Privacy policy

1. Who is responsible

For the accounts of our business customers and for visitors to this site, the data controller is Abdellah HMACHE EI, 23 rue Olympe de Gouges, 92600 Asnières-sur-Seine, France (privacy@useringup.com).

For the people waiting in a shop's queue, the shop is the data controller and we process their data on the shop's behalf (see section 4). Questions about that data should go to the shop first; we will help them answer.

2. Business customers and their staff

We process the account owner's name, email address and language, the business name and country, staff first names and a one-way hash of each staff PIN, sign-in records and billing details.

Why: to provide the service under the contract with your business, to secure it, and to invoice and keep accounting records as the law requires.

How long: for the life of the account and 90 days after it closes; invoices for the period required by accounting law (10 years in France). Sign-in links are deleted 24 hours after they expire and sessions 30 days after they end.

3. Visitors to this site

We do not use advertising or analytics cookies. Our servers keep technical logs (IP address, pages, time) for security for up to 30 days. Sign-up and sign-in forms are protected by Cloudflare Turnstile, which processes technical data from your browser to tell people from bots.

Why: our legitimate interest in keeping the site secure and working.

4. People waiting in a shop's queue

A ticket holds a number, the queue, its times, the language of the page and, if the customer adds them, a table number. If the customer asks for a text message, their phone number is stored; if they turn on alerts, their browser's push subscription is stored. In clinic mode the clinic may add a first name, shown on its staff page only and never on the screen in the waiting room.

Why: to tell the customer their order or turn is ready, on behalf of the shop.

How long: phone numbers, first names and push subscriptions are deleted 24 hours after the ticket closes. The rest of the ticket is kept without personal data for the shop's statistics. A rating is kept with the ticket; any comment goes to the shop only.

5. Who receives data

Only the service providers listed on the sub-processors page, each for its own task (hosting, payments, text messages, email, bot protection, delivery of web notifications), under contracts that protect the data. We do not sell personal data and do not share it for advertising.

6. Transfers outside the European Union

Some providers are based in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses, with additional safeguards where needed.

7. Security

Data is encrypted in transit. Integration credentials and webhook secrets are encrypted at rest. Staff PINs and sign-in links are stored only as one-way hashes. Access to production systems is restricted and logged.

8. Your rights

You can ask for access to your data, its correction or deletion, a copy in a portable format, to restrict its processing, or object to processing based on our legitimate interest. Write to privacy@useringup.com; we answer within one month.

You may also complain to your data protection authority, in France the CNIL (cnil.fr).

9. Changes

We will tell account owners by email of significant changes to this policy.