Antonio&I Jewelry Service
Privacy Policy
1. Scope
This Privacy Policy applies to the Jewelry Service mobile application and the supporting backend services operated for Antonio&I Jewelry Service (collectively, the “Service”).
The Service is an internal customer relationship management and workshop operations system. It is primarily intended for authorized employees, contractors, and other approved personnel. The Service may also contain information about customers whose jewelry service or manufacturing orders are recorded by authorized users.
In this Policy, “Account User” means a person who signs in to the application. “Customer” means a person whose information is entered into the CRM in connection with an order or service request.
2. Who is responsible for your information
The Service is operated by Antonio&I Jewelry Service. For privacy questions, requests, or complaints, contact:
Email: antonio.best.jewelry.service@gmail.com
Where applicable law identifies another entity as the data controller for employee, contractor, or customer records, that entity may have additional privacy obligations and policies.
3. Information we process
3.1 Account and authentication information
Depending on how you sign in, we may process:
- Firebase authentication identifiers;
- email address and email verification status;
- phone number and phone verification information;
-
Google Sign-In account information made available through the
requested
emailandprofilescopes; - authentication provider information and account security state.
Passwords are handled by the authentication provider. The Service does not store plaintext account passwords in its application database.
3.2 Profile and employment-related information
The CRM may store profile information such as:
- first and last name;
- profile photo;
- email address and phone number;
- birth date and gender, when provided;
- preferred language and time zone;
- workshop assignment, position, approval status, and related administrative records;
- notification preferences and push-notification token.
3.3 Customer and order information
Authorized Account Users may enter customer and order information needed to provide jewelry services. This can include:
- customer first and last name;
- customer phone number;
- order number, workshop, status, payment status, and order dates;
- order notes;
- service and manufacturing details;
- jewelry materials, fineness, colors, inserts, weights, measurements, and related technical information;
- promo or discount information;
- order photos and other permitted order media.
The Service records operational payment amounts and payment status. It is not designed to store payment-card credentials such as full card numbers, CVV codes, or online-banking passwords.
3.4 Internal communication data
The Service includes direct and group chat functionality. We may process:
- chat messages and edits;
- message reactions, replies, delivery/read status, and timestamps;
- chat membership and role history;
- group titles and avatars;
- files, images, and other chat attachments uploaded by users.
3.5 Device, session, and security information
To authenticate sessions, prevent abuse, and protect sensitive operations, the Service may process:
- device identifier generated for the application;
- platform, device model, operating-system version, and app version;
- user-agent information;
- IP address;
- session start, last-seen, and end timestamps;
- app and device integrity signals, including Google Play Integrity or platform-equivalent attestation results;
- security signals used to determine whether a sensitive action should be allowed, rejected, or require additional verification.
The current application does not request device GPS/location permission for the CRM workflow. An IP address may nevertheless reveal an approximate network location.
3.6 Diagnostics and performance data
We use operational diagnostics to maintain reliability and security. Depending on the event, this may include crash reports, stack traces, performance traces, app version, device characteristics, error metadata, and technical logs.
3.7 Biometric authentication
If you enable local biometric authentication, the biometric comparison is performed by your device operating system. The Service does not receive or store your fingerprint, face template, or other biometric template.
4. Sources of information
We receive information from:
- you, when you create or update your account and profile;
- authorized Account Users, when they create customer records, orders, chats, files, or operational records;
- authentication and platform providers such as Firebase Authentication and Google Sign-In;
- the application and your device when security, session, crash, or performance telemetry is generated;
- backend systems that create audit, message-status, order-status, and security records as part of normal use.
5. How we use information
We process information to:
- create, authenticate, and secure user accounts;
- approve and manage authorized personnel;
- maintain employee/workshop profiles and operational assignments;
- create and manage jewelry service and manufacturing orders;
- maintain customer service history and order records;
- provide internal direct and group messaging;
- store and deliver permitted profile, chat, and order media;
- send service and operational notifications;
- remember language, time-zone, and notification preferences;
- prevent fraud, abuse, unauthorized access, malicious file uploads, and account compromise;
- diagnose crashes, errors, and performance problems;
- enforce permissions, security policies, and audit requirements;
- comply with legal, accounting, employment, and dispute-resolution obligations.
We do not use the Service to sell personal data or to deliver third-party behavioral advertising.
6. Legal bases for processing
The legal basis depends on the relationship and applicable law. Where the GDPR, UK GDPR, or similar rules apply, processing may rely on one or more of the following:
- Performance of a contract or steps necessary to provide the Service and fulfill jewelry-service operations;
- Legitimate interests, including secure operation of the CRM, fraud prevention, access control, internal communication, service quality, and business administration;
- Legal obligations, including accounting, tax, employment, dispute-resolution, and recordkeeping duties;
- Consent where consent is required by applicable law for a particular optional feature or device permission.
If information is processed in an employment or contractor context, additional lawful bases under applicable employment and data-protection law may apply.
8. File uploads and malware scanning
Profile photos, chat attachments, chat avatars, and order media may be uploaded to restricted storage and, where the feature requires it, temporarily placed in a quarantine area before publication.
Uploaded files can be checked by a dedicated malware-scanning service. The scanner may receive a short-lived, signed link to the quarantined object together with technical file information such as size, MIME type, and cryptographic hash. Files that fail security validation may be rejected and deleted.
Users must not upload malware, executable payloads disguised as documents or images, unlawful content, or information they are not authorized to process.
9. Security and integrity controls
We use technical and organizational measures intended to reduce the risk of unauthorized access, alteration, disclosure, or destruction, including:
- authenticated access and account verification;
- role- and membership-based authorization;
- database row-level security and private storage policies;
- server-side authorization for sensitive operations;
- Firebase App Check and device/app integrity verification;
- single-use or action-bound security checks for selected sensitive actions;
- malware scanning and quarantine for supported file uploads;
- security, session, and audit logging;
- restricted backend credentials and service-to-service authentication.
No security measure can guarantee absolute security. Users are responsible for protecting their devices, credentials, and access to the Service.
Automated security checks may block or delay a sensitive operation when the app, account, session, or device does not meet security requirements. These checks are used for security and access control, not to make employment-performance decisions.
10. Data retention
We retain information only for as long as reasonably necessary for the purposes described in this Policy and for applicable business, legal, accounting, security, and dispute-resolution requirements.
Retention periods vary by data type. For example:
- profile and account information is generally retained while an account is active and may be deleted or de-identified after account removal, subject to mandatory retention requirements;
- order and customer records may be retained for warranty, accounting, tax, audit, fraud-prevention, and dispute-resolution purposes;
- chat and attachment records may be retained where required for operational continuity, security, investigation, or organizational recordkeeping;
- security, session, crash, and performance records are retained for the period reasonably required to protect and maintain the Service;
- temporary quarantine files and unreferenced file objects may be removed automatically after operational grace periods.
Deleting an Account User does not necessarily delete independent customer, order, accounting, audit, or business records that must be preserved. Where appropriate, references to a deleted user may be removed, anonymized, or retained in a limited form needed to preserve record integrity.
11. Your privacy rights
Depending on your location and the applicable law, you may have rights to:
- request access to personal information concerning you;
- request correction of inaccurate or incomplete information;
- request deletion where there is no overriding reason to retain the information;
- request restriction of certain processing;
- object to processing based on legitimate interests;
- request data portability where applicable;
- withdraw consent where processing is based on consent;
- submit a complaint to a competent data-protection authority.
Account Users can change certain profile and account information from within the application. The Service also provides an account-deletion flow protected by reauthentication and security checks.
To exercise a legal privacy right that is not available directly in the application, email antonio.best.jewelry.service@gmail.com . We may need to verify your identity and authority before completing a request.
12. International processing
Our technology providers may process or store information in countries other than the country where an Account User or Customer is located. Where required by applicable law, we rely on appropriate contractual, organizational, or legal safeguards for such transfers.
13. Children
The Service is an internal business CRM and is not directed to children. Accounts should be created only for persons authorized to perform work or business functions for Antonio&I Jewelry Service.
14. Changes to this Policy
We may update this Privacy Policy when the Service, applicable law, or our processing practices change. The “Last updated” date at the top of the page indicates the latest revision.
Material changes may also be communicated through the application or another appropriate channel.
15. Contact
For privacy questions, data-subject requests, or concerns about the Service, contact:
Antonio&I Jewelry Service
Email:
antonio.best.jewelry.service@gmail.com