Privacy Policy

Data controller

The party responsible for processing the data is Francisco Marín, owner of Ninaku, operating in Ecuador. We process personal data in accordance with Ecuador's Organic Law on the Protection of Personal Data (LOPDP) and other applicable regulations.

For any privacy-related questions you can write to us at support@ninaku.io.

Data we collect

We collect the data needed for the system to work and for your business to operate:

• Staff account data: name, email, phone and password.
• Business and operational data: branches, menus, products, inventory, tables, orders, business customers, sales, payments and credit accounts or installments.
• Receipt images: photos taken with the camera or selected from the gallery as proof of payment or delivery.
• Device location: used only to place the delivery address on the map.
• Push notification tokens (Expo, APNs, FCM) to send alerts to your team.
• Technical device data: model, operating system and basic diagnostic data.
• E-invoicing data: the end customer's tax details that are transmitted to the SRI as required by law.

How we use the data

We use the data for the following purposes:

• Providing and operating the service: managing orders, payments, inventory, invoicing and reports.
• Creating and managing staff accounts and their permissions.
• Sending operational notifications (new orders, kitchen statuses, payments, deliveries).
• Issuing electronic receipts and meeting tax obligations before the SRI.
• Providing support, resolving issues and improving how the system works.
• Ensuring the security of the service and preventing fraud or misuse.

Device permissions

The mobile app requests certain permissions only when they are needed for a specific feature:

• Camera: to take photos of payment or delivery receipts.
• Photos and gallery: to select receipt images already saved on the device.
• Location: only to place the delivery address on the map during delivery.
• Notifications: to alert your team about orders, kitchen, payments and deliveries.

Who we share data with

We do not sell your data. We only share it with providers who help us deliver the service, and only to the extent necessary:

• Hosting and cloud infrastructure providers where the system is hosted.
• Push notification services (Expo, Apple APNs, Google FCM).
• Google Maps, to display and locate delivery addresses.
• Ecuador's Internal Revenue Service (SRI), for the e-invoicing required by law.

Transfers and the SRI

When you issue electronic receipts, the end customer's tax details are transmitted to the SRI because Ecuadorian law requires it. Some of our infrastructure providers may process data outside Ecuador; in those cases we apply the safeguards required by data protection regulations.

Data retention

We keep account and operational data for as long as your account is active. Tax and invoicing data is kept for the period required by Ecuadorian law, at least seven (7) years. When a piece of data is no longer needed and there is no legal obligation to keep it, we delete it or anonymize it.

Security

We apply reasonable technical and organizational measures to protect the data: encryption in transit, role-based access control, backups and good development practices. No system is completely foolproof, but we work to reduce risks and protect your information.

Your rights (LOPDP)

Under the LOPDP, as a personal data subject you have the right to:

• Access: knowing what data of yours we process.
• Rectification: correcting inaccurate or outdated data.
• Deletion: requesting the erasure of your data where applicable.
• Objection: objecting to certain types of processing.
• Portability: receiving your data in a structured, commonly used format.

How to exercise your rights

To exercise any of these rights, write to us at support@ninaku.io from the email associated with your account. We will respond within the time frames set by law. Some data, such as that required by tax obligations, may be retained even if you request its deletion.

Minors

Ninaku is a management tool for businesses and is not directed at minors. We do not knowingly collect personal data from minors.

Changes to this policy

We may update this Privacy Policy to reflect changes in the service or in regulations. We will publish the current version on this page and indicate the date of the last update.

Contact

If you have questions about this policy or about how your data is processed, write to us at support@ninaku.io or visit https://ninaku.io.