Privacy Policy

1 Who we are

The Esmy platform (esmy.ai and app.esmy.ai) is operated by Esmy, a French single-shareholder simplified joint-stock company (SASU) with a share capital of €1,000, registered with the Paris Trade and Companies Register (RCS) under no. 130 411 739, with its registered office at 47 rue Vivienne, 75002 Paris, France, represented by its President, Sébastien Viger.

Esmy is the data controller for its merchants' data (section 2.1). The data of a merchant's customers (sections 2.2 and 2.3) is collected on behalf of that merchant, who decides how it is used — in particular whether to send campaigns: Esmy processes it for the merchant, in order to operate the service.

For any question about your data, whatever your situation: contact@esmy.ai.

2 Data we collect

2.1 Merchant data (dashboard users)

• First name, last name, business email address
• Business name, address and logo
• Google Business Profile OAuth token (encrypted, never exposed to the browser)
• Billing data (processed by Stripe — Esmy never sees or stores the card number)
• Platform usage logs

2.2 End-customer data (visitors of the game page)

To spin the wheel, the customer fills in a short form:

• First name (last name is optional)
• Email address — this is where the prize voucher is sent
• Mobile number — it lets the merchant find the voucher at the checkout and, only if the box below is ticked, receive the merchant's offers by SMS
• An optional box, unticked by default, to receive the merchant's exclusive offers: taking part in the game never depends on it
• The game result: prize won, voucher code, date and time of participation, then the date the voucher is used at the checkout
• Whether the customer opened the link to the merchant's Google review page, and when
• The IP address and browser type, stored with the participation to prevent abuse of the game (participation limits)
• No precise location data is collected

2.3 Loyalty card

If the merchant turns on loyalty, a customer's card is linked to the contact details they already provided (first name, email, mobile) and records their stamps and the dates. The customer may add the card to their phone's wallet (Apple Wallet or Google Wallet): Apple or Google then receive the card's content (business name, stamps, reward) in order to display it. For Apple Wallet, Esmy also stores a technical device identifier, used only to keep the card up to date. Nothing else is read from the phone.

2.4 Data from the Google Business Profile API

• Published Google reviews (text, rating, reviewer display name, date)
• Replies to reviews (published only with your explicit approval)
• Business information (name, address, category)

This data is accessed through the official Google Business Profile API, exclusively after the merchant's explicit OAuth authorization.

4 Purposes of processing

• Providing the Esmy service (dashboard, review replies, game, loyalty)
• Sending customers the voucher they won, then checking it at the checkout
• The merchant's email and SMS campaigns to customers who consented (section 5)
• Account-related communication (alerts, notifications, summaries)
• Billing and account management
• Preventing abuse of the game (participation limits per customer and per connection)
• Service improvement (aggregated, anonymized data)

Legal bases: performance of a contract (Art. 6.1.b GDPR); consent (Art. 6.1.a) for campaigns sent to end customers; legitimate interest (Art. 6.1.f) for abuse prevention and service improvement.

5 Email and SMS campaigns

• Only customers who ticked the "receive exclusive offers" box during the game can receive campaigns — the box is unticked by default
• Campaigns are sent on behalf of the merchant concerned, who chooses their content and recipients; Esmy carries out the sending for the merchant
• Every campaign email contains an unsubscribe link, valid for the merchant concerned
• Every campaign SMS states how to stop receiving them (reply STOP to the number given)
• Emails are sent through our provider Resend, SMS through Brevo (see section 12)

6 Prepared businesses (demonstration)

To present Esmy to a merchant, Esmy may set up that business's space in advance from public information (business name, typical prizes). Until the business is activated, its game page runs as a simple demonstration: no form is displayed and no customer data is collected. If the merchant adopts Esmy, the space is handed over to them and Esmy no longer has access to it. If they do not follow up, they can ask at any time for this space to be deleted at contact@esmy.ai.

7 Data retention

• Merchant account data: for the life of the account, then for as long as legal obligations require (billing, accounting)
• Google review data: deleted no later than 90 days after the end of the contract
• End-customer data (participations, vouchers, loyalty cards): for as long as the merchant uses Esmy; deletion on request at any time, and unsubscribing from campaigns at any time
• Technical logs: kept briefly, for diagnostics and security

8 Security

• Encrypted communications (HTTPS/TLS) across the whole platform
• Data hosted in the European Union (Supabase) and encrypted at rest
• Google OAuth tokens encrypted server-side — never exposed to the browser
• Payments processed by Stripe (PCI-DSS certified): the card number never goes through Esmy
• Access to data limited to the people who need it to operate the service

9 Your rights (GDPR)

Whether you are a merchant or a customer of a business using Esmy, you have the following rights over your personal data:

• Access — obtain a copy of your data
• Rectification — correct inaccurate data
• Erasure — request the deletion of your data
• Portability — receive your data in a structured format
• Objection — object to certain processing
• Withdrawal of consent — at any time, for campaigns (unsubscribe link, STOP by SMS, or a simple email)

To exercise these rights: contact@esmy.ai. We reply within 30 days. You may also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

10 Data deletion and access revocation

At any time, you can:

• Revoke Esmy's access to your Google Business Profile from myaccount.google.com/permissions or from your Esmy dashboard;
• Request the deletion of your account and all your data by writing to contact@esmy.ai.

Deletion results in the erasure of the associated data within 30 days, except where the law requires us to keep it.

11 Cookies

Esmy only uses cookies and local storage that are strictly necessary for the platform to work (session, authentication). No advertising cookies, no third-party trackers.

12 Sub-processors

• Supabase — database and authentication (hosted in the European Union)
• Vercel — hosting of the web application
• Stripe — payment processing (PCI-DSS certified)
• Resend — sending emails (prize vouchers, notifications, merchants' email campaigns)
• Brevo — sending the SMS of merchants' campaigns
• Google — connection of the business profile (Business Profile API) and, if the customer adds it, the loyalty card in Google Wallet
• Apple — if the customer adds it, the loyalty card in Apple Wallet
• Anthropic — generating suggested replies to reviews and the help assistant. Data sent through the API is not used to train Anthropic's models
• fal.ai — generating the flyer images requested by the merchant

All sub-processors are bound by a GDPR-compliant data processing agreement (DPA).

13 Contact

For any question about this policy: contact@esmy.ai.