Privacy Policy

Introduction

This Privacy Policy describes how HamyFlow (“we”, “us”, “our”) handles personal information when you use our website and related services (the “Service”).

HamyFlow is a local marketplace platform designed to connect customers with independent businesses, their products, and bookable services. Customers may discover listings, book services, purchase products, message businesses, leave reviews, and manage account activity. Business owners may manage profiles, catalog, reservations, orders, and customer relationships.

HamyFlow is currently in V1 preparation. At the time this policy was written, no company has been registered to operate HamyFlow yet, and there is no active public customer or registered-business base. This document describes the data practices of the software as implemented, for transparency while the product is prepared for launch.

[Operator legal name — configure before public launch] will operate HamyFlow once an operator entity is designated. [Registered business address — configure before public launch].

This policy reflects the Service as implemented in the current codebase. It is not legal advice and does not by itself establish legal compliance. Operator legal review is required before public launch.

Information we collect

Depending on how you use HamyFlow, we may process the following categories of information:

• Account information: name, email address, password (stored hashed with bcrypt), and role (customer or business owner).
• Profile and business information: business name, description, location, contact details, working hours, images, products, services, employees, and category-specific profile fields.
• Booking data: service selections, reservation dates and times, notes, optional employee assignment, reservation status, and pricing associated with bookings. Overnight hotel date-range stays are not supported by the current booking engine.
• Commerce data: cart contents (stored in your browser), order details, product quantities, shipping or pickup details when provided, payment references, invoices, transactions, promotions, and gift card usage.
• Payment data: payments are processed by Stripe when configured. We store payment status, amounts, currency, provider references, and related order or reservation links. Full card numbers are handled by Stripe and are not stored by HamyFlow.
• Messaging data: conversation threads, message text, optional product or service context, read and archive state, and unread counts.
• Notifications: in-app notification records (type, title, body, and metadata such as conversation or booking identifiers). Transactional email may also be sent when an email provider is configured by the operator.
• Reviews and favorites: ratings, review text, and favorite business selections.
• Claim and onboarding data: business claim requests, verification tokens, and related status (including claim emails when configured).
• Technical data: IP address (used for rate limiting and security on some routes), browser type, and standard request metadata.
• Preferences: language and region selections, and location preferences stored in browser local storage where enabled.

How we use information

We use information to operate and improve the Service, including:

• Creating and authenticating user accounts.
• Displaying businesses, products, and services; processing bookings and orders.
• Facilitating payments through Stripe and recording payment outcomes.
• Enabling messaging between customers and businesses.
• Sending in-app notifications and, when configured, transactional emails about claims, bookings, orders, payments, or refunds.
• Preventing abuse (for example rate limits on sensitive API routes).
• Maintaining security, troubleshooting, and limited audit logging on selected server actions.
• Complying with legal obligations where applicable.

Legal bases (EEA/UK users)

Where GDPR or similar laws apply, processing may rely on one or more of: performance of a contract (providing the Service you request), legitimate interests (security, fraud prevention, operating the platform), consent (where required for optional features), and legal obligation.

Specific legal bases and records of processing should be confirmed with qualified legal counsel before public launch in the EU/UK.

How we share information

We may share information in these situations:

• With business owners when you book, order, message, or review their business (limited to what is needed for fulfillment).
• With Stripe and its subprocessors to process payments you initiate.
• With database and hosting providers that store application data (for example MongoDB Atlas), depending on operator configuration.
• With an email provider (Resend when configured) to deliver transactional messages such as claim verification or booking/order notices.
• When required by law, regulation, court order, or to protect rights, safety, and security.
• We do not sell personal information as a data broker.

Cookies and local storage

HamyFlow uses an HttpOnly session cookie (`hamyflow_session`) to keep you signed in. The cookie is not readable by page scripts.

Browser local storage may hold shopping cart contents, language and region preferences, location preferences, and related client-side UI state. Authentication tokens are not stored in local storage for the current session model.

We do not currently deploy a separate cookie consent banner. If analytics or marketing cookies are added later, this policy and the user interface must be updated before those tools are enabled.

You can clear site data through your browser settings, which will sign you out and remove locally stored cart and preference data.

Data retention

We retain information for as long as your account is active and as needed to provide the Service, resolve disputes, enforce terms, and meet legal requirements.

Reservation, order, payment, invoice, and messaging records may be retained for operational and accounting purposes. Specific retention schedules should be defined by the operator before public launch.

Backups, if enabled on the production database, may retain copies for a limited period according to the operator’s backup policy.

Security

We use technical measures including password hashing (bcrypt), HTTPS in production deployments, security headers (including Content Security Policy), authenticated API routes for sensitive actions, and rate limiting on selected endpoints.

Session authentication uses an HttpOnly cookie. No method of transmission or storage is 100% secure.

Your rights and choices

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal information, and to object to or withdraw consent for certain processing.

You can update your display name in account settings where available. Dedicated account-deletion and data-export self-service flows should be confirmed and documented by the operator before public launch.

To exercise privacy rights, contact: [Operator contact email — configure before public launch].

Children

HamyFlow is not directed to children under 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children.

International transfers

Your information may be processed in countries where our hosting and service providers operate. Appropriate safeguards for cross-border transfers should be documented by the operator before international public launch.

Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the Service after changes means you accept the updated policy, subject to applicable law.

Contact

Email: [Operator contact email — configure before public launch]

Operator identity (once designated): [Operator legal name — configure before public launch]; [Registered business address — configure before public launch].