Effective September 3, 2026
Privacy Policy
Pro Shop Pal is built around data minimization, limited retention, private shop conversations, and meaningful user control. Questions or privacy requests may be sent to admin@kriek.dev.
1. Scope and roles
This policy applies to Pro Shop Pal’s website, web application, Android application, and messaging service. Pro Shop Pal operates the platform. A participating pro shop can access and manage information for customers assigned to that shop and may also have its own obligations for information it handles.
2. Information we collect
- Account information: email address, display name, optional phone number, password hash, account role, shop assignment, and account status.
- Conversation information: messages, images you choose to send, attachment names, timestamps, conversation status, and read status.
- Security and operations information: session records, audit events, limited web-server logs, device platform and push-notification token, delivery errors, and application diagnostics you choose to provide.
We do not seek precise location, contacts, advertising identifiers, payment-card data, or sensitive personal information. Please do not send unnecessary sensitive information in messages or images.
3. How information is used
- Provide accounts and private customer-to-shop messaging.
- Route conversations to the assigned shop and send requested notifications.
- Protect accounts, prevent abuse, investigate failures, and maintain auditability.
- Back up, restore, maintain, and improve the service.
- Meet legal obligations and enforce service terms.
We do not sell personal information, use it for targeted advertising, or permit third-party advertising in the service.
4. Legal grounds
Where applicable, processing is based on providing the service you request, legitimate interests in operating and securing the service, consent for optional notifications, and compliance with law. Notification permission can be withdrawn in device settings.
5. Disclosure and processors
Information is available only to authorized personnel, your assigned shop’s authorized owner/staff, and service providers needed to operate the platform. Firebase Cloud Messaging processes push tokens and notification delivery data. Hosting, domain, certificate, and network providers may process limited infrastructure data. We disclose information when legally required or necessary to protect people, rights, and service integrity. We do not disclose conversation content to unrelated shops.
6. Security
Controls include TLS in transit, hashed passwords, authenticated private media and APK delivery, role- and shop-scoped authorization, session revocation, rate limiting, restricted network listeners, audit records, least-access server permissions, automated backups, availability monitoring, and tested restoration procedures. No system can guarantee absolute security; suspected incidents are investigated and affected people will be notified when required.
7. Retention
We retain each category only for a defined purpose and then delete or anonymize it. The complete schedule is in our Data Retention Standard. In summary: messages and images are normally retained for no more than 24 months; expired session records for 30 days; inactive push records for 90 days; security audit events for 24 months; routine server logs normally for 14 days; and rolling backups for 14 days. Legal holds, fraud/security investigations, or law may require limited exceptions.
8. Your choices and rights
You may update profile information in the application, disable notifications in device settings, or request access, correction, export, restriction, objection, or deletion by emailing admin@kriek.dev from the account email. We verify requests to protect the account, acknowledge them promptly, and normally complete verified requests within 30 days. Deletion removes or anonymizes account identifiers and content unless a narrow retention exception applies. Data can remain in encrypted or access-restricted rolling backups until those backups expire.
9. Children
The service is not directed to children under 13, and we do not knowingly collect their information. Where local law requires parental consent at a higher age, the service should be used only with that consent. Contact us to report a child’s account for prompt review and deletion.
10. International use
The service infrastructure is operated in the United States or locations used by our providers. Where required, appropriate safeguards will be used for cross-border transfers.
11. Changes
Material changes will be announced through the service or other reasonable means before taking effect when feasible. The effective date above identifies the current version.
12. Contact
Privacy contact and service operator: Pro Shop Pal
Email: admin@kriek.dev