Privacy Policy — SmartShopAgent

1. Data controller

SmartShopAgent
Contact: contact page
Website: smartshopagent.com

2. Data collected

As part of providing the service, SmartShopAgent collects the following data:

Data	Source	Purpose	Legal basis
Email address	Registration	Authentication, sending transactional emails (verification, password reset)	Performance of the contract
Password	Registration	Authentication (stored as a bcrypt hash, never in clear text)	Performance of the contract
Business information	Dashboard	Display of the public page (name, address, phone, hours, category, description)	Performance of the contract
Photos	Upload	Display on the business's public page	Performance of the contract
Visit logs	Browsing	Audience statistics (page visited, date/time, anonymised IP, browser)	Legitimate interest
Contact messages	Contact form	Handling support requests	Legitimate interest / consent
IP address	Browsing	Security, abuse detection, error logs	Legitimate interest

SmartShopAgent collects no payment data. The service is entirely free.

3. Data hosting

Data is hosted in France by OVH SAS (2 rue Kellermann, 59100 Roubaix), an ISO 27001-certified provider. Data remains within the territory of the European Union.

4. Data sharing

SmartShopAgent does not sell or rent your personal data to third parties. The only sharing is:

OVH: host, access to data as part of the technical service
api.qrserver.com: third-party service used to generate QR codes. Only the public URL of your page is sent (no personal data)
Competent authorities: if required by law or a court order

5. Retention period

Data	Duration
User account and business page	Until account deletion
Uploaded photos	Until the photo or account is deleted
Visit logs	12 rolling months
Error logs	90 days
Contact messages	3 years from receipt
Verification / reset tokens	10 minutes (automatic expiry)

6. Your rights (GDPR)

Under the GDPR, you have the following rights over your personal data:

Right of access

Obtain a copy of your personal data held by SmartShopAgent.

Right to rectification

Correct your inaccurate or incomplete data from your dashboard.

Right to erasure

Request the deletion of your account and all your data.

Right to portability

Receive your data in a structured, machine-readable format.

Right to object

Object to processing based on legitimate interest (visit logs).

Right to restriction

Request the restriction of the processing of your data in certain cases.

To exercise your rights, use the contact page specifying your request. We will respond within 30 days. You may also lodge a complaint with the French data-protection authority CNIL at cnil.fr.

7. Cookies and trackers

SmartShopAgent uses only:

PHP session cookie (PHPSESSID): strictly necessary for the service to work (authentication). No consent required.
Language cookie: stores your language choice (FR/EN). Strictly necessary, no consent required.

No advertising cookie, no third-party tracker (Google Analytics, Facebook Pixel, etc.) is used.

8. Data security

SmartShopAgent implements the following technical and organisational measures to protect your data:

Mandatory HTTPS connection (TLS encryption)
Passwords hashed with bcrypt (high cost, automatic salting)
Access to data files restricted by .htaccess
Single-use, time-limited verification and reset tokens
Error logging with restricted access

9. Changes to the policy

SmartShopAgent may update this privacy policy. The update date appears at the top of the document. In the event of a substantial change, users will be informed by email.

10. DPO contact

For any question regarding the protection of your data, use the contact page.