Privacy Policy
Effective date: 2026-05-10. Last updated: 2026-07-23.
1. Summary
We collect the minimum personal data needed to operate Bina, store it in Singapore (ap-southeast-1) on Neon Postgres, never sell it, and never train AI models on tenant-specific data. You can export or delete your data at any time.
2. Who's the controller
For owner/operator users (the team running a Bina-powered business), Bina is the data controller. For your customers (people who order via your QR/menu/WhatsApp), the business using Bina is the controller; Bina is the processor. See our DPA.
3. What we collect
- Account info: name, email, optional phone — via Clerk on signup.
- Operational data: tenant, outlet, menu, orders, inventory, shifts, refunds — that you enter while running your business.
- Customer data: when a customer orders via QR/WhatsApp, we store their name/phone/email and order content if they provide it.
- Telemetry: page views, error reports, request IDs. We use Sentry (errors) and PostHog EU (analytics).
- Audit log: every meaningful state change is recorded with actor, timestamp, and request ID for security and compliance.
4. How we use it
- To operate the service you signed up for.
- To send transactional emails (e-receipts, account, billing).
- To detect abuse and protect the service.
- To improve Bina (in aggregate, never tenant-specific without consent).
5. AI processing
Some features send your data to Anthropic Claude on a per-request basis (no training, no retention beyond Anthropic's standard policies). We don't train models on your data. We don't share data across tenants.
6. Where data lives
Primary database: Neon Postgres in ap-southeast-1 (Singapore), co-located with the API (Railway asia-southeast1). Email delivery: Resend. Analytics: PostHog EU (eu.i.posthog.com). Error tracking: Sentry. Hosting: Vercel (global edge network) and Railway. AI inference: Anthropic.
7. Retention
Operational data is retained for the lifetime of your account. Audit log: indefinite (compliance). Idempotency keys: 24 hours. On account deletion, we delete within 90 days, except where legal obligations require longer (e.g. financial records: 5 years per UAE FTA requirements).
8. Your rights
Under UAE PDPL, GDPR, and similar laws, you can access, correct, export, delete, or port your data. Email us at hello@bina.so from your registered email address. We respond within 30 days.
9. Cookies
See our Cookies Policy.
10. Children
Bina is not directed at children under 16. If you believe a child has signed up, contact us.
11. Changes
We notify material changes by email at least 14 days before they take effect.