Privacy at Scopy

Last updated: 28 May 2026

Scopy is a messaging assistant used by restaurants and spas to handle customer messages on WhatsApp. This page explains what data we hold, why we hold it, and how to remove it. It's intentionally short — if anything isn't clear, email privacy@scopy.helpand we'll answer plainly.

Who's who

When you message a restaurant or spa through WhatsApp, that business is the data controller — they decide why your data is collected (so they can serve you). Scopy is the data processor— we hold the data on their behalf and run the Scopy software. Both of us have responsibilities under privacy laws (GDPR if you're in Europe; UU PDP if you're in Indonesia; similar laws elsewhere).

What we collect

• Your WhatsApp number and display name — sent to us automatically by WhatsApp when you message the business. We need this to reply to you.
• The messages you send — to understand what you want and respond.
• Your reservation details if you book — date, time, party size, any notes you share.

For restaurant/spa staff who sign in to the Scopy app: email address (for sign-in) and a display name you choose. No password — we use one-tap email links.

What we don't collect

• Your WhatsApp contacts, photos, or other chats. We only see messages you send to the business's number.
• Payment information. If you pay the business, that happens outside Scopy (in person, via their own payment processor).
• Tracking cookies. The Scopy staff app uses only a session cookie to keep you signed in. No third-party analytics, no ads, no fingerprinting.

Who can see your data

• The business you're messaging— their staff can read your messages and reservations through the Scopy app. They use this to serve you. They can't see customers of other businesses.
• Scopy's infrastructure providers— your data is stored on Supabase (database, hosted in Seoul) and processed through n8n on Hetzner (servers in Germany). The AI replies are generated by Anthropic via OpenRouter. These providers process data on Scopy's behalf and can't use it for their own purposes.
• Nobody else.We don't sell or share your data with marketers, advertisers, or third parties.

How long we keep your data

• Conversations: deleted automatically 90 days after your last message, unless you have a future reservation. (Conversations tied to upcoming reservations stay until the visit happens.)
• Reservations: kept as long as the business keeps you as a customer (typically for their accounting and follow-up). Ask the business if you want yours removed.
• Scopy mistakes or complaints(rare): kept longer if needed for safety or audit purposes. We'll document if we ever do this.

Removing your data

The fastest way: message Scopy the word /forget (or “delete my data” or “supprime mes données”). Scopy will confirm, then delete all your conversations and messages on that business's account within 24 hours. You'll lose past chat context if you message them again, but your future visits aren't affected.

If you want to be removed from a business's reservation records too, ask the business directly — those records belong to them, not Scopy.

Prefer email? Write to privacy@scopy.help with the WhatsApp number you messaged from. We'll process the request within 5 business days.

Your other rights

You have the right to:

• See what data we hold about you
• Correct anything inaccurate
• Object to how we process your data
• Complain to your local data protection authority

Email privacy@scopy.help for any of these.

Security

Your data is encrypted in transit (HTTPS / TLS) and at rest (Supabase + Hetzner disk encryption). Access to the Scopy staff app requires sign-in via a one-tap email link — there's no password to steal. We keep daily backups, retained for 30 days.

We're a small team. If a security incident affects your data, we'll email you and the affected business within 72 hours of discovering it.

Changes to this policy

If we make material changes, we'll update the “Last updated” date above and email anyone affected. The current version is always at scopy.help/privacy.

Contact

Privacy questions: privacy@scopy.help
General support: support@scopy.help

Scopy is operated by Steven (sole proprietor, based in Bali, Indonesia). This page is written in plain English in good faith. It is not legal advice; if you need a binding interpretation under your local law, talk to a lawyer.