Scope
They cover personal data that a store enters or creates in the service about its customers and staff, including contact details, visit history, purchases, prescriptions, measurements and face-shape photos.
Processing on your instructions
We process store data only to provide the service and its support, and only as the store instructs through its settings and use of the product. We do not use store data for our own purposes.
Prescription and health data
- Prescription data is treated as sensitive and is encrypted in transit and at rest.
- Access inside the store is controlled by role, and every change is logged with a name and time.
- Our staff can access a store's records only to give support the store has asked for, and that access is logged.
Face-shape photos
Photos taken for AI Frame Finder are processed only to estimate face shape and width for that visit. They are deleted when staff delete them, or automatically under the store's setting, and are never used to train models.
Sub-processors
We use sub-processors for cloud hosting, email delivery and WhatsApp message delivery. Each is bound by written terms at least as protective as these. Account owners can ask for the current list, and will be told before a new sub-processor is added.
Security incidents
If we become aware of a breach affecting store data, we will notify the account owner without undue delay, and no later than 72 hours, with what we know and the steps taken.
Helping with requests
Stores can view, correct, export and delete customer records directly in the software. Where a request needs more, we help the store respond within the time the law requires.
Return and deletion
When an account closes, the store can export its data for 30 days. After that, data is deleted from live systems and removed from backups within a further 60 days.