This policy explains what personal data we collect through this website and through Uppercut One, why, where it is kept, who else handles it, and what you can ask us to do with it. "We" are Mazin Jillood International SPC, which provides Uppercut One under the name Uppercut Apps: a sole proprietor company registered in the Sultanate of Oman under commercial registration number 1511631, of Murtafaat Al Matar, Al Seeb, Muscat Governorate, P.O. Box 111, P.C. 111. This policy is written to meet the Personal Data Protection Law of the Sultanate of Oman (Royal Decree 6/2022) and, where a venue's customers are elsewhere, the data protection laws that apply there. If anything here is unclear, ask: [email protected].
Depending on who you are, we hold your data in one of three capacities:
| What | Why | How long |
|---|---|---|
| The sign-up form: business name, your name, email, phone, city, message | To contact you about setting up the service. Lawful basis: taking steps at your request before entering a contract. | Until the request is closed, then 12 months. |
| The “Try it free” form: business name, WhatsApp number, links to your website or social pages, and the photos or PDFs of your menu you send | To set up a trial copy of the service with your own products and send you its link on WhatsApp. Your photos, PDFs and links are read by the AI model provider named in section 6 to draft the menu, and we check the draft before it is used. Lawful basis: taking steps at your request before entering a contract. | Your photos and PDFs are deleted automatically after 180 days. The rest: until the request is closed, then 12 months. |
| Messages to our WhatsApp number: your number, your WhatsApp profile name, what you write, the photos and documents you send, and, if you came from one of our ads, which ad | To answer you and to set up a trial with your own menu. Replies may come from our AI assistant, which says so, using the AI model provider named in section 6; we read the chats and can answer you ourselves. We only ever reply to you: we never message a number that has not written to us first. Write STOP at any time and we send nothing more (START to talk again). Lawful basis: your request, by writing to us. | Messages, photos and documents: deleted after 180 days. A record of when you wrote first and of any STOP or START is kept as proof of your choice. |
| Questions you ask the site's sales assistant | To answer them. Questions are sent to the AI model provider named in section 6 for that purpose only. | Not stored by us beyond the session; a count per visitor per day is kept for 24 hours to limit use. |
| The interactive demo | A random token in your browser identifies your private copy of the demo so nobody else sees what you typed into it. It is not linked to you. | Deleted 24 hours after you last use it. |
| Standard server logs: IP address, browser, pages requested | Security, and keeping the site running. | Held by our hosting provider for a short period. |
This site sets no advertising or analytics cookies. It stores the demo token and your preferences in your browser only.
When you arrive by one of our links, cards or ads, the site keeps in your browser which one it was and a random number, and tells us, so we can see which of our visits, cards and ads work. If you sign up, they are kept with your sign-up. Apart from the Google ad click below, nothing of this is sent to an advertiser.
When you arrive from one of our Google ads, we keep the ad click identifier Google adds to the link. If you then sign up, start a trial or pay, we send Google Ads that identifier, which of the three happened, when, and the amount paid, so we can measure our ads. We send no names, emails or phone numbers.
Each venue has its own separate database. The data below is held for the venue, on its instructions, and is not shared between venues or used for anything else, except the account and billing details, which we hold as controller.
Name, email, a hashed password, login sessions, and which venues you may manage. Used to give you access and to contact you about the service. Kept while your account exists and for 12 months after.
No card numbers, no government ID numbers, no location tracking, no advertising profiles. The Assist feature answers from the venue's own data and is not used to build profiles of anyone.
Under Omani law you may ask to see the personal data held about you, to have it corrected, to have it deleted, to withdraw a consent you gave, and to object to or restrict how it is used. You may also complain to the Ministry of Transport, Communications and Information Technology, which supervises data protection in Oman.
We use a small number of providers, each for one job. Each is bound by its own terms to process data only to provide its service to us.
| Provider | What for | What they see |
|---|---|---|
| Cloudflare, Inc. (USA) | Hosting, databases, file storage, the network the service runs on | Everything the service stores, encrypted in transit and at rest |
| Resend, Inc. (USA) | Sending email: booking confirmations, receipts, payment links, staff notices, password resets | The recipient's address and the message |
| AmwalPay (Oman) | Card payments: a venue's customers paying the venue online, where the venue enables it, and venues paying us for their subscription | The payer's card details, in its own payment window, and a card the payer chooses to save; the amount and a reference |
| Anthropic, PBC (USA) | The AI model behind the sales assistant on this site and on our WhatsApp number, Uppercut Assist, the onboarding document reader, and reading the menus sent to us (the “Try it free” form or WhatsApp) into a draft trial menu | The question asked and the data needed to answer it; a WhatsApp chat with us; the documents a venue uploads for setup; the menu photos, PDFs and links sent to us. Not used to train the provider's models. |
| Meta Platforms, Inc. (WhatsApp, USA) | Our WhatsApp Business number, on WhatsApp's Cloud API | Your number, your profile name, and the messages and files you exchange with our number; which of our ads you came from, if any |
| Google LLC (USA) | Web fonts on the pages | The IP address of the browser requesting the font file |
We do not sell personal data and we do not share it with advertisers. We disclose it to authorities only where the law requires us to, and we will tell the venue when we are allowed to.
Data travels encrypted (TLS) and is stored encrypted. Passwords and till PINs are stored as salted hashes, never as typed. Each venue's database is separate, and a venue's staff can reach only their own venue. Access to the platform itself is limited to the people who run it, with two-factor authentication. Repeated wrong logins and PINs are locked out. If a breach affects personal data we will tell the affected venue without undue delay and help it meet its own obligations to notify.
The service is for businesses and their adult customers. A venue that takes bookings for children records the parent or guardian as the customer. We do not knowingly collect personal data from a child.
When this policy changes we update the version and date at the top, and we tell venues by email if the change affects the data we hold for them. The current version is always at this address.