PRIVACY POLICY

SHABANG connects local businesses with local people who promote them. What we hold about you depends on which you are:

• Ambassadors — people who complete marketing tasks and refer customers, and are paid for approved work.
• Businesses — the people who open and run a business account.
• Customers — people referred to a business, who book and pay it. If that is you, read § 4: most of what we hold about you came from the business or from the person who referred you, and the business decides what happens to it.

Everyone who signs up: your phone number (used to verify your account), a handle and optional avatar and bio, an age self-confirmation (a yes/no confirmation that you are 18+ — we do not collect your date of birth), and, if you enable notifications, a push subscription for your device.

If you are an ambassador: the neighborhoods you can cover, the interests and the social accounts or local groups you say you can post to, the work you submit (posts, links, photos, videos, and screenshots you upload as proof), and the details of referrals you submit. To pay you, Stripe collects your identity and taxpayer information — including your legal name, address, date of birth, and taxpayer identification number — directly, for its own verification and for the tax forms we are required to file; SHABANG receives a confirmation that you are verified and payable, not those documents.

If you run a business account: the business name, category, description, service area, address or coverage radius, website or Google Business Profile link, contact email and phone, logo and photos, the credit you load and spend, and the settings you choose. Stripe collects your business's payment and verification details directly, as above.

Collected automatically: device and usage information (pages viewed, general performance and analytics events) and, if you grant permission, your device's approximate location, used to show work and businesses near you.

Payment information: card and bank details are collected and processed directly by Stripe, our payment processor. SHABANG never receives or stores a full card number. For one anti-fraud check — confirming that an ambassador did not pay for their own referral — we compare Stripe's irreversible card fingerprint, a scrambled identifier for a card, never the card number itself.

If you book through a referral link: you are paying the business, and the business is the merchant on that charge. We see what you paid, when, and whether it was refunded or disputed — we do not see your card. Because an ambassador is owed a commission on that booking, our platform fee is deducted from the payment on its way to the business; what that means for your money is nothing at all, and our Terms (§ 8) describe it.

We do not knowingly collect information from anyone under 18. The Service requires self-confirmed age 18+ to create an account at all. If you believe a minor has an account, email us and we will delete it.

We use the information above to:

• Operate your account and show you relevant work or ambassadors nearby;
• Hold, spend, refund, and reconcile marketing credit, and pay ambassadors;
• Show a business real availability and write a confirmed booking to its calendar;
• Review submitted work against what the task required;
• Moderate uploaded photos, videos, and text for prohibited content;
• Check that a referral is genuine — comparing the details submitted against the business's existing customers, against referrals already submitted, and against the ambassador's own details, so that no one is paid for referring themselves or someone already a customer;
• Detect and prevent fraud, multiple accounts, and abuse — including, where location checks are on, the country of your connection and of your phone number, and the sign-up signals your device sent when you registered;
• Send transactional messages (work approved, booking confirmed, payout sent);
• Meet our tax, accounting, and legal obligations; and
• Maintain and improve the Service's reliability and security.

We do not sell personal information, and we do not use a business's customer information, or a referred customer's details, to market anything of our own.

A business may upload its existing customer list, so those people are never counted as new referrals and so the business can ask us to send them a review request. An ambassador submitting a referral gives us the customer's name and contact details, and a customer who books gives us their appointment and what they paid.

For this information, the business is in charge and we act on its instructions. We use it only to do what the business asked — check referrals against it, send a message it asked us to send, show it its own bookings — and for the security and recordkeeping described here. We do not use it for our own marketing, do not give it to another business, and do not sell it.

A business that uploads customer information is responsible for having the right to provide it to us and for the messages it asks us to send, as its Terms (§ 10) set out.

A review request carries a one-click opt-out. Every review-request email we send on a business's behalf has an unsubscribe link in it. One click stops them permanently, from that business and from any other, and no business can override it or switch it back on. We keep a record that the opt-out was honoured — that record is the proof it worked, and it is why the row is not simply deleted. The same message goes to everybody on the list who has not opted out: we are never given, and cannot act on, a rating, a score, or a guess about who would leave a good review.

If you are a referred customer: the ambassador who referred you gives the business your name and the phone number or email you agreed could be passed on, so the business can reach you about the appointment. Message us at manager@greenlightning.biz to have your details removed from the Service, or ask the business directly — we will act on either.

We share information with the following service providers, only as needed for them to perform their function for us, and never for their own independent marketing use:

• Stripe — payments, identity verification, and payouts
• Clerk — account authentication
• Google — calendar availability and bookings, for a business that connects its calendar (see § 6)
• Amazon Web Services (Rekognition and S3) — automated moderation of uploaded photos and videos, and storage of the video a chat attachment is served from
• OpenAI — automated moderation of uploaded text
• Twilio — screening a phone number for disposable-number and fraud signals at sign-up
• Mapbox — turning the coordinates or address you provide into an approximate city and state
• Resend — delivering transactional and review-request email
• GIPHY — in-chat GIF search — your search terms go to GIPHY when you use it, and no other account data is shared with it
• Vercel Analytics — aggregate usage and performance measurement

We also share what the Service is for: a business sees the work done for it and the referrals submitted to it, including the customer details needed to contact and book that customer; an ambassador sees whether their work was approved. We may disclose information if required by law, subpoena, or to protect the rights, safety, or property of SHABANG or others.

A business can connect its Google Calendar so the Service can offer the times it is genuinely free and write a confirmed booking back. We request the narrowest access that allows this: the ability to read when the calendar is busy, and the ability to create and manage only the events this Service created. We do not read the contents, titles, guests, or attachments of your other events, and we do not touch events we did not create.

SHABANG's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely: we use Google Calendar data only to provide the booking feature you connected it for, we do not use it for advertising, we do not sell it, we do not let humans read it except with your explicit permission or where required by law or for a specific security investigation, and we do not use it to train generalized artificial-intelligence models. You can disconnect the calendar at any time in your business settings, which revokes our access, and you can also revoke it from your Google account's permissions page.

We keep account and transaction information for as long as your account is active and as needed afterward to satisfy tax, accounting, and legal recordkeeping obligations — payment and payout records in particular, which we are required to retain.

A referred customer's contact details are kept while the referral is live, through the period in which a bounty can still be voided or disputed, and afterwards as part of the record of a payment that was made. An uploaded customer list is kept until the business deletes it, deletes that customer, or closes its account — all three are available to the business today, and we will do any of them on request from the customer as well.

We should be plain about what that means: there is no automatic clock. Nothing in the Service deletes a customer's details on a schedule today, and we would rather say so than describe a sweep that does not exist. Deletion happens when someone asks for it, and when a business removes a list or an account. Setting a retention schedule — for this and for proof of work below — is an open decision, and this section is where it will be stated.

Proof of work — the screenshots and links ambassadors submit — is kept at least until the work has been reviewed and paid and any dispute window has closed. The final retention period beyond that is still being decided, and we will state it here rather than keep it indefinitely by default.

We use cookies and similar technology for the things the Service cannot work without — keeping you signed in, and security — and Vercel Analytics to understand how the Service is used in aggregate. We do not run advertising on the Service and do not use advertising cookies. Because we do not use cookies for advertising or profiling, we do not currently offer a separate cookie-preferences control; we will add one and update this section if that changes.

You can review and update your handle, avatar, bio, and the details of your account or business directly in your settings at any time, and disconnect a connected calendar there.

For anything else — a copy of the personal information we hold about you, a correction, or deletion of your account and associated data — email manager@greenlightning.biz from the email address or phone number on your account. We will verify your identity and fulfill eligible requests within a reasonable time. This is a manual process today; there is no self-service deletion button yet. Some information must be retained even after a deletion request where we have a legal or accounting obligation to keep it, such as records of a completed payment or payout.

Depending on where you live, you may have additional rights — to know what we hold, to have it corrected or deleted, to a portable copy, to opt out of sale or targeted advertising (we do neither), and not to be discriminated against for exercising them. California residents have these rights under the CCPA as amended. The contact process above is how to exercise any of them, and you may use an authorized agent.

You can turn off notifications in your device or browser settings, and you can revoke location permission at any time — the only consequence is that nearby work and businesses will not be shown to you.

We use reasonable administrative and technical safeguards, including restricting which parts of our system can read sensitive fields such as a customer's contact details, keeping payment credentials with our processor rather than in our own systems, and recording money movements in an append-only ledger that cannot be quietly edited. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. If we make a material change we will update the effective date above and, where practical, notify you in-app. Continuing to use the Service after a change takes effect means you accept the updated policy.

Shabang Technologies, Inc. — Florida, United States
Email: manager@greenlightning.biz