Terms and SECURITY for Restaurant Management Wix App

Prepared from repository evidence, 26 October 2026. Use these facts to answer the actual dashboard questionnaire. Question wording and production controls must be checked there. This is not a security certification or an approval of the questionnaire. 1. Application purpose Restaurant walk-in waitlist, guest queue status, table reservation timeline and eligible guest reservation changes/cancellations. 2. Personal information Yes: optional waitlist guest name, phone and notes; native reservation data is read for restaurant operations, and a guest cancellation reason may be stored. A free-text note or reason can contain sensitive information. Do not answer "no personal data" or "no sensitive data possible". Evidence: src/extensions/backend/data-collections/waitlist-entries.ts, reservation-notes.ts; src/backend/repositories/table-reservations-mapping.ts. 3. Infrastructure Uses Wix-hosted app infrastructure, Wix Table Reservations and Wix Data. Production storage region, provider contracts, administrator access, backups and log retention need owner/Wix confirmation. 4. Authentication and isolation Dashboard operations resolve Wix caller/site context on the backend and use a tenant/instance identifier. Guest operations use random bearer-link tokens, with only hashes stored server-side. Guest links are credentials; they are not a separate guest account/password system. Evidence: src/backend/lib/tenant.ts, src/backend/lib/link-token.ts, src/backend/repositories/tenant-collection.ts. 5. Encryption The waitlist collection schema marks guestName, guestPhone and note encrypted. Do not expand this into a claim that every stored field/log is encrypted by this application. Transport, production configuration and backup controls need verification. 6. Browser storage and embedded code Guest tokens can be retained in sessionStorage. The dashboard remembers a location in localStorage. The app attempts to strip the token query parameter from the visible URL. The guest script is declared ESSENTIAL. No advertising/analytics implementation was identified in src; Wix and site-level behavior must be assessed separately. Evidence: src/hooks/guest-token.ts, location-memory.ts, browser-wiring.ts; guest-status.extension.ts. 7. Retention and uninstall Closed waitlist entries: 90-day eligibility; opportunistic bounded cleanup when a party is added. Guest links: expiry plus opportunistic cleanup. No deletion guarantee at an exact timestamp. Uninstall handler logs and deletes nothing explicitly. Confirm operational removal/export and Wix's platform lifecycle before approving deletion/retention answers. Evidence: src/shared/constants/waitlist.ts, link-token.ts; src/backend/services/waitlist-purge.ts, guest-link-purge.ts, install.ts. 8. Logs and crash reporting A redaction utility masks key fragments associated with personal data, secrets, tokens and free text. A Wix monitoring integration can send crash reports if configured; Sentry activation and actual production recipients are unverified. Do not claim logs can never contain personal data or that monitoring is definitely inactive. Evidence: src/shared/constants/logging.ts; src/backend/lib/log-redaction.ts; src/hooks/crash-report.ts. 9. Payments Application source uses Wix App Instance subscription data to gate app features. No guest card-storage/payment-collection implementation was identified. Paid app plans and checkout remain unverified because PACKAGE_PLAN is empty. Do not claim PCI certification or tested billing. 10. Owner details and answers still required Company/brand supplied: saxsos. Contact supplied: coder.sagor@gmail.com. This inbox is the draft privacy contact; confirm its monitoring and role. Legal provider identity and postal address; public privacy/terms URLs; actual hosting regions and transfers; operational deletion/export route; subprocessors; logging/backup retention; incident response contact/procedure; production consent configuration; whether any other company tools receive app/guest data. Do not invent these answers or approve attestations from this worksheet alone.