Privacy Policy – EasyQ

Last updated: October 2026

1. Data Controller

For Business Users of the EasyQ platform:

Francesco Pugliese
Rome, Italy
Email: info@easyq-app.com

For personal data of end customers (queue participants), the Data Controller is the Business User. EasyQ acts as a Data Processor on behalf of the Business User, under the terms of the Data Processing Agreement.

2. Types of Data Collected

Business Users

• Name, email address, phone number
• Business name and address
• Login credentials
• Billing information (processed by Stripe; card details never stored by EasyQ)
• IP address and browser/device information (collected automatically)
• Usage and navigation data (pages visited, features used, session duration)

End Customers (Queue Participants)

• WhatsApp display name
• Phone number
• Queue-related data (registration time, party size, wait time, exit reason)

Guest Ratings and Notes (kept by the Business User)

A Business User may record, for its own guests, star ratings of behaviour and spending, short descriptive tags (for example “regular” or “often late”) and free-text notes, together with the guest's past bookings, visits and no-shows at that venue. These records:

• are created and used only by that Business User, to serve its guests;
• are never shared with other Business Users, nor used by EasyQ for any other purpose;
• are linked to the guest through keyed one-way hashes of phone number, email and name, computed with a secret specific to each venue, so the same guest cannot be matched across venues;
• remain subject to the guest's rights of access, rectification and erasure, exercised through the Business User, which is the Data Controller for them.

Analytics and Performance Data (all users)

EasyQ uses third-party analytics tools that automatically collect:

• IP address (anonymized or truncated where possible)
• Browser type, operating system, device type
• Pages visited, time on page, referral source
• User interactions (button clicks, form submissions, conversion events)
• Session recordings of on-screen activity (mouse movements, scrolls, clicks) via Microsoft Clarity

Where a Business User is logged in, EasyQ may pass a pseudonymous user identifier to Microsoft Clarity to link sessions to a single account. No name or email is transmitted.

3. Purpose and Legal Basis of Processing

Business Users

End Customers

Personal data is processed by EasyQ on behalf of Business Users for queue management and sending service notifications via WhatsApp. Legal basis: contractual necessity between the end customer and the Business User.

4. Data Retention

• Booking data → guest name, contact details and health-related notes are erased after the retention period set by each Business User (90 days by default). Ratings, tags and visit counts are kept, linked only to the hashes described above; free-text notes are erased once the guest has not returned within that period
• Business account data → retained until account deletion
• Inactive accounts → deleted after 24 months of inactivity
• Queue/customer data → deleted within 90 days of queue completion
• Upon account deletion, all associated data is purged within 30 days

5. Data Sharing and Sub-Processors

WhatsApp messages sent to end customers are delivered through Meta's infrastructure. Meta processes those messages under its own terms of service and privacy policy as an independent controller for the messaging infrastructure.

6. International Data Transfers

Where personal data is transferred outside the EEA, appropriate safeguards are implemented including Standard Contractual Clauses (SCCs) per Art. 46 GDPR. For transfers to TikTok Inc. and ByteDance, a Transfer Impact Assessment (TIA) has been conducted and is available on request at info@easyq-app.com.

7. Security Measures

• HTTPS encryption in transit
• Encryption at rest for database storage
• Secure authentication with hashed credentials
• Role-based access controls
• Infrastructure-level protections via Vercel and Supabase

8. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict or object to processing
• Data portability in a structured, machine-readable format
• Withdraw consent at any time, without affecting the lawfulness of prior processing
• Not be subject to automated individual decision-making (Art. 22 GDPR)

Send requests to info@easyq-app.com. We will respond within 30 days. You may also lodge a complaint with the Italian Data Protection Authority: Garante per la Protezione dei Dati Personali.

9. Updates to This Policy

This policy may be updated from time to time. Significant changes will be communicated through the platform with at least 15 days' advance notice.