Privacy policy
Last updated:
Controller: Orvel (privacy@orvel.dev). Purposes: account, cash-register journal, item photos, billing. Legal bases: contract and statutory record-keeping.
Data
Email, merchant legal identity, items and photos, anonymous sales (no customer PII on v1 tickets). Strictly necessary session cookie: minty_session. Login attempts kept 30 days.
Processors
- Railway — Application hosting, database and object storage (EU (Amsterdam) / USA)
- Stripe — SaaS subscriptions and invoices (USA / Ireland)
- Resend — Transactional email (sign-in links) (USA)
Rights
Access, rectification, erasure within fiscal retention limits: privacy@orvel.dev.