for anyone under 16. We do not knowingly create accounts for children. If you believe a child has an account, email support@sbizz.com and we will delete it.

8. Security

Traffic uses HTTPS. Member passes are signed tokens. Shop data is separated in the API, with row-level security in the database. Dashboard sessions end after 8 hours without use.

9. Changes

When this notice changes, the date at the top changes with it. If the company name or the database country changes, this page is updated before new accounts are opened under that setup.

10. Contact

[COMPANY LEGAL NAME]
[STREET AND NUMBER]
[POSTAL CODE AND CITY], [COUNTRY]
support@sbizz.com
https://sbizz.com