YARMBack to YARM
Legal

Privacy Policy

Draft template — not yet legal-reviewed. Last updated: [date]. This describes what YARM actually does with data, but every bracketed placeholder needs your real company details, and this page needs a lawyer's review before it goes live for paying customers.

1. Who we are

YARM is operated by [Your Company Legal Name], [registered address], ("YARM", "we", "us"). This policy explains what information we collect when a business uses YARM and when a customer taps or scans one of that business's NFC cards or QR codes, why we collect it, and what rights you have over it. Questions can be sent to [privacy@yourdomain.com].

2. Two different people use YARM

This policy covers two distinct groups, because YARM collects very different information about each:

  • Merchants -- businesses that sign up for a YARM account, connect their Google Business Profile, and manage assets, analytics, and AI insights through the dashboard.
  • Customers -- the merchant's own customers, who tap an NFC card or scan a QR code that a merchant has placed in their location. Customers never create a YARM account and are never asked to.

3. What we collect from merchants

  • Account information: name, email address, and password (hashed by our authentication provider, Supabase Auth -- we never see or store a plaintext password).
  • Business information you provide: business name, category, city/country, timezone, and logo.
  • Google Business Profile data, if you connect it: your Google account email, the list of locations you manage, and every review, star rating, reviewer display name, and review reply for the location you select. This comes directly from Google's Business Profile API -- we never scrape Google and never invent review data.
  • OAuth tokens for your Google connection, encrypted at rest (AES-256-GCM) and used only to call Google's API on your behalf.
  • Team membership and role information, if you invite teammates.
  • Billing information (plan, subscription status), handled by our payment processor if/when billing is enabled -- we do not store card numbers ourselves.

4. What we collect from customers (tap/scan events)

When a customer taps an NFC card or scans a QR code, YARM redirects them to the merchant's Google review page immediately -- before any tracking work happens, so the redirect is never slowed down. In the background, we record:

  • A one-way salted cryptographic hash of the visitor's IP address and browser user-agent string -- never the raw IP address or user-agent itself, and the hash cannot be reversed back to either.
  • A coarse, city/country-level location derived from the request, not precise geolocation.
  • Device type, browser, and operating system family (e.g. "mobile", "Safari", "iOS") -- not a device fingerprint.
  • Which asset (which physical card or code) was tapped, the timestamp, and the HTTP referrer if present.

We deliberately do not collect names, emails, or any other way to identify an individual customer, and a tap event is never linked to a specific Google review afterward -- we report tap volume and review volume side by side, but we never claim a specific tap produced a specific review, because that link genuinely cannot be observed.

5. AI processing of review content

If a merchant's plan includes AI review analysis, the text and star rating of each new or changed review is sent to our configured AI provider (currently [Anthropic / OpenAI / Google Gemini -- see your deployment's AI_PROVIDER setting]) to generate sentiment, topics, an urgency rating, and a suggested reply. Only the review's own text, rating, and the business's name/category are sent -- no customer account data, no tap data, and no other reviews. We do not use review content to train our own models, and each AI provider's own data usage terms govern how they process that request.

6. Cookies

YARM uses only strictly-necessary cookies: a session cookie from our authentication provider (Supabase Auth) that keeps you signed in, and a small preference cookie that remembers which business you last viewed on the dashboard. We do not use analytics, advertising, or third-party tracking cookies. The public tap-redirect page (/t/<code>) sets no cookies at all.

7. Who we share data with

  • Supabase -- our database, authentication, and backend hosting provider.
  • Google -- to sync Business Profile data, via the Business Profile API, using the OAuth connection a merchant explicitly authorizes.
  • Our configured AI provider -- to analyze review text, as described in section 5.
  • Our hosting provider ([e.g. Vercel]) -- to run the application.

We do not sell personal data, and we do not share tap-event data with any third party.

8. Data retention

We keep merchant account and business data for as long as the account is active, plus a reasonable period afterward for legal and accounting purposes. Tap-event hashes are retained per the merchant's plan (see analytics history limits in-app) and are never individually identifying regardless of how long they're kept. Google review data is retained to preserve the merchant's review history and is removed if the merchant disconnects Google and requests deletion.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Merchants can manage most of this directly from Settings, or contact [privacy@yourdomain.com] for anything else. Because we never collect identifying information about customers who merely tap or scan a code, most customer-side requests will have nothing to locate -- the hashes we hold cannot be traced back to an individual.

10. Changes to this policy

We'll update the date at the top of this page when this policy changes, and post material changes here.