Privacy Policy

This policy explains how OCHO LLC d/b/a Kwakkwak, operating the Kwakkwak service, handles information for its public site, founder-pilot applications, invited accounts, and controlled pilot service. The applicable pilot order identifies the participating shop and any pilot-specific terms.

For shop customer data, the shop generally decides why and how the data is used and Kwakkwak processes it on the shop's behalf. For account, application, billing, support, security, and site-operation data, Kwakkwak may determine the relevant processing purposes.

We may collect application and account details such as name, work email, phone, shop name, location, website, booking platform, customer-count range, goals, source attribution, legal acceptance versions and timestamps, login records, and support communications.

Approved pilot data may include customer names, normalized phone numbers, emails, external IDs, appointments, services, purchase and revenue history, source files and hashes, export or connected-account metadata, selected locations, consent scope and language, opt-in and opt-out evidence, suppression records, owner attestations, reviews, notes, and recorded outcomes.

Service systems may generate device, browser, IP, request, audit, authentication, security, performance, and error data. Payment providers may collect payment details directly; Kwakkwak should receive transaction and billing status rather than full card data.

We use information to review pilot fit; create and secure invited accounts; connect and synchronize owner-authorized Square data; privately stage and review approved fallback files; analyze customer return patterns; produce owner-reviewed recovery work; maintain consent and suppression evidence; support the service; prevent abuse; troubleshoot; maintain audit and recovery records; process approved payments; and meet legal or contractual obligations.

Uploaded files are not treated as instructions to automated systems. SMS is limited to separately consented recipients and remains subject to the applicable campaign authorization, sender registration, suppression controls, and launch gates.

A phone export alone is not consent. Kwakkwak may retain evidence showing the shop, sender, scope, language, source, timestamp, review status, later opt-outs, suppressions, and owner approvals. Owner attestation records responsibility but cannot substitute for customer consent.

The Kwakkwak Pilot SMS program is limited to direct Kwakkwak users and invited pilot testers who enroll themselves at the public SMS enrollment page using an unchecked consent box. Kwakkwak records the submitted number, consent timestamp, source page, and disclosure version. Messages may include requested test confirmations, pilot or account updates, support replies, and product-feedback requests. Message frequency varies and remains low. Message and data rates may apply. Reply STOP to opt out or HELP for help.

We do not sell, rent, or share mobile phone numbers or SMS consent records with third parties or affiliates for their marketing or promotional purposes. We may disclose them to service providers such as Twilio only as needed to deliver, secure, support, or document the messaging service, or when required by law. Client-customer messaging requires separate shop-specific consent evidence, sender and campaign registration, suppression enforcement, owner approval, runtime gates, and legal review.

See Twilio's Messaging Policy and Privacy Notice.

Current or planned service providers may include Supabase for database, private storage, and authentication; Vercel for application hosting; Stripe for an approved payment flow; and Twilio for separately approved shop-owned messaging. Square data is handled through an owner-authorized read-only OAuth connection with webhook-driven updates and scheduled reconciliation. Other booking sources use assisted exports unless a separate connection is disclosed and authorized.

The Square connection stores application-encrypted authorization credentials, selected-location metadata, signed-webhook receipts, encrypted minimized audit snapshots, and normalized customer and visit records needed for the pilot. Connecting Square does not create SMS marketing consent, and disconnecting revokes Square access and removes the local credential envelope.

Relevant vendor privacy materials include the Supabase DPA, Vercel Privacy Notice and DPA, and the Stripe Privacy Center.

We may also disclose information when directed by the shop, required by law, needed to protect rights or safety, necessary to investigate abuse, or part of a business transaction subject to appropriate safeguards. We do not sell shop customer lists.

Application, account, shop, and pilot data is retained only as reasonably needed for pilot review and delivery, security, dispute handling, backup and recovery, legal obligations, and documented business records. Rejected applications should be deleted or de-identified on a defined schedule after counsel review.

Consent, opt-out, suppression, sender, attestation, audit, and payment records may be retained longer where needed to demonstrate compliance or resolve disputes. Deletion requests may be limited by legal, security, billing, backup, or compliance-retention needs.

Kwakkwak uses measures intended to reduce risk, including private file staging, organization-scoped paths and policies, authentication, limited service credentials, hashes, audit records, and release gates. No security measure eliminates all risk. Shops should minimize unnecessary data and promptly report suspected unauthorized access.

Vendors may process data in the United States and other countries where they or their subprocessors operate, subject to their contractual and legal transfer mechanisms.

Shop owners may ask to access, correct, export, or delete account and shop data. A shop's customer should normally direct a request to that shop, which controls the underlying customer relationship; Kwakkwak will assist the shop as appropriate. Marketing emails from Kwakkwak may be opted out of using the message instructions.

The service is for businesses and is not directed to children. Do not submit children's personal information.

We may update this policy as the pilot changes. Material updates will receive a new version and effective date, and renewed acceptance will be requested where appropriate.

This policy is not legal advice or a claim of regulatory certification. Questions or requests: contact@kwakkwak.app.