Privacy Policy — Zain

1. Data Controller

The data controller for your data is Zain RMS (hereinafter, "we" or "Zain"), with contact address: info@zainagent.com.

2. Data We Collect

We only collect the data necessary to provide you with the Service:

Registration data: name, email address, restaurant name and contact phone number, provided when requesting beta access.
Payment data: handled entirely by Paddle (our payment provider). We do not store card numbers or bank details on our systems.
Usage data: processed bookings, bot conversations, restaurant configuration. This data is stored in your account to provide the Service.
Technical data: IP address, browser type and session cookies, for security and performance.

3. Purpose and Legal Basis

Provision of the Service — performance of a contract (art. 6.1.b GDPR).
Communications about the product — consent (art. 6.1.a GDPR), revocable at any time.
Legal and tax compliance — legal obligation (art. 6.1.c GDPR).

4. Data Retention

We retain your data for as long as your account remains active. When you cancel the Service, your data is deleted within a maximum of 90 days, except for data we must retain due to legal obligation (invoices, tax records: 5 years).

5. Providers and International Transfers

We use trusted providers that comply with the GDPR:

Paddle.com — payment processing (USA, Privacy Shield / Standard Contractual Clauses).
Vercel — web application hosting (USA, SCCs).
Insforge — PostgreSQL database in the cloud (EU).
Resend — transactional email delivery (USA, SCCs).
Meta (WhatsApp Business API) — messaging channel. Conversations pass through Meta's servers.

We do not sell or share your data with third parties for commercial purposes.

6. Your Rights

Under the GDPR (Regulation EU 2016/679) and the French Data Protection Act (Loi n° 78-17), you have the right to:

Access your personal data.
Rectify inaccurate data.
Erase your data (the "right to be forgotten").
Object to processing or request its restriction.
Request portability of your data.
Withdraw your consent at any time.

To exercise these rights, write to us at info@zainagent.com. If you do not receive a satisfactory response, you may lodge a complaint with the French Data Protection Authority (CNIL) at www.cnil.fr.

7. Cookies

We use strictly necessary session cookies for the Service to function. We do not use third-party tracking cookies for advertising purposes. You can configure your browser to block cookies, although this may affect how the application works.

8. Security

We apply technical and organisational measures to protect your data: encryption in transit (HTTPS/TLS), role-based access control, and periodic audits. Payment data never passes through our servers — it is processed directly by Paddle, which holds PCI DSS certification.

9. Changes to This Policy

We may update this policy from time to time. We will notify you by email of any substantial change at least 30 days in advance. The "last updated" date at the top of the document always reflects the current version.

10. Contact

For any queries about privacy: info@zainagent.com<br/>Zain RMS.