This Privacy Policy applies to the Cafe Simply mobile app, related public pages, payment functions, support interactions, and other service operations connected to the product.
For account, billing, security, support, diagnostics, and service analytics data, we usually act as the data controller. For workspace content entered by a customer organization or its administrators such as staff records, suppliers, schedules, tasks, internal documents, and operational materials, that customer organization typically determines the purposes and scope of processing, while we provide the hosted software and supporting infrastructure needed to process that data on its behalf as part of the service.
We process data only to the extent reasonably necessary for lawful and predefined purposes. Depending on the context, the legal basis may be performance of a contract, provision of the service, user consent, compliance with legal obligations, or our legitimate interests in securing, operating, and improving the product.
Primary production customer workspace data and operating materials for the production version of the service are hosted on infrastructure administered by us in Russia. The public landing pages are also served from infrastructure in Russia.
Some integrations may nevertheless involve processing of limited data or technical identifiers outside Russia when the user or customer organization chooses to use a particular feature. This may apply, for example, to Firebase services, Apple Sign In, Google Gemini, and other external providers. In such cases, only the data reasonably required for the relevant feature is sent, and the transfer occurs as part of the selected sign-in, notification, analytics, or AI-assisted document processing flow.
If a user deliberately runs the AI-assisted supplier document extraction feature, the document text, extracted fragments, and in some cases page images or PDF content may be sent to a server-side function and then to the connected AI provider for parsing. This feature is optional and is not required for ordinary use of the app.
The user and the organization on whose behalf the user acts remain responsible for deciding whether it is lawful and appropriate to submit that document content and whether any third-party personal data contained in it may be processed for that purpose.
We use Firebase Cloud Messaging for push notifications. A device push token is stored in the user profile only after the relevant app setup flow and operating-system permission are completed.
For the mobile app, we may use Firebase Analytics and related tools to understand which screens and features are used and to investigate crashes and failures. For the public landing pages, we use Yandex Metrica and similar website analytics tools. These tools may rely on cookies, local storage, or comparable browser and app identifiers. Where separate consent is required for analytics cookies or measurement technologies in a particular jurisdiction, those tools should only be activated after such consent or another legally valid basis is available.
We do not sell personal data. Data may be shared only to the extent needed to operate the service, comply with law, process a payment, follow the instructions of a customer organization, answer a support request, or protect our legitimate interests. We aim to keep shared data limited to what is reasonably necessary for the relevant purpose.
We do not keep data indefinitely without purpose. The actual retention period depends on the category of data, the user role, the contractual relationship with the customer organization, and applicable legal requirements.
You may request information about the processing of your data, correction, deletion, restriction of processing, withdrawal of consent where applicable, or any other request available under applicable law.
How to send a request: email princess.zhirova@gmail.com and include the account email, organization or location name where relevant, the nature of your request, and the action you want us to take.
Identity verification: for security purposes we may ask you to verify account ownership, administrator authority, or other information sufficient to identify the requester.
Response timing: we respond within the time required by applicable law. Where Russian personal data law applies, we aim to respond within 10 business days unless a different period or extension is expressly allowed by law.
The app may provide an account deletion function. If the user cannot use the app or needs additional assistance, the request may be sent to princess.zhirova@gmail.com. Deleting an account does not always mean instant removal of all related data from backups or payment records where retention is still required by law, security needs, or completion of backup rotation.
Important: if a user or customer organization uploads data about employees, suppliers, or other individuals, that user or organization is responsible for having a lawful basis for that processing, giving us correct instructions as the service provider, and providing any notices required by law.
The service is intended for business use in managing cafes and similar organizations and is not designed for children. If you believe personal data relating to a minor has been submitted without the necessary legal basis or consent, contact us at princess.zhirova@gmail.com.
We apply organizational and technical measures intended to protect data against loss, unauthorized access, alteration, blocking, and other unlawful actions. No method of internet transmission or electronic storage can guarantee absolute security. If we become aware of an incident that is reasonably likely to affect user or administrator data, we may notify affected persons, organization administrators, or other appropriate parties to the extent we consider necessary and legally permitted.
We may update this Privacy Policy from time to time. The current version is published on the relevant public page. Where a change is material, we may also notify users through the app, website, or email.
For privacy, personal data, account deletion, or data rights requests, contact princess.zhirova@gmail.com.