Privacy Policy

1. Overview

This Privacy Policy explains how Rozana (“Rozana,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you visit example.com (the “Site”), contact us, or use the Rozana store operations platform at app.example.com and related services (the “Service”).

2. Who we are and our role

Rozana is located at TEST and operates the Site and the Service.

Visitors, people who contact us, and account holders. We decide how information about you is used, and this policy applies directly to you.

Store Data. Businesses that subscribe to Rozana (“Customers,” usually store owners) put information about their store, team, vendors, and customers into the Service (“Store Data”). We process Store Data on the Customer’s behalf, following the Customer’s instructions and our agreement with them, as their service provider. If you work at or shop at a store that uses Rozana, that store is responsible for its own privacy practices. Please send requests about Store Data to the store; we will help it respond.

3. Information we collect

Information you give us

• Contact and demo requests: your name, email address, company or store name, phone number and number of stores (both optional), and your message.
• Account information: name, email address, phone number, role, the stores you can access, and sign-in credentials. Passwords and PINs are stored only as salted hashes.
• Store Data: what Customers and their users enter or create in the Service, such as the item catalog, stock levels and counts, vendors and purchase orders, delivery receipts and scans, closeouts and cash counts, lottery books, sales and winners, time clock and payroll records (which can include employee names, hours, pay rates, and pay details), expenses and financial records, customer requests, and AI assistant conversations.
• Camera video: if a store connects compatible cameras or recorders, the Service processes their video and related details (such as camera names and times) to provide live view, playback, and transaction-linked video. Stores are responsible for following the laws that apply to video surveillance, including posting any required notices.

Information from connected services

• Clover, when a store connects it: sales, transactions, items, stock levels, employees, and cash events from the store’s Clover account. Rozana sends stock levels back to Clover. Other point-of-sale integrations will be listed here when they become available.

Information collected automatically

• Site analytics: we run our own copy of Umami, an open-source analytics tool, on our servers, so no analytics company receives this information. It does not use cookies. It records the page visited and the site that referred you (both without their query strings), the sections you view, the links and buttons you use, how far you scroll, your browser, operating system, device type, screen size, language, and approximate location (country, region, and city) worked out from your IP address. Your IP address is combined with your browser’s user agent and a value that changes every month to count visitors anonymously, and is not stored. A Do Not Track or Global Privacy Control signal turns it off.
• Service usage analytics: the same self-hosted tool records which pages and features of the Service are used: page addresses with record numbers removed, the name of each action (for example, “closeout submitted”), and the store, the user’s role, and the store’s plan. It never records names, contact details, anything typed into a form, or amounts. A store owner can turn it off for their store, or allow more detail (which fields a feature used, and the store’s results in the Service, such as closeouts completed and sales recorded, which we compute from Store Data inside the Service) in Privacy settings.
• Server logs: IP address, browser user agent, requested URL, time, and response status, used for security, abuse prevention, and troubleshooting.
• Service activity and security records: sign-ins, device and browser information, error reports, and audit logs of actions taken in a store, including any action by Rozana staff.
• Bot protection: forms on the Site use Cloudflare Turnstile, which checks signals from your browser to tell people from automated abuse.

4. How we use information

We use information to:

• provide, maintain, and secure the Service, including real-time updates across a store’s devices;
• respond to contact and demo requests and provide customer support;
• send service and account emails, such as sign-in links, password resets, alerts, and notices about your account;
• understand how the Site is used, in aggregate, so we can improve it;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• comply with the law and enforce our Terms of Service; and
• do anything else you ask us to do or agree to.

We may create aggregated, de-identified statistics (for example, how often a feature is used) that cannot identify you, your store, or any individual, and use them to operate and improve the Service.

We do not sell personal information, share it for cross-context behavioral advertising, or use Store Data for advertising. We do not use Store Data to train AI models.

5. The AI assistant

• The assistant answers from the store’s live data, using only the tools and information that the person asking is allowed to see.
• Before any data is sent to our AI model provider, the Service removes personal details it detects, such as email addresses, phone numbers, Social Security numbers, and payment card numbers. Automated removal may not catch everything, so please do not type sensitive personal information into the assistant.
• AI conversations, summaries, saved memory, and tool results are encrypted at rest.
• Each store chooses how long AI history is kept: 30, 60, 90, 180, or 365 days. The default is 90 days. Older history is deleted automatically, and an owner can erase all of the store’s AI history at any time.
• Our AI model providers process requests only to generate responses, under business terms that do not allow them to use the data we send to train their models.

6. Store-owner control and support access

• Walled off by store. Each store’s data is kept separate from every other store’s. People see only the stores and modules they have been granted, under roles the owner controls.
• No standing staff access. Rozana staff cannot open a store’s workspace unless the owner grants support access. A grant lasts from 1 to 72 hours, expires automatically, and can be revoked early.
• Every entry is logged. Each time Rozana staff enter a store, and what they do there, is recorded in an access log the owner can review.
• Owner choices. Owners decide who has access, which integrations are connected, and how long AI history is kept, and can export their data or ask us to delete it.

Outside a support grant, our engineers do not view a store’s data except where strictly necessary to keep the Service secure and working (for example, responding to a security incident or repairing damaged data) or where the law requires it. Any such access is limited to what is necessary.

7. How we share information

We share information with service providers that process it for us under contracts requiring them to protect it and use it only to provide their services:

We may also share information:

• with the people a Customer authorizes to use its store workspace;
• when required by law, subpoena, or other legal process, or to protect the rights, property, or safety of Rozana, our Customers, or others. Where the law allows, we notify the affected Customer first;
• as part of a merger, acquisition, financing, or sale of assets, in which case this policy continues to protect the information; and
• with your consent or at your direction.

8. Cookies, analytics, and local storage

• The Site uses no advertising or analytics cookies. Our analytics, which we host ourselves, is cookieless. We save one small value in your browser’s local storage to remember that you dismissed our privacy notice. Cloudflare Turnstile runs in its own frame on pages with a form and uses only what it needs to detect bots.
• The Service uses strictly necessary cookies to keep you signed in and to protect your session. It does not use advertising cookies, and its usage analytics sets no cookies.

Because we use only strictly necessary cookies and cookieless analytics, we show a short notice rather than a cookie consent prompt. We do not track you across other websites, and we treat a Global Privacy Control signal as a request to opt out of any sale or sharing of personal information (which we do not do).

9. Data retention

• Store Data: kept while the Customer’s account is active. After an account closes, we delete or de-identify Store Data within 90 days, except copies in backups (which are overwritten on their normal cycle) and records we must keep for legal, tax, or dispute reasons.
• AI history: kept for the period each store chooses (30 to 365 days, 90 by default), then deleted. Owners can erase it at any time.
• Access and audit logs: kept for the life of the account so owners can review them.
• Contact and demo requests: kept for up to 24 months after our last conversation, unless you become a Customer.
• Server logs: generally kept for no more than 30 days, unless needed to investigate abuse or a security incident.
• Analytics: kept for 25 months, then deleted automatically.
• Backups: encrypted, kept for a limited period, and then overwritten.

10. Security

We protect information with safeguards appropriate to its sensitivity, including:

• encryption in transit (HTTPS) for the Site and the Service;
• encryption at rest for AI conversations at the application level, on infrastructure that also encrypts stored data;
• per-store separation of data and role-based permissions;
• owner-granted, time-limited, and logged support access;
• salted password hashing, bot protection, and rate limiting on public forms;
• security headers and a strict content security policy on the Site; and
• monitoring and audit logs.

No method of transmission or storage is completely secure. If a security breach affects your personal information, we will notify affected Customers and individuals as required by law, including New York’s SHIELD Act.

11. Your choices and rights

• Account holders can review and update their profile in the Service. Owners can manage users, export store data, set AI retention, and erase AI history.
• Requests: you can ask to access, correct, delete, or receive a copy of your personal information by emailing [email protected]. We may need to verify your identity before acting, and you may use an authorized agent.
• Store employees and customers: please contact the store first. We will help it respond to your request.
• Emails: we send marketing emails only if you asked to receive them, and you can unsubscribe at any time. Service and account emails are part of using the Service.
• State privacy rights: depending on where you live, you may have the right to know, access, correct, delete, and port your personal information, and to opt out of its sale, sharing, or use for targeted advertising. We do not sell or share personal information for those purposes. We will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying to our decision.

We respond to verified requests within 45 days, or sooner if the law requires.

12. Children’s privacy

The Site and the Service are made for businesses and are not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

Store Data can include information about employees who are minors, such as their hours worked. We process that information on behalf of the store that employs them, and the store is responsible for it.

13. Where information is processed

We store and process information in the United States. If you use the Site or the Service from outside the United States, your information will be transferred to and processed in the United States.

14. Changes to this policy

We may update this policy as the Site, the Service, or the law changes. We will post the new version here with a new effective date. If a change is material, we will tell Customers by email or in the Service before it takes effect.

15. Contact us

For privacy questions or requests, email [email protected] with “Privacy request” in the subject line, or write to:

Rozana
Attn: Privacy
TEST
555-555-5555