Privacy Policy

The people whose information appears in the Dashboard are Shootz staff and, in aggregate, Shootz guests. Access is restricted to authorized employees and contractors of Shootz. If you are a restaurant guest looking for the policy that governs ordering and marketing, that is a separate policy published on our guest-facing website.

Account information

When an administrator invites you, we store your name, work email address, assigned role, and location assignments. Authentication is handled by Clerk; if you sign in with Google or Slack, we receive your basic profile from that provider in order to establish the session. If you choose to connect your own LinkedIn account, we also store the LinkedIn identity and token described in the LinkedIn section below.

Business operations data

The Dashboard aggregates operational data from the systems Shootz runs on — point of sale, scheduling and time tracking, online ordering, guest feedback, marketing platforms, and accounting. This includes sales, labor, scheduling, and marketing performance records.

Usage information

We keep standard server and application logs, including IP address, browser type, and pages accessed, to operate and secure the service.

• To operate, secure, and support the Dashboard.
• To produce internal reporting on sales, labor, marketing, and guest experience.
• To publish marketing content we own to accounts Shootz controls (see the YouTube section below).
• To help staff who choose to connect their own LinkedIn account find public posts worth joining, draft comments and posts in their own voice, and publish them from that account (see the LinkedIn section below).
• To meet legal, accounting, and tax obligations.

We do not sell personal information, and we do not use the data in the Dashboard to build advertising profiles of individuals.

The Dashboard uses YouTube API Services to publish Shootz’s own marketing videos to a YouTube channel that Shootz owns and controls. By connecting a channel to the Dashboard, you agree to be bound by the YouTube Terms of Service. Google’s handling of your information is described in the Google Privacy Policy.

What we access

An administrator connects a channel through Google’s OAuth 2.0 consent screen, granting the youtube.force-ssl scope. With that authorization the Dashboard can upload videos to the connected channel, read the metadata and public statistics of videos it uploaded, and change the privacy status of those videos.

What we store

• OAuth tokens — the access and refresh tokens for the connected channel, held encrypted in our database’s secret vault and never exposed to browsers or third parties.
• Channel identity — the channel ID and title, so the Dashboard can show which channel is connected.
• A publishing record — for each video we upload: its title, description, tags, privacy status, upload status, the YouTube video ID, the source file name, who requested it, and timestamps.

What we do not do

• We do not collect or store information about YouTube viewers, their watch history, or their activity.
• We do not access channels other than the one an administrator explicitly connects.
• We do not sell, rent, or transfer YouTube data to any third party, and we do not use it for advertising or targeting.
• We do not use YouTube data to train machine-learning models, and we do not combine it with data from other sources to profile individuals.

Retention and deletion

OAuth tokens are deleted from our systems immediately when a channel is disconnected. The publishing record is retained as an operational record of what we posted and can be deleted on request by contacting us at the address below.

The Dashboard lets individual Shootz staff connect their own LinkedIn account so they can comment on public LinkedIn posts and publish posts from that account, with help drafting the text. Unlike the YouTube connection, a LinkedIn connection belongs to the person who made it, not to Shootz. Connecting is optional and is started by the person from their Account page. Your use of LinkedIn through the Dashboard remains subject to the LinkedIn User Agreement and the LinkedIn Privacy Policy.

What we access

You connect through LinkedIn’s OAuth 2.0 consent screen, granting the r_basicprofile, w_member_social and w_member_social_feed permissions. With that authorization the Dashboard can read your LinkedIn member ID, name, headline and public profile URL, and can create posts and comments on LinkedIn as you. It cannot read your feed, your connections, your messages, or the comments other people leave on your posts.

What we store

• OAuth token: the access token LinkedIn issues for your account, held encrypted in our database’s secret vault and never exposed to browsers or third parties. LinkedIn tokens expire after 60 days and are not renewed without you reconnecting.
• Your LinkedIn identity: your member ID and display name, so the Dashboard can show which account is connected and author posts as you.
• Your topics and voice profile: the search phrases you ask us to watch, and the short profile you write describing your niche, what you are building, and how you write. Later versions of the voice profile may be proposed from how you edited earlier drafts; every version is kept and you can restore any of them.
• Public posts we found for you: for each public LinkedIn post surfaced to your queue, the author’s public name, headline and profile URL, the post text, its public engagement counts, and a relevance score. Queue items expire seven days after the post was published.
• A publishing record: every draft we generated for you, the final text you actually published, LinkedIn’s ID for the resulting comment or post, and timestamps.

How drafting and discovery work

Public posts are found by searching public LinkedIn content through a third-party data provider (Apify). We never use your LinkedIn credentials, token, or session to browse or search LinkedIn. To score relevance and draft text, we send the public post, your voice profile, and any notes you typed to Anthropic’s Claude models. Nothing is published to LinkedIn unless you press Comment or Publish in the Dashboard, or you yourself invoke the equivalent Shootz IQ tool.

What we do not do

• We do not post, comment, or react on your behalf without your explicit action.
• We do not read or store your LinkedIn feed, connections, messages, or private activity, and we do not collect information about other LinkedIn members beyond what is publicly shown on a post you see in your queue.
• We do not sell, rent, or transfer LinkedIn data to any third party, and we do not use it for advertising or targeting.
• We do not use LinkedIn data to train machine-learning models. Your voice profile is used only to draft text for you.
• Other staff cannot see or use your connection. Each person’s token, queue, topics, and voice profile are their own.

Retention and deletion

Your OAuth token is deleted from our systems immediately when you disconnect, and expires on its own after 60 days. Discovered posts leave your queue after seven days. Your topics, voice profile, and publishing record are retained as an operational record of what was posted and can be deleted on request by contacting us at the address below.

The Dashboard integrates with services Shootz uses to run the business, including Toast, 7shifts, Restaurant365, Lunchbox, Ovation, Meta, Google, Slack, Customer.io, LinkedIn, Apify, and Anthropic. Each processes data under its own agreement with Shootz. We share information with these providers only as needed to operate the business and to provide the features described above.

Access requires an invited account and is limited by role, so users see only what their role permits. Credentials and API tokens are stored encrypted in a dedicated secret vault. Connections are encrypted in transit. Administrative actions taken through the Dashboard’s automation tools are logged.

Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, and to object to certain processing. To exercise any of these rights, contact us at the address below and we will respond as required by applicable law.

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page.

Shootz · admin@shootzhawaiian.com