Privacy Policy

Website and demo requests. When you request a demo we collect your name, store name, email address, phone number, and any message you write. The demo form is delivered to us by Web3Forms, a third-party form service, which processes the submission to deliver it to our inbox.

Dashboard accounts. Accounts are created by invitation. We store your email address, your role (administrator, store owner, or staff), the store you belong to, and authentication records. Authentication is handled by Supabase.

Store information. Your store's name, address, time zone, PLU catalog and any store-specific item names, codes, and display settings you configure.

Scan Data. Each time produce is placed on the scale, the kiosk captures an image of the scale area and uploads it together with metadata: the item the model identified, its confidence, the PLU code entered, which variant a cashier selected, whether a cashier corrected the result and to what, the device that captured it, and the time. Images are stored in Cloudflare R2; the metadata is stored in Supabase.

Device telemetry. Kiosks periodically report their online status, CPU temperature, camera status, free disk space, installed software and model versions, and diagnostic log messages. Log messages describe the kiosk's operation and do not intentionally include personal information.

Support. When you open a support thread in the dashboard we store the messages and any attachments you upload.

Technical data. Our hosting provider (Vercel) and our authentication provider record standard server logs, including IP address, browser type, and the pages requested, for security and operations.

The kiosk camera is aimed at the checkout scale to photograph produce. Because of where it sits, an image may incidentally include a hand, a sleeve, or another part of a person placing an item on the scale. The kiosk does not record video, audio, or the checkout area beyond the scale, and it does not attempt to identify, recognise, or track people. Shalyx does not perform facial recognition and does not build profiles of shoppers or employees.

Images are used to identify produce and to improve our recognition models. The store that operates the kiosk is responsible for any camera notice or consent that the law where you are requires. Questions about a specific store's use of the kiosk should be directed to that store.

• To provide and operate the Service: identify produce, send PLU codes, show scans and analytics in the dashboard, and deliver updates and commands to devices.
• To improve recognition: Scan Data, including images and staff corrections, is used to train, evaluate, and improve our machine-learning models. This is a core part of how the Service gets better over time.
• To support customers: respond to demo requests and support threads, send account invitations and service emails, and alert customers when a device goes offline or reports a fault.
• To keep the Service secure and reliable: monitor device health, detect abuse, and investigate problems.
• To bill for the Service and comply with our legal obligations.

We do not sell personal information and we do not use it for third-party advertising.

We share information only with service providers that process it on our behalf to run the Service:

• Supabase — database, authentication, and storage for dashboard and device data.
• Cloudflare — object storage (R2) for scan images and software releases.
• Vercel — hosting for the website and dashboard.
• Resend — delivery of transactional email such as account invitations and offline alerts.
• Web3Forms — delivery of demo request submissions from the website.

We may also disclose information when required by law, to protect the rights or safety of Shalyx, our customers, or others, or as part of a merger, acquisition, or sale of our business, in which case this policy continues to apply to the information transferred.

Scan Data, including images, is retained for as long as it is useful for training and improving our models, which may be indefinitely, including after a customer's subscription ends. It is not deleted when a subscription ends.

Device health readings are kept for 15 days and then deleted. Diagnostic logs and command history are kept in our live database for a short operational window (currently 5 and 30 days) and then moved to compressed archival storage.

Account information is retained while the account exists and for a reasonable period afterwards for record-keeping. Demo requests and support threads are retained while we have a business reason to keep them.

Data travels between kiosks, the dashboard, and our cloud over encrypted connections. Each kiosk authenticates with its own credential, which we store only as a hash. Dashboard access is limited by role, so a store's users see only that store's data. Software releases sent to kiosks are cryptographically signed and verified on the device before installation. No system is perfectly secure, and we cannot guarantee the security of information.

Dashboard users can update their account information through the dashboard or by contacting us. A customer can ask us to remove a user's account or to delete the store's account information when the subscription ends.

Scan images are owned by Shalyx and are not personal data about an identified individual; we do not maintain the ability to look up images by person. If you believe an image identifies you and you want it removed, contact us with enough detail to locate it and we will consider the request.

Depending on where you live you may have additional rights under local law, such as the right to access, correct, or delete personal information, or to object to certain processing. To exercise any right, email support@shalyx.com. We will respond within the time required by applicable law.

The dashboard uses cookies only to keep you signed in. The public website does not use advertising or tracking cookies. If you install the dashboard as an app on a phone or computer, it stores a small amount of data on your device to make it launch faster; it does not cache your store's data.

The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Our service providers store and process data in the United States. If you access the Service from elsewhere, your information will be transferred to and processed in the United States.

We may update this policy as the Service changes. We will post the updated policy at shalyx.com/privacy and update the date above, and for material changes we will notify customers by email.

Questions about this policy or about your information: support@shalyx.com.