Privacy Policy — Local Plus

Last updated: 13 October 2026 · Made by KiraZone · support@kirazone.xyz

This policy is written to be read by a merchant, not by a lawyer. Where a sentence could be read two ways, the narrower reading is the one we mean.

The short version

AI picture tools, including on-device AI background removal, are temporarily paused for the initial Business rollout. No new photo or prompt is sent to an AI provider while these tools are paused. Existing photos and designs remain available.

Your sales stay on your phone. Everything the till does — recording sales, counting stock, working out your profit, refunds, expenses, reports — happens on your device and is stored there. We cannot see any of it. There is no server holding your takings, except the copy in your own account that you ask for by logging in (number 7 below), which only your account can read.

Nine things leave your phone, and only when you choose them:

A report or backup you export and share. It goes wherever you send it, and nowhere else.
An AI menu photo. If you ask for a picture to be made, the dish name goes to the image provider. If you ask for a photo you took to be fixed, that photograph goes to the image provider along with what you asked for. The result comes back and is stored in your account.
A credit purchase. Google Play handles the payment; we are told only that a purchase happened — and, if Google later refunds it, cancels it or sees it charged back, that it was reversed. See "A coin purchase Google reverses".
Connecting a second phone. If you link phones so an owner can see what staff are selling, a short summary of each sale is sent so the owner's phone can show it, and the owner's items and prices go to the staff phones so they sell at the owner's prices. This keeps sending after you set it up, so it has its own section below.
Publishing a Local+ storefront. If you switch your shop on in Local+, your shop's name, its position on the map, and your menu — item names, selling prices and their photos — are put where customers can see them, with the riel your till counts a dollar as, and with your phone number only if you switch that on as well. When you ask a customer to pay for an order, the payment code you pick goes to that customer. That is the point of publishing, and it too has its own section below.
Order alerts. If you switch on "Tell me when an order arrives", this phone's notification token is sent, so an order can reach you while the app is closed. It has its own section below, which also covers the customer app.
A copy in your account. While you are logged in, a copy of your whole shop is kept in your own account — one for each phone you use it on, so one phone never writes over another's — and a lost phone is not a lost year. Logging in is how you ask for it. See "A copy in your account". Your rental bills and contract drafts are part of that book, including the names, contact details, property address, rental amounts and terms you enter. The contract maker does not publish these documents on a customer web menu.
A help request you send us. If you ask for help from inside the app, what you write — and what you link it to — comes to us, and so do our replies. So does your answer, if the app asks whether we helped and you give one; and, if you ask us to look again at a decision about you, which decision it is. See "Asking us for help".
An optional AI model download, when available. The request goes to Hugging Face and may follow a redirect to another hosting endpoint. No assistant prompt or shop record is attached. See "Local AI preparation and model downloads".

If you never use AI photos, never buy coins or start a plan, never export, never connect a second phone, never publish a storefront, never switch on order alerts, never log in and never ask us for help, nothing of your shop leaves your phone. Two small things still do, and neither is your records. The first time the app can reach our server, it gives itself an anonymous identifier — no name, no email, no phone number — and each time it opens with a signal it asks our server what that identifier holds, such as its coins. And every time either app talks to our server, Google Play Integrity checks that it is our genuine app on a genuine phone. See "Your account" and "Who else receives anything".

Local Plus Business shows a few ads, from Google. The unreleased customer app has planned placements for its future launch. Where an ad is shown, Google's ads software in the app reads the phone's advertising ID and a little more about the phone and how the app is used, and sends it to Google. A shop on its trial or a paid plan sees no ads. The ads software is not started when the shop is initially on either plan; after a free shop switches plans, further ad requests stop. See "Ads".

On Local+ we also count, for every published shop, how its orders are answered and how it is rated — from the orders, reviews and reports this page already describes, so nothing new leaves anybody's phone for it. See "How we notice problems".

Local AI preparation and model downloads

Selecting AI or AI Pro saves a choice on this device; it does not turn AI on. Production AI remains off. An in-app assistant conversation, conversation history and assistant microphone use are not integrated. The current Android assistant adapter accepts text and returns text; it does not accept photos, audio or video, or speak replies.

The choice is saved locally, outside the merchant's account copy. Downloaded model weights and the Android runtime cache use storage excluded from Android backup and device transfer. The AI setup screen can remove a downloaded model; removing it is not an account deletion.

The model-download code requests a specific pinned file from Hugging Face over HTTPS. A download requires a connection and sends the model-file request and the network address needed to deliver it. Hugging Face may redirect the request to another hosting endpoint. No assistant prompt, dictionary lookup or shop record is attached to that download request. Model downloads remain unavailable until the required device and storage checks can be satisfied; selecting a model alone does not prove it can run.

The Khmer dictionary is bundled with the app and read offline. It is a separately licensed CC BY-SA 4.0 reference pack adapted from Wiktionary contributors through Kaikki.org, with source links and a notice of changes. AI → Dictionary sources shows the attribution offline. Most definitions are English glosses; native Khmer quality has not been verified. Supplying reference entries does not train the model, correct speech recognition or qualify a voice.

What we store, and where

On your phone only

What	Notes
Products, prices, costs, recipes	Costs and recipes never leave the device. Item names and selling prices leave it in two cases: you publish a Local+ storefront, which puts your menu and its photos where customers can see it — see "Publishing a storefront"; or you connect phones, and the owner's items and prices go to the shop's own phones, never with a photo — see "Connecting a second phone".
Every sale, refund, void and expense	Stays on the device, with two exceptions you choose. On a shop with connected phones, a short summary of each sale — amount, count, seller, time, and from a staff phone which items it sold — is also sent so the owner can see it and the owner's stock can go down; refunds, voids and expenses are never sent. And if you are logged in, a copy of your whole shop is saved to your own account so you can get it back on a new phone — see "A copy in your account". Nobody but you can read it.
Stock levels and movements	Stay on the device while you are logged out, with one exception you choose: on a shop with connected phones, the owner's count of each item goes to the shop's own phones, so they stop selling what is gone. If you are logged in they are part of the copy of your whole shop described two rows above — see "A copy in your account".
Your settings — currency, exchange rate, language, business-day start	The same: on the device while logged out, and part of the copy in your account while you are logged in. This includes your shop's address, shop phone number, e-mail, tax and registration numbers, and any legacy unverified account contact phone saved in the shop settings, as well as the payment QR codes you saved — a KHQR code carries your bank account identifier, so it travels with them. Three of them can also leave with Local+, and only with it: a published storefront carries your exchange rate, and your phone number only while "Show this number to customers" is on — see "Publishing a storefront"; and the payment code you pick when you ask a customer to pay goes to that customer — see "Paying for a Local+ order".
Where your shop is	Read once, only when you tap "Use my location" on the Local+ storefront screen, and stored on the device. If you publish your storefront, that stored position is part of what is published — a customer finds your shop by where it is. Unpublish and it is no longer served. Never read in the background. It is also read when you press "call for help" or "say where you are" on the Safety screen, which shops in the transport trade have — that is the whole purpose of those two buttons, and the position is put in a text message to the contacts you chose and is not kept by us.
Photos you take with the camera	Stay on the device — unless you publish them as part of your shop's menu, or ask for one to be fixed with AI, which sends that photo. See "Publishing a storefront" below.
Product barcode scanning	The Business app uses the camera only when you open Scan. Barcode decoding runs on your device, including offline. Camera frames are not saved or uploaded. The decoded code is used to find a product in your shop; scanning alone does not record a sale or change stock. You can enter the code without granting camera access.
The menu boards you design	Never leave the device. The finished picture goes wherever you send it, and nothing else does — the dish names and prices on a board are never sent anywhere, even when the background under them was bought.
Your own recorded alert sounds	If you record your own voice for an alert in Customize → Sounds, the recording stays on this phone: it is never uploaded, never part of the copy in your account, and gone when you delete it or remove the app. The business app uses the microphone only while you record, after you tap Record. Which sound plays for which event is a setting, and travels with your other settings. A sentence read aloud is spoken by your phone's own voice; the app sends it nowhere.

Location is requested when you choose a feature that needs it. The merchant records a single shop point. The customer can find nearby shops or set a delivery destination. Neither app requests background location permission.

It is used for two different things, and which one depends on which app you are holding. As a merchant, it records a single point — where your shop is — and if you never set up a Local+ storefront it is never asked for at all. As a customer on Local+, it is used to find shops near you, which means your position is sent to us when you ask for that — we measure how far each shop is from it, and do not keep it; and if you drop a pin for a delivery, those coordinates go to the shop you ordered from, because that is how they find your door.

For an accepted, merchant-confirmed paid delivery, the customer can separately choose Share with shop and consent to sharing device location while the order page is active. Only that order's authorized merchant can read the latest point through the merchant order view. Console, staff and support case readers receive no live-location data. The point, accuracy, sequence and server receipt/expiry times are kept separately from the agreed delivery address, destination pin and fee, which this feature never changes. No location trail is stored or sent to a public menu, QR code, notification or order log. Stop sharing cancels the device subscription and requests server revocation. If the device is offline, the last point expires within 120 seconds without a new device fix. Coordinates become unavailable when sharing stops, the order ends, or the original payment's two-hour window expires. Server cleanup removes the separate point asynchronously and can lag; expired coordinates are already unavailable to readers. The device subscription also stops when the app is backgrounded or the order page loses its active route. A closed or locked page is not a promise of continued sharing, and reopening it does not restart sharing automatically. The shown time means last received by the server, not a verified GPS capture time. The merchant can explicitly open the last received point in an external Google Maps search. That tap passes the coordinates to Google Maps; it is a static map handoff, not Google account live-location sharing.

Android's automatic backup is switched off for this app, deliberately. Your trading history is not copied to the Google Drive of whoever owns the phone.

On our servers — only if you use AI photos or buy a board background

What	Why
An account identifier	To know whose credits are whose. Unlike everything else in this table, it exists for every phone that has reached our server once: the app makes it by itself, before you use any of this — see "Your account"
Your email address	Only if you sign in with Google or sign in with Apple without hiding it. Used to sign you in. Older versions may also receive an email address for email/password sign-in or a password reset. Never used to advertise to you.
Your credit balance, when each pack was bought or each gift given, and when a gift expires — bought coins do not	Because a balance the phone controls is a balance anyone can edit
The AI photos you generated	So you keep them if you change phone
The name of the dish each photo was for	To generate the photo, and so you can find it again
A record of each generation, and of each pack, gift or reversed purchase	So you can see where a credit went: the app shows it to you as your coin history
A photo you asked to have fixed	It is sent to the image provider to be worked on, and the result is saved in place of it. The original is not kept on our servers as a separate copy.
A picture you asked the Studio to expand, erase from or upscale	It is sent to the image provider to be worked on, and the result is saved in your account so the app can fetch it. One per picture in a design: doing it again replaces it. The picture you sent is not kept on our servers.
The background you bought for a menu board	So you keep it if you change phone. One per board: buying another replaces it.
What you asked that background to look like	Either which of the ready-made ones you picked, or the words you typed. Nothing else about the board is sent — not your dish names, not your prices, not the layout.

On our servers — only if you publish a Local+ storefront or take orders

What	Why
Your published storefront: shop name, description, logo, position, the riel your till counts a dollar as, your phone number if you chose to show it, and your menu — item names, selling prices, photos, availability	So customers can find your shop and see what it sells. This is public — anyone can read it, in the app or on your shop's menu page on the web. Unpublishing takes the shop out of discovery.
Each order a customer places: what they ordered, the amounts, the name, phone number, optional Telegram username and address they typed, whether they mean to pay by cash or KHQR, the table number when they ordered from a table sticker, and — once you ask to be paid — the payment code you picked and the time the customer said they had paid	So the order can reach you and you can fulfil it. Held on our servers, shown to you in the app. Your costs and margins are not part of an order — a customer never sees what anything cost you.
Your Local Plus plan, once you start the free trial or are given a plan: which plan, when its period started and when it ends, and whether it came from the trial, a gift code or KiraZone directly	So Local+ knows whether your shop is listed and can take orders, and so the app can tell you before your plan ends and after it has.
A promotion you ask for: which shop, the days you picked, the daily price and total shown to you, whether it has been marked paid, and when it was approved	So it can be approved and shown to customers. While it runs, customers see your shop first, marked "Sponsored".
Your shop's figures, for the last 7 and the last 30 days: how many orders were placed, accepted, refused by you, closed because nobody answered, and called off after you marked them paid; how many minutes you typically take to accept; your ratings, star by star. Worked out again every morning from the orders and reviews above	So you can see how your shop is doing — the Local+ tab shows them to you — and so we notice when a shop's customers are being let down. See "How we notice problems".
A warning or a suspension, if one is decided: which it is, the reason you are shown, from a fixed list, when it ends if it has an end date, and when it was decided	So the app can tell you, and so a warning with an end date ends on that date. See "What we decide about an account".

Not your sales, not your profit, not your costs. Your selling prices are on our servers in exactly one case — a storefront you chose to publish, where they are the menu. What you paid, what you made and your book of sales are in neither list above. There is one place they do go, and only one: if you are logged in, the copy of your whole shop saved to your own account. Nobody else can read it, it is there so a lost phone is not a lost year, and logging out stops it. Logged out, those figures never leave the phone at all.

Your account

You can use the entire till with no account at all.

An account is needed for credits, for letting a second phone join the same shop, for the copy of your shop in your account, and for a help request, which belongs to the account that sent it. Local Plus makes an anonymous account for this phone by itself, the first time it can reach our server — no name, no email, no phone number, just an identifier that says "this device's credits". The till never uses it; it is there so that the day you buy a coin, link a phone or publish a shop, those have an owner. Each time the app opens with a signal, it asks our server what that identifier holds, such as its coins.

For the next Business version, Step 1 offers Google or Apple where available, or Guest. These changes are still being prepared for release; they do not announce a newer public download or working account-connected access.

With your Google account. Google tells us your email address, the name and picture on your Google account, and an identifier, and Google knows you signed in to Local Plus. We ask for nothing else from your Google account — not your contacts, not your files, not your Drive.
With Sign in with Apple. We then receive whatever Apple chooses to pass on — an identifier, and an email address unless you ask Apple to hide it.

Account entry does not collect a phone number. Store Basics, Step 2, requires a plausible shop phone for a new or unfinished setup, including Guest setup. The number is unverified, is not a sign-in credential, and this setup sends no SMS code or phone-auth verification. The saved number is the existing Store profile phone: its public visibility and receipt printing follow the existing Store profile switches described on this page. It is included in private file backups and copies in your own account.

Any legacy private account-contact phone remains separate and is preserved in those backups. Account entry does not collect or overwrite that field, and it is not automatically copied into the shop phone. Guest needs no account.

Older Local Plus versions may offer email/password sign-in and a password reset, or phone-number sign-in checked with an SMS code sent by Google's Firebase. Those routes are not offered by the next Business account setup.

An account carries your credits. It also carries the copy of your shop described above, for as long as you stay logged in — that is the one thing on this page that changed when backup arrived, and it is why "stays on the phone" now has a condition attached to it wherever it appears.

In the customer app, a Google account is optional, and ordering never needs it. The customer app gives this phone an anonymous identifier the first time it is opened, and that is all an order, a review, a report or a help request needs. If you want your orders to follow you to a new phone, the Account tab can link a Google account to that same identifier. Nothing is moved and nothing is lost: your orders and your help requests belong to the identifier, and linking keeps it. Google then tells us the same things as above — your email address, the name and picture on your Google account, and an identifier — and they are kept with your sign-in. On another phone, sign in with the same Google account and your orders are there.

Signing out turns this phone back into a new guest with nothing on it; your orders stay with your Google account and come back when you sign in again.

If the Google account you pick already has a Local Plus account of its own — from another phone, or because it runs a shop on Local Plus Business — the app tells you before it switches to it. The orders and help requests this phone made as a guest stay with the guest: they cannot be moved onto that account, and once you switch, this phone cannot reach them any more. To have what the guest sent removed, delete it first (Account → Delete my data) or ask us afterwards — see "Your choices". And an account that runs a shop is one account wherever you sign in to it: the customer app can then see its data, and Delete my data deletes everything under that Google account on Local Plus, including a shop run with it on Local Plus Business.

A coin purchase Google reverses

If Google Play refunds a coin pack you bought, cancels the order, or sees the payment charged back by your bank, Google puts that purchase on a list it keeps for this app. Once a day our server reads that list and matches it to your coins. The coins from that pack you have not spent yet are taken back — from that pack only, never from another pack or a gift, and never below zero. Coins you had already spent stay spent. Your coin history in the app shows the reversal, how many coins were taken back and how many you had already used.

What we keep about it: the time Google gives for the reversal, how many coins were taken back and how many had been used. The history row of a reversal carries no purchase token — the code that proves a purchase — and no Google order number. Since 3 September 2026 no purchase has been filed under its token either: it is filed under a one-way fingerprint of it, which cannot be turned back into the token or used to claim the purchase.

Nothing new leaves your phone for this, or for the two things the app now shows you from records described above: your coin history, and a notice when your Local Plus plan has a week left or has ended.

Messages, reviews and reports on Local+

These three exist only on the Local+ side — the marketplace, where a customer orders from a shop. None of them touches the till. A phone that only sells, and never publishes a storefront, produces none of it.

It is also the one part of this policy written for the customer as much as for the merchant, because on Local+ each of them writes things the other one reads.

Contact about an order

Web orders require a phone number so the shop can call the customer. Customers can optionally provide a Telegram username. We store that username with the order and show a direct Telegram icon to its merchant. That link opens Telegram; messages sent there are handled by Telegram and are not copied into Local Plus.

The customer's phone and Telegram contact buttons close 30 minutes after the order is completed. The server removes both stored contact fields during its expiry cleanup. Account or guest-order deletion also removes the username.

Business order cards and customer web-menu screens do not offer internal customer/merchant messaging. Existing internal message records remain subject to their retention and deletion rules. Those messages are stored on our servers as an archive. New internal order messages are disabled; neither side can create or change an archived message.

When a customer deletes their data, their message text is removed from orders they placed; the shop's replies stay. When a shop deletes its account, an order it marked paid and then called off remains visible to its customer as a refund record. The shop's account and storefront identifiers and its message text are removed from that order. The order still shows the shop name, amount and status. In either case the message rows still record who wrote and when.

Reviews

When an order is finished, the customer can rate the shop out of five and write a comment. The rating and the comment are stored on our servers and shown to that shop. The shop is never told who wrote them: no name, no phone number and no account identifier reaches the merchant. That is deliberate — a merchant who can see who complained is a merchant nobody complains to.

We do not write reviews and we do not edit them.

A review stays on the shop when its author deletes their data. It never carried their name, it is what the next customer reads, and taking it down would move that shop's score for a reason nobody could see. When a shop's own account is deleted, the reviews of that shop are deleted with it: there is no shop left to show them on.

Reporting something

Either side can report a shop, a person, an order, or the conversation on one.

A report carries the account identifier of whoever sent it, what the report is about, the reason they picked from a fixed list, and anything they chose to type in their own words. It is read by one person: the owner of KiraZone. The reported party is never told who reported them, and there is no reply — the app says so the moment the report is sent. A report is not a help request: to ask us something, see "Asking us for help" below.

When the report is about a shop, we also keep a copy of what that shop's storefront said at that moment — its name, its description, the addresses of its logo and its banner, and its Telegram and Facebook links, and the name, description, price and picture addresses of each of its dishes. A shop can be renamed in the time it takes to type, so without the copy a complaint about one name would reach us describing another, and the person deciding it would be reading the wrong thing. The copy is of what the shop published to every customer, and holds nothing about whoever reported it. The logo, banner and dish pictures at those addresses stay there while the copy is kept, even if the shop changes or removes them, so the person deciding the report can see what it was about.

That copy is deleted twelve months after the report was filed, unless the case is still open. The report itself stays: it is the record of a decision. What goes is the old shop-front text, because a year later there is no case left for it to be evidence in; the pictures it pointed at go with the shop's next publish.

Reports about a shop's owner are also counted — see "How we notice problems" — and the shop is never shown that count.

Blocking

When you block a shop, that is kept on your phone only and is never sent anywhere.

When a shop blocks a customer, the shop's list of blocked customers is stored on our server, because an order reaches the shop through us and only we can turn it away. That list holds account identifiers and nothing else — no names, no messages, no reason. Only that shop can read its own list; nobody can read across shops, including us in ordinary operation.

Nobody is told they have been blocked: a blocked order is refused the same way any other refused order is.

Either way, the list belongs to the phone that made it, and that has a cost it is fair that you know: a block does not travel to your other phone, and reinstalling the app clears it — on our side too, because the shop's phone is the copy that counts.

Favourite shops, and what checkout remembers

When you heart a shop, which shop it is, its name, its trade, the address of its picture and the account identifier of the shop's owner are kept on your phone only and are never sent anywhere. Taking the heart off removes it the same way.

If you switch on "Remember me on this phone" at checkout, your name, your phone number and up to three delivery addresses are kept on your phone only — with the map pin for an address, where you used "Use my location" to set one. They go out only inside an order you actually send, the same as if you had typed them fresh. Turning the switch off stops saving further changes, and stops this app filling anything in from what it already saved; it does not erase what is already saved. "Forget my saved details", on the same screen or on your Account tab, erases it immediately, and so does Account → Delete my data. "Check the pin in Maps" hands that point to Google Maps (the app if your phone has it, otherwise google.com in your browser), and only when you tap it.

The Inbox

In the customer app, the Inbox tab puts three things you already have in one list: the newest line of each conversation with a shop, the moments your orders moved — accepted, ready, sent out — and your help requests, marked when we have replied. It reads them from what this page already describes, and it sends nothing new. The one thing it keeps of its own stays on your phone only: which help requests you have opened, and up to when, so it can mark a reply you have not seen yet — ids and times, never anybody's words. What a shop you blocked writes stays out of it, as it stays out of the conversation.

How we notice problems

A marketplace where one shop can quietly let its customers down is a worse place for every other shop in it. So, for every published shop, our server counts, from the orders, reviews and reports this page already describes and from nothing else:

how many orders were placed, accepted, refused by the shop, and closed because nobody answered in the two hours a shop has to answer;
how many were called off after the shop had marked them paid — which is what the shop's own taps on the order say, never what any bank says;
how the shop is rated, star by star, and how many ratings arrive in one day;
how many reports were made about the shop's owner, and by how many different accounts.

The figures cover the last 7 and the last 30 days and are worked out again every morning. Nothing new leaves anybody's phone for this: every figure is counted from something already on our servers. We count shops, not customers: nothing here adds up what one customer does at different shops, and nothing reads a shop's till, its book, or the copy of it kept in its owner's account.

When a count crosses a line we have set, the server files a flag — a note for us to look at, holding the numbers and which orders, reviews or reports were counted, and never a name, a phone number or anything anybody typed. The lines are ours to adjust and are not published, because a published line is one a shop plays to.

A person reads every flag before anything happens. The owner of KiraZone reads it, and the orders, reviews or reports behind it. Nothing happens to a shop because of a count: a flag changes nothing on its own, and whatever is decided afterwards is decided by a person, and is one of the decisions in the next section.

A shop sees its own figures and never who complained. In Local Plus Business, the Local+ tab shows a shop its own figures. It does not show how many reports were made about it, how many of its reviews we hid, how many help requests mention it, where our lines are, or whether a flag was filed — at a small shop, a count of one is a name.

The figures are replaced every morning. A flag is kept after it has been decided, as the record of what we looked at. The figures and flags about a shop are deleted with its owner's account.

What we decide about an account, and what we keep

Some things on Local+ only a person can decide, and that person is the owner of KiraZone. Every decision is made by a person — never by a count, and never by a report on its own.

About a shop, we can warn it or suspend it. A warning is a step short of a suspension: it blocks nothing — the shop stays listed, takes orders and is paid as before — and it says why, from a fixed list of reasons. A suspension takes the shop off Local+ and says why, from the same list; it has no end date and is lifted by a person. About a customer, we can warn them — they can still order as usual — stop the account placing orders, or close it. A warning or a stop on ordering can end on a date we set, and on that date it ends by itself, in the first hour of the day in Phnom Penh. We can also hide a review that breaks the Terms, and decide a report.

The person it is about is told, and nobody else. A shop sees its warning or suspension, the reason and the end date in the Local+ tab, and if order alerts are on, its phone is told there is news there. A customer is told in the app: a warning or a stop on ordering in a banner, with its end date if it has one, and a closed account when it next tries to order. No other shop and no other customer can read a decision about somebody else. The notice that tells you is also where you can ask us to look again — see "Asking us to look again at a decision", under "Asking us for help".

What a decision holds is which one it is, the reason a shop is shown, when it ends if it has an end date, when it was made, and which of our accounts made it. Our own note about why is not part of it. A note like that routinely says who complained, so it is kept where only we can read it.

The record of each decision stays after the account is deleted. Every decision — a warning, a suspension, a restriction, a hidden review, a report decided, a flag looked at, an account deleted on request — is written in a log only the owner of KiraZone can read: what was decided, when, what it was about — the account, shop, review, report or flag — and our own note. It is the record of what the platform did and why, so it is kept when the account it was about is deleted. A warning or restriction on an account is deleted with the account; the line in our log saying it was decided is what stays.

Asking us for help

You can ask Local Plus for help from inside either app — in Local Plus from Account → Help, and in Local Plus Business from More → Help. A help request is a conversation with us: you write, we reply in the app, and you can write back until the request is closed. It is not a report. A report goes to moderation and gets no reply; a help request is answered.

What we keep when you send a help request: your account identifier; which app you asked from; the kind of help you chose; the language your app was in; what you linked the request to, if anything — an order you placed or received, your own shop, a review you wrote or one about your shop, or a ride you were part of, and only ever one you are a party to; if you are asking us to look again at a decision about you, which decision it is (see below); the messages you write and our replies; notes we write about your request, which you do not see; where the request stands, how urgent we marked it, and short labels for its topic; your answer, if you told us whether it helped; and when each of these happened. A link lets us look at the thing you linked while we answer; the request does not copy it. Nothing else is attached — not your location, not a photo, not your till's records.

If you send us two requests about the same thing, we may join one to the other. Each keeps its own messages, nothing moves between them, and each says in the app that it was joined. We only ever join two requests of the same person, sent from the same app.

The platform owner and authorised support staff read help requests. They are stored on our servers and read through our own console. Staff access is granted by the platform owner or a delegated manager and requires an Authenticator. No shop and no other customer can read yours.

A notification about a help request never says what anybody wrote. When we reply, when we write to you first, or when we are waiting for your answer, your phone may show a notification that says only which of those it is — never our words or yours, and never what the request is about. The three are quoted under "Notifications about orders and help requests". In the customer app they ride the same permission as order updates (see the next section). In the business app they reach a phone only if "Tell me when an order arrives" is switched on there; otherwise the request waits in the app, under Help.

We delete the words of a help request — yours, ours and our notes — 24 months after the request is closed, and at once if you delete your data. A request marked solved closes by itself seven days later unless somebody writes in it again. What we keep after the words are gone is that the request existed: its kind, which app and language it came from, where it stood, how urgent it was, its topic labels and its times, whether you said it helped, and whether it was joined to another request or started by us — so that our counts stay true — without your account identifier, and without anything it was linked to. The one exception is a request asking us to look again at a decision: it keeps which decision it was about, and our log of decisions still names the account that decision was about (see "What we decide about an account").

If the shop or the person your request is about deletes their own account, your request keeps its words: it is your conversation with us, and you can still read it.

If you use Local Plus as a guest, your requests belong to the guest identifier on this phone. If you delete the app or clear its data, you cannot see them again, and we cannot move them to another phone.

In Local Plus Business, Help also has a button that opens Telegram with a message already written: the app and its version, your shop's name and trade, who registered it and the shop's phone number, then a blank line for your own words. You see all of it in Telegram before anything is sent, it is sent only if you press send there, it goes to the owner of KiraZone on Telegram, and Telegram's own terms and privacy policy apply to it.

Telling us whether we helped

When a help request is solved, the app may ask you, once, whether it helped. If you answer, we keep your answer — yes or no — the reason you picked if you said no, and when you gave it. The reasons are a short fixed list, and there is no box to type in: anything more you want to say goes in the request itself, where we read it and where writing opens the request again. You can answer once each time a request is solved. The owner of KiraZone reads your answer beside the request, and we count the answers to see how well we are helping; no shop, and nobody else, ever sees it.

Asking us to look again at a decision

If we have warned your account, stopped it placing orders or closed it, or warned or suspended your shop (see "What we decide about an account"), the notice in the app that tells you lets you ask us to look again. What you write is a help request like any other, and it is linked to that decision so that we read the two together: we keep which decision it is, what kind it is, and the level it set. Only the account a decision is about can ask about it — for a shop, the account that owns it, not the staff who work there.

You have 90 days from the decision to ask. After that you can still send us an ordinary help request about it. You can ask once about each decision; if we change a decision — a new end date, a new reason — the changed one can be asked about afresh.

Asking does not change the decision. It stays as it is until we change it, and if we do, the notice in the app changes with it. Support can look and explain; it cannot move money, refund anything or change an order, and a request to look again is no different.

When we write to you first

If somebody asks us about an order you placed, or an order your shop received, we may write to you about that order in a new help request. It starts with what we wrote and nothing else: we write only what we choose to, and we never pass on the other person's own words — nothing from their request is copied into yours, and the app does not tell them yours exists. You can reply, and it is your help request like any other: its words are kept and deleted by the same rules, and it keeps them if the other person deletes their account.

Reminders, and a request nobody answers

If we have asked you something and are waiting for your answer, we may remind you once, with a notification. If you still do not answer, we mark the request solved seven days after the reminder, and say so in the request. Writing in it opens it again. A solved request closes by itself seven days after it is solved, as above.

Misuse

If help requests are used to abuse us or to flood us, we may close one and stop that account opening new ones for 30 days. A request closed this way stays closed, and you can still read it. During the pause you can still reply in your other open help requests, tell us whether one helped, and ask us to look again at a decision about you — and you can write to the address at the top about the pause itself. We can lift a pause early.

What we keep about it: that the account is paused, until when, which request it was set on, and which of our accounts set it. A pause whose 30 days have passed stops nothing, and it is deleted when we lift it or when you delete your account.

Notifications about orders and help requests

This is how a phone is told about an order, a help request, or news about a shop, while the app is closed. Both sides of Local+ use it, and both send the same kind of thing.

When anything is sent. In the business app, only after you switch on "Tell me when an order arrives". In the customer app, only after your first order or your first help request, whichever comes first — never when you install it or open it — and only if notifications are allowed. On Android 13 and later, that first order or first help request is when the app asks you.

What is sent. This phone's notification token: the identifier Google's Firebase Cloud Messaging needs to deliver a notification to this app on this phone. It goes to our server with your account identifier, which kind of phone it is, and the language the app is set to, so the notification can be written in that language. Nothing else — no name, no phone number, no location. In the customer app, when you sign in to a Google account or sign out of one, the token is sent again under the account the phone is now using, so that what is meant for that account reaches it. The same notification token belongs to only one account at a time: registering it for the new account removes that phone's registration under the previous account, so alerts meant for the previous account no longer reach this phone.

What a notification says. To a shop: that an order arrived, where it came from and its total; that a table is asking for something — which table, and what it asked for; that a customer withdrew a request; that a customer says they have paid — which is what the customer said, not what your bank says; that money arrived; or "There is news about your shop in the Local+ tab", which is how a warning or a suspension, a change to one, or its end reaches the phone without saying which. A shop's news goes to its owner and to every phone that joined that shop with a code, and to no other shop's phones. To a customer: the shop's name and what the shop did — said yes, could not take the order and why, asked to be paid, has it ready, has sent it out, or called it off. About a help request, to either app, one of three and nothing else: "Local Plus support — Replied to your help request" when we reply; "Local Plus support — Sent you a message" when we write to you first; and "Local Plus support — Waiting for your answer" when we remind you. A customer's name, phone number and address are never in a notification, and neither is a payment code.

Who handles it. Google delivers every notification, so Google's Firebase Cloud Messaging receives the token and the words of each notification sent to it — for a help request, only one of the three lines above.

Stopping it. Turn notifications off for the app in your phone's settings and they stop appearing. In the business app, switching order alerts off also deletes the token on the phone. Deleting your account deletes every token filed under it at once. Otherwise our copy of a token is deleted the next time a notification to it fails because the token no longer works, which is what happens once the app is uninstalled or its data is cleared.

Local bank receipt detection

Local Plus Business declares an Android notification-listener service for optional local bank receipt detection. It is absent from the customer app. No incoming bank receipt template or bank signing identity is verified in this version, so Income Detect shows that it is not yet supported and does not offer notification-access settings. Even if Android access was previously enabled, unverified notifications are rejected before their title, message, account details or OTP are read. No bank notification content is uploaded or retained, and no order, ledger or payment announcement is changed.

Any future supported bank must have an exact incoming receipt template and verified signing identity. Before access is offered, the owner must be shown the broad Android notification-access disclosure and choose in Android's own settings. Local binding is limited to the signed-in owner and original shop; account changes, shop authority loss, access revocation and listener disconnect stop it. Local erase clears its dedicated on-device state. Historical manual payment announcements are not evidence of detected bank income.

Delivery-order notifications

Not available in the current release. The description below is how the feature is built for when it ships, and it is kept here because a policy that appears after a feature does is a policy nobody re-reads. Today, the switch it describes does not exist on your phone, and nothing of the kind runs.

If you turn this on, Local Plus can see that a delivery app has posted a notification.

It reads which app posted it, and at what time. Nothing else. Not the title, not the message, not the customer's name, not the order, not the amount. This is enforced by how the feature is built, not by a promise: the notification's contents are never read, so there is nothing to store, send or lose.

That information stays on your phone and is used for one thing: showing you "an order arrived at 14:32 — record it?".

The feature is off until you switch it on in your phone's own settings, and you can switch it off there at any time.

Publishing a storefront

Platform console access. KiraZone's owner can inspect account identity and status, published store settings, and online order records to operate the service and answer support requests. Account details include the name, email or sign-in phone number you supplied, verification status and sign-in dates. Order details include items, totals, customer contact and delivery details, payment claims, the merchant's payment confirmation and lifecycle times. These console views are available globally only to the platform owner. Authorised support staff with Records access can inspect the order, shop, review and account IDs linked to a support case; they cannot search the account directory or read unrelated order history or account sign-in contacts. They do not read your private till book, costs, margins, recipes or staff PINs, and cannot move money or change an order's total.

Console read accountability. Successful record lookups and searches, and opening a full support ticket, are logged with the operator's Console ID, role and grant revision, record type and record or case IDs, and server time. Search words and returned contacts are not copied into that log. Account deletion removes or tombstones copied account identifiers and operator names in these entries.

Support work allocation. Authorised platform operators share their Console ID, name, role, selected availability, server-recorded last-seen time, configured active-case limit and current assignment count with other operators who have support access. The directory does not share their sign-in contacts or device data. Case logs record actual assignment changes; User log records explicit capacity and availability changes with the actor, target, chosen values and server time. Account deletion releases assignments and removes or tombstones copied operator identifiers. Selected availability is not a claim that a device is online.

Completed order contacts. Customer calling is available for 30 minutes after an order is completed. After that, the app and support's order view hide the phone number; the support view also hides delivery details and customer notes. The server removes the order's phone number during its next scheduled cleanup. An unpaid table or Pay later bill still needs to be settled; completion does not mean it was paid. Account deletion and guest detail deletion remain available.

Nothing here happens unless you choose to publish your shop or Business web menu. An unpublished shop serves nothing, and that is how the app arrives.

You can publish a Business web menu from Print a card. This makes its shop details, menu and photos public on the web; it does not list the shop in the Local+ marketplace.

Published means public. Your shop's name, description, logo, its position on the map, and your menu — item names, selling prices, photos, what is available — can be read by anyone: in the Local+ app, and on your shop's menu page, which opens in any web browser without the app. That is what a storefront is for, and it is why this section exists: everywhere else in this policy, prices staying private is the rule.

Your exchange rate. The riel your till counts a dollar as is published with your prices, so a customer sees each dollar price in riel as well. It is your own till's rate — the one your counter customers already pay at — and not a market rate.

Your phone number, only if you choose. Store profile has a switch, "Show this number to customers". It is off until you switch it on. While it is on, your shop's number is part of your published storefront. The customer app and your web menu page show a Call button on your shop page, and the customer app shows the number on a customer's order with you, so they can call you — but anybody can read a published storefront, so treat the number as public. For many shops it is the owner's own mobile, the one their Telegram and their bank are registered to, and that is worth a moment's thought before you switch it on. Turning it off takes the number down: the app publishes your storefront again without it. If the phone has no connection at that moment, the number comes down with the next publish that goes through.

Your banner, Telegram and Facebook, only if you add them. Store profile can hold a banner photo, your shop's Telegram name and its Facebook page. Each one you add is part of your published storefront, drawn across the top of your shop page and your web menu, and as Telegram and Facebook buttons there — so, like the number, treat them as public. Remove one and the next publish takes it down, the picture included — unless a report is about it; see "Reporting something".

What is never part of it: your costs, your margins, your recipes, your stock levels, your sales history, your expenses, your staff. A customer sees a menu, not a book.

Orders. When a customer orders, they type a name, a phone number and — for delivery — an address. The order also says whether they mean to pay by cash or KHQR, carries the table number when they scanned a table sticker, and carries any note they wrote for the whole order, for one dish ("less sugar") or for the rider. A delivery order also keeps the map pin and distance used to price the delivery fee; the typed address may point somewhere else. Each order gets a queue number for the day, which the customer sees and your staff call out. That reaches our servers and your phone, because you have to fulfil the order. It is theirs, and they can take it back. A customer who deletes their account has their name, number, address, delivery pin and notes, and what they wrote to you on the order, stripped out of every order they placed. A customer who ordered from your web menu, with no account, can do the same to that one order from its own page once it has finished, and we do it for them 90 days after it ends. Either way your record of the sale itself stays: what was ordered, the totals, the times and the queue number.

Customer agreement at checkout. A web-menu order keeps the version of the Terms the customer agreed to and the server's order timestamp. Authorised support staff can view this record with the order. It follows the order's retention and deletion rules; it is not permission to send marketing messages.

Who on your team did what. When someone accepts, rejects or moves an order along, the order keeps a record of it: what was done, when, and the name (or nickname) of the staff member signed in to your till at the time. Only your shop can read it — never the customer — and it is deleted with your account.

A table calling your staff. A customer sitting at one of your tables can ask for staff, the bill, water or cutlery from your web menu or their order. The call carries the table number and what they asked for — nothing about who they are — and only your shop can read it. When you mark it done, the name of the staff member who went is kept on it.

Counting requests on the web menu. When you use a shop's web menu, we count requests from your internet address for a short time, so nobody can flood a shop with orders or calls. We do not keep the address itself, and the count is deleted within about a day.

Turning it off. Unpublish from the storefront screen. The shop leaves discovery immediately. Unpublish from Print a card turns off the Business web menu. Deleting your account removes the storefront and its orders entirely.

Paying for a Local+ order

Local+ never takes, holds or moves the money for an order, and never looks at anybody's bank account. A customer pays the shop directly — cash in hand, or a transfer from their own banking app into the shop's own bank. We are not part of that, so we cannot know whether money moved, and neither app pretends to.

Three things about paying do travel, and this is who sees each.

How the customer means to pay. At checkout the customer chooses cash or KHQR. It goes to the shop with the order, so the shop knows whether to reach for a payment code or the cash tin. It charges nothing and confirms nothing.

The shop's payment code. When a shop has accepted an order and asks to be paid, it picks one of the KHQR codes it saved, or asks for cash. The code it picked is copied onto that order and shown to the customer whose order it is — to nobody else, and never before the shop has accepted. A KHQR code carries the shop's bank account identifier and the name its bank holds for the account, and for a small shop that name is very often the owner's own. It is the same code the shop would print for its counter, and the customer can save or share the picture to pay from their banking app — so once it has been shown, it has left our hands as surely as a printed one. A shop that would rather a particular customer did not see the name on its code can ask that customer for cash instead.

"I have paid" is a claim, not a payment. When a customer taps "I have paid", the shop is told the customer says so, and the time they said it is kept on the order. The tap records that time and nothing else — no amount, no bank reference, no screenshot. An order is marked paid only by the shop, after checking its own bank. No screen in either app says an order is paid because of anything a customer did: a shop that hands over food for a transfer that never arrived is the person this rule is for, and so is a customer who stops checking whether theirs did.

All three are part of the order and are kept with it. When a customer deletes their data, their name, phone number, address and delivery pin come off the order, and the rest stays as the shop's record of the sale.

Connecting a second phone

This section exists because it is the only part of Local Plus that keeps sending after you set it up, and because the rest of this policy would be misleading without it.

Nothing here happens unless you connect phones. An unlinked shop sends nothing, and that is how the app arrives.

What is sent when phones are linked

What	When
Your shop's name	Once, when you create the link
Which of your shops it is — the same code your shop's menu link carries — so its news reaches its own phones	Once, when you create the link
A staff member's name and role	When you make an invite code for them
For each sale: the amount, the currency, how many items, who sold it, and the time	As it happens
From a staff phone, for each sale: which items it sold, and how many — as codes and amounts, never a name, a price or a cost — so the owner's phone takes the owner's items off its stock, and off Local+'s	As it happens
From the owner's phone: the shop's items — names, selling prices, sizes and extras, categories and barcodes — the owner's count of each item that is counted, and the shop's currency and exchange rate, so staff phones sell the owner's items at the owner's prices and stop when one is gone. Only the owner's phone and phones still in the shop can read them	When they change

What is not sent, ever

Your costs, your margins or your profit. Your recipes and your ingredients. Your expenses. Your reports. Your photos. Anything about your customers. The owner's phone shows a running feed of sales — an amount, a seller and a time — and nothing underneath it; what a staff phone sold moves the owner's stock and is shown nowhere else.

Turning it off. Disconnect the phone, or revoke it from the owner's Connected phones list. Sales stop being sent immediately, and the phone stops receiving the owner's items and prices; what it already has stays on it. A phone that disconnects also takes itself off the shop, so it is not told the shop's notifications any more. What was already sent stays until it is deleted; ask us and we will delete it.

One deliberate behaviour worth naming: if the owner revokes a phone while it is mid-shift, that phone keeps selling normally and its sales simply stop appearing in the owner's feed. The till never refuses a customer because of something the owner did an hour ago, and the sale is still recorded in full on the phone that made it.

Verifying a store

Before a shop is shown to customers on Local Plus, a person at KiraZone checks who is behind it. This is optional in exactly the sense that publishing is: you only meet it if you ask for your store to be verified.

What you send. Four photographs and a few details: the front of a government ID, a photo of your face holding that ID, your shopfront, the inside of your shop; your full name as on the ID, a phone number, the shop's address, the pin you already placed on the map, and — if you have one — a business registration number.

Who sees it. The photographs and details go to our servers and are shown to one person: the owner of KiraZone, who reviews them by eye. No automated face matching is performed, and nothing is sent to any third-party identity service. Customers never see any of it; they see a "verified" mark on your shop, and nothing else.

What we do not keep. We do not store your ID number as text — the photograph is the record. We keep the photographs and details for as long as your store is verified, so a later question about the shop can be answered. One such question is a request to delete the shop's account made without the app: the phone number you gave here is one of the ways we check that the request is yours (see "Your choices"). If your store is refused, they are deleted when it is refused. If you stop before it is verified — you never send it, or do not answer when we ask for more — they are deleted 30 days after you last changed it.

Turning it off. Deleting your account deletes the photographs, the details and the verification record with it. Ask from Help in the app, or by email, if you want a verification withdrawn without deleting the account.

Who else receives anything

Who	What they get	When
Google Firebase	Your account identifier, your sign-in email address, your credit records and your generated photos; in older versions, a phone number used for phone-number sign-in	The identifier from the first time the app reaches our server; the rest only if you make an account or use AI photos. A saved shop phone and any legacy private account-contact phone are included in a private account copy, not sent as sign-in credentials. Shop-phone publication follows the separate storefront rows below
Google Play Integrity (through Firebase App Check)	Google's check that the app talking to our server is our genuine app on a genuine Android phone, with details of the device and the app that the check needs — never your records, your orders or your messages	Every time either app talks to our server, whatever you have switched on
Google Firebase	Your shop's name, your staff members' names and roles, and a summary of each sale — amount, count, seller, time	Only if you connect a second phone
Google Firebase	Your published storefront — shop name, position, exchange rate, your phone number if you chose to show it, menu with prices and photos — and each order's contents: the name, phone number and address the customer typed, their notes, how they mean to pay, their table, the payment code you asked them to pay with, and when they said they had paid	Only if you publish a Local+ storefront / take orders through it
Google Firebase	Your store verification — the four photographs and the details you typed	Only if you ask for your store to be verified
Google Firebase	Your help requests: what you wrote, what you linked them to, the decision a request asks us to look again at, whether you said one helped, our replies and our notes	Only when you ask for help from inside the app, or answer a request we started
Google Firebase Cloud Messaging	This phone's notification token, and the words of each notification sent to it — for a help request, only that we replied, that we wrote to you first, or that we are waiting for your answer	Only after you switch on order alerts in the business app, or after your first order or first help request in the customer app if notifications are allowed
Anyone — in the Local+ app, or on your shop's menu page on the web	Your published storefront, exactly as above, including your phone number while "Show this number to customers" is on. It is public by design	Only while your shop is published
The customer on an order you ask to be paid for	The payment code you picked — the KHQR, which holds your bank account identifier and the name your bank holds for it — with the label you gave it	Only after you accept their order and ask them to pay with that code
A shop you send an order to	Your name, phone number, optional Telegram username and address as you typed them, what you ordered, any note you wrote for the whole order, for a dish or for the rider, whether you mean to pay by cash or KHQR, your table if you ordered from one, and — if you tap "I have paid" — that you said so, and when	Only when you send it an order
The other phones on your shop	The owner sees the sale summaries above. A phone that joined your shop sees the shop's name, its own role, and the owner's items, prices and counts and, if its notifications are on, that shop's notifications: its orders, the money announced and its tables asking — never another shop's	Only if you connect a second phone
Telegram	Messages you choose to send through the order's external Telegram link; Local Plus does not receive a copy	Only if you open Telegram and send a message; Telegram handles its own storage and deletion
A shop you ordered from	Your rating out of five and any comment you wrote, with nothing that says who you are	Only after you review a finished order
The owner of KiraZone	A report: who sent it, what it is about, the reason, and anything they typed. Nobody else can read one	Only when somebody reports something
The owner of KiraZone	A help request: everything "Asking us for help" lists, and the notes written about it. Nobody else can read one	Only when you ask for help from inside the app
The owner of KiraZone	A shop's figures and the flags about it: counts, and which orders, reviews or reports were counted. Nobody else can read a flag, and a shop reads only its own figures	While a shop is published
Telegram	The message the Help button writes — the app and its version, your shop's name and trade, who registered it, the shop's phone number — and anything you add	Only if you press send in Telegram, from Local Plus Business
The AI image provider	The name of the dish you asked for a picture of, or — if you are fixing a photo — that photo. The provider is fal.ai today; the app can be switched to OpenAI, and both are named here so that switching it never makes this page wrong	Only when you press generate or fix
Google Firebase (your own account copy)	The copy of your whole shop: items, prices, costs, stock, sales, expenses, settings, your shop's contact and registration details, including any legacy unverified account contact phone, your saved payment QR codes, your staff's names and what you pay them, and the emergency contacts you entered on the Safety screen. Only you can read it	Only while you are logged in
Google (sign-in)	That you signed in to Local Plus, your email address, and the name and picture on your Google account	Only if you choose to sign in with Google — in Local Plus Business, or on the customer app's Account tab
Apple (sign-in)	That you signed in to Local Plus	Only if you choose Sign in with Apple
Google Play	The purchase itself. We never see your card	Only when you buy credits
Whoever you send an export to	Whatever is in that file	Only when you export and share it
Google (AdMob, the ads in both apps)	What Google's ads SDK collects: the IP address, how the app is used around an ad, diagnostics, and device identifiers including the advertising ID — see "Ads"	Whenever an ad is asked for; no ad requests while a shop is on its trial or a paid plan

We do not sell your data. The one thing shared for advertising is what Google's ads SDK collects, described in "Ads" below. There is no analytics or other tracking SDK in either app.

Local Plus Business is free and shows a few ads, from Google's AdMob, to help it stay free. The customer app is unreleased; its two existing placements are planned for its future launch and are not serving ads yet.

Where. In Local Plus Business: one at the end of Today, and one at the foot of More. For the future launch of Local Plus: one in the list of shops on Home, after the sixth shop and then after every tenth, and one at the end of My orders. Never on a shop's own page or menu, at checkout, on an order or its payment, in messages or the Inbox, on your account, while you sell or take a payment, on a sheet, a lock, the Studio or anything you print. The web menu and your shop's page on the web carry none.

Shops on a paid plan see no ads. Shops on their trial also see none anywhere in Local Plus Business. If the shop is initially on its trial or a paid Local Plus plan (Online or Ultra), the ads consent step and ads software are not started. If a free shop switches to its trial or a paid plan after the software has started, its ads are removed and further ad requests stop; this does not undo the earlier startup or requests. Privacy choices remain available when required. The sample shops show none either.

What Google's ads SDK collects. When an ad is asked for, the Google Mobile Ads SDK inside the app collects, in Google's own words, the IP address, which "may be used to estimate the general location of a device"; how the app is used (launches, taps, ad views); diagnostic information about the app; and device identifiers, including your phone's advertising ID. This is shared with Google, for advertising, analytics and fraud prevention, under Google's own privacy policy (policies.google.com/technologies/partner-sites). We never see it, and we keep nothing about an ad. Ads are asked for as not directed at children.

Your choices. Before the first ad, Google's own consent form appears where the law requires it (including the European Economic Area, the UK and Switzerland). Where Google says you must be able to change your answer, Privacy choices — in Settings in Local Plus Business, on the Account tab in Local Plus — opens the form again. On any phone, your phone's own Ads settings reset or delete the advertising ID (on most Android phones: Settings → Google → Ads). See Google's consent guidance for the EEA, UK and Switzerland.

Children

Local Plus is a tool for running a business and is not directed at children.

Your choices

Use the till without an account. Everything except AI photos works.
Delete your data on the phone by uninstalling, or by clearing the app's storage in Android settings. This is immediate and total on the phone, and we cannot recover it for you. If you were logged in, it does not touch the copy in your account — you can restore that on a new phone, or remove it; see "A copy in your account".
Delete your account and its data, from inside the app. In the business app: More → Store profile → Account → Delete account. Store profile is the card at the top of More, the one with your shop's name on it. It removes your account, any credits you have not spent, every photo the app generated for you, any storefront you published, and any phones linked to your shop. It happens immediately and cannot be undone, so spend your credits first if you have any.
A paid order that was called off remains visible to its customer. The shop's account and storefront identifiers and its message text are removed from that order; the shop name, amount and cancelled status remain as the customer's record of a refund owed. A shop with an order still being fulfilled, or with a customer's "I have paid" claim awaiting an answer, must finish or call off that order before deleting its account.
If you use Local+ as a customer, the same thing is on your Account tab. In the customer app: Account → Delete my data. You do not need to sign in for it: the app gave this phone an anonymous identifier the first time you opened it, and that identifier is what is deleted. Your name, phone number, address and delivery pin come off every order you placed, and this phone stops receiving order updates. Anything checkout remembered on this phone is forgotten too.
If you linked a Google account on the Account tab, it is that account that is deleted, with everything under it on Local Plus — including a shop run with it on Local Plus Business, if the same Google account runs one. The app says so before you confirm.

Your shop stays on this phone. Deleting the account does not touch the products, sales, costs, stock and staff on the phone. If you were logged in, it does remove the copy of them kept in your account — see "A copy in your account".

Orders you placed as a customer are changed rather than removed: the merchant keeps their record of the sale, and your name, phone number and address are stripped out of it. Destroying somebody else's sales record is not something your account deletion gets to do — and leaving your phone number behind is not something we get to do either.

Because they are changed rather than removed, finish or cancel an order that is still on its way before you delete. A shop part-way through a delivery loses the address it is delivering to.

Four things stay behind, and we would rather write them down than be found out. The shop's messages on an order stay on that order: neither side can delete a message once it is sent, which is said above and is the whole reason the thread is worth having. Deleting your data removes the text of your own messages there; the shop's replies are its record and stay. A rating or comment you left stays on the shop's page — it is what the next customer reads, it never carried your name, and taking it down on your way out would rewrite that shop's score. A help request you sent keeps its kind, where it stood and its times, without its words and without your account — see "Asking us for help"; one that asked us to look again at a decision keeps which decision. And if we ever decided something about your account — a warning, a stop on ordering — the line in our own log saying so stays, as the record of what we did; see "What we decide about an account".
If you ordered from a shop's web menu, without the app. An order placed from a shop's web menu belongs to no account, so there is no account to delete. The order's own page — the one your browser opened when you sent it — has Delete my details once the order has finished: done (at a table, once the table has paid), cancelled, turned down or withdrawn. Until then the shop still needs your phone number and address to get the order to you, and the page says so instead. It takes your name, phone number and address, your notes — on the order, on a dish and for the rider — and the text of what you wrote to the shop off that order. The shop keeps its record of the sale and its own replies, as above, and the page still shows you the order without them.
Keep the link: it is how the page knows the order is yours. Lost it? Ask us, below: we check that the order is yours by a call or a message to the phone number on it, then take the same details off it, and our log keeps a line saying we did, with a one-way fingerprint of the order's identifier in place of the identifier. Whether or not anyone asks, these details are removed from a web order 90 days after the order ends.
Or ask us to delete it for you, without the app. From Help in the app (Account → Help in Local Plus, More → Help in Local Plus Business), or by writing to the address at the top from any address you like. Tell us which account: for a customer, the phone number you put on your orders, and the shop and the day of one of them; for a shop, its name, and the email address or phone number the account uses to sign in, if it has one. For an order from a shop's web menu, which has no account, tell us the shop, the day and the phone number you put on it.
Before anything is deleted, we check that it is yours. A request from Help about the account that sent it already is. Otherwise we confirm it through the email address or the phone number that account uses to sign in, the phone number a shop gave when it was verified, or the phone number on the orders you named. If we cannot match the request to one account and check that it is yours, we delete nothing — and the button in the app still works, and needs no checking.

We delete it with the same deletion the app runs, so it removes exactly what the button removes and keeps exactly what the paragraphs above say it keeps. The one thing it cannot reach is what checkout remembered on your phone: none of that ever reaches us, so only your phone can forget it — Account → Forget my saved details. While an order you placed, or an order to your shop, has been marked paid and is still being made or delivered, we wait until the shop has finished it or called it off: deleting takes the address off an order, or the order off a shop. The one thing it adds is a line in our log saying that we deleted an account, when, and why in our own words, with a one-way fingerprint of its identifier in place of the identifier — never the words of your request.
Save a backup. Reports → Safe keeping → Save a backup writes your whole shop to one file that this app can read back: items, sales, costs, stock, staff, hours and pay. It is a plain, open, documented format. It includes shop settings, including any legacy unverified account contact phone. It never leaves the phone on its own — it goes only where you send it, and it carries no PINs in it, because those live in the phone's keystore and not in your records.
A copy in your account. If you are logged in, the app keeps a copy of your shop in your own account so a lost, stolen or broken phone does not cost you your records. Each phone keeps its own copy, so a new phone signing in never writes over the copy from the one you lost, and Restore from my account shows every copy with its date and how many sales it holds. This is the only thing in this app that sends your sales anywhere, and it happens only while you are logged in — signing in is how you ask for it. A guest account does not count and nothing is sent.
It is the same file "Save a backup" writes: items, sales, costs, stock, staff, hours and pay, shop settings including any legacy unverified account contact phone, and no PINs. Catalogue photographs remain outside this file. Original PDF, JPEG or PNG agreement copies that you explicitly add to Agreement records are included, along with their recording metadata and any amendments. They may contain names, contact details, signatures and other personal information supplied by the parties. It is stored under your account and the rules on the server allow only that account to read it, write it or delete it — not another merchant, not somebody who is not logged in.

It is saved when you come back to the app, at most once every six hours, and only when something has changed. Reports → Safe keeping shows when it was last actually saved — never when it was last attempted.

One account keeps copies of up to ten shops. Saving a copy of an eleventh shop removes the copy that was saved longest ago.

To stop it: Remove the copy on that same screen takes it out of your account, and logging out stops anything further being sent. Deleting your account removes it with everything else.
Export everything. The export produces a plain CSV of your own records. It is your data and the format is open. It is a report, not a backup — the app cannot read a CSV back in.

Khmer · ភាសាខ្មែរ

This policy is written in English. The deletion route is here in Khmer because it is the one instruction on this page a reader has to be able to act on; the support page carries the same block. A short local AI and model-download summary is also provided below and marked for native review; it is not a translation of the whole policy.

AI នៅលើឧបករណ៍ និងការទាញយកម៉ូដែល

ការជ្រើសរើស AI ឬ AI Pro រក្សាទុកជម្រើសនៅលើឧបករណ៍នេះ។ វាមិនបើក AI ទេ។ បច្ចុប្បន្ន AI នៅតែបិទ។ កម្មវិធីមិនទាន់មានការសន្ទនាជាមួយជំនួយការ ប្រវត្តិការសន្ទនា ឬការប្រើមីក្រូហ្វូនសម្រាប់ជំនួយការទេ។ កំណែ Android បច្ចុប្បន្នទទួល និងឆ្លើយតែអត្ថបទ។

ការទាញយកម៉ូដែល ពេលអាចប្រើបាន ត្រូវការអ៊ីនធឺណិត។ សំណើឯកសារម៉ូដែល និងអាសយដ្ឋានបណ្តាញត្រូវបានផ្ញើទៅ Hugging Face ហើយអាចបញ្ជូនបន្តទៅកន្លែងផ្ទុកឯកសារផ្សេង។ សំណើនេះមិនភ្ជាប់សារដែលអ្នកសួរជំនួយការ ឬកំណត់ត្រាហាងទេ។ ឯកសារម៉ូដែល និងឃ្លាំងសម្ងាត់ Android មិនចូលក្នុងការបម្រុងទុករបស់ Android ឬការផ្ទេរទៅឧបករណ៍ផ្សេងទេ។

វចនានុក្រមខ្មែរមានភ្ជាប់ក្នុងកម្មវិធី ហើយអានបានដោយគ្មានអ៊ីនធឺណិត។ វាជាទិន្នន័យយោងពី Wiktionary / Kaikki.org ក្រោមអាជ្ញាបណ្ណ CC BY-SA 4.0។ មើល AI → ប្រភពវចនានុក្រម។ សេចក្តីពន្យល់ភាគច្រើនជាភាសាអង់គ្លេស ហើយគុណភាពភាសាខ្មែរមិនទាន់បានពិនិត្យដោយអ្នកប្រើភាសាខ្មែរទេ។ វាមិនបណ្តុះបណ្តាលម៉ូដែល ឬកែការស្គាល់សំឡេងទេ។

គោលការណ៍នេះជាភាសាអង់គ្លេស។ ផ្នែកសំខាន់បំផុតគឺរបៀបលុបទិន្នន័យរបស់អ្នក។

លុបទិន្នន័យ · ម្ចាស់ហាង៖ ផ្សេងៗ → ព័ត៌មានហាង → គណនី → លុបគណនី។ អតិថិជន៖ គណនី → លុបទិន្នន័យរបស់ខ្ញុំ។ ហាងនៅតែរក្សាកំណត់ត្រានៃការលក់ ដោយដកឈ្មោះ លេខទូរស័ព្ទ និងអាសយដ្ឋានរបស់អ្នកចេញ។ សូមបញ្ចប់ការកម្ម៉ង់ដែលកំពុងដំណើរការជាមុនសិន។

កម្ម៉ង់តាមតំណម៉ឺនុយ ដោយគ្មានកម្មវិធី? វាគ្មានគណនីទេ។ បើកទំព័រនៃការកម្ម៉ង់នោះ ហើយចុច លុបព័ត៌មានរបស់ខ្ញុំ ពេលការកម្ម៉ង់បញ្ចប់។ សូមរក្សាតំណនោះទុក។

បាត់តំណនោះ? សូមសុំឱ្យយើងលុបឱ្យ។ យើងពិនិត្យជាមុនសិន ដោយទូរស័ព្ទ ឬផ្ញើសារទៅលេខទូរស័ព្ទលើការកម្ម៉ង់នោះ។

ទោះអ្នកមិនសុំក៏ដោយ ព័ត៌មានរបស់អ្នកនឹងត្រូវលុបចេញពីការកម្ម៉ង់តាមតំណម៉ឺនុយ 90 ថ្ងៃ ក្រោយពេលការកម្ម៉ង់បញ្ចប់។

គណនីមួយរក្សាទុកច្បាប់ចម្លងហាងបានរហូតដល់ 10។ ពេលរក្សាទុកច្បាប់ចម្លងហាងទី 11 ច្បាប់ចម្លងដែលបានរក្សាទុកយូរជាងគេត្រូវលុប។

ពេលអ្នកប្រើម៉ឺនុយរបស់ហាងលើវេប យើងរាប់សំណើពីអាសយដ្ឋានអ៊ីនធឺណិតរបស់អ្នកមួយរយៈខ្លី ដើម្បីកុំឱ្យនរណាម្នាក់ផ្ញើការកម្ម៉ង់ ឬការហៅ ច្រើនពេកទៅហាងបាន។ យើងមិនរក្សាទុកអាសយដ្ឋាននោះទេ ហើយការរាប់ត្រូវលុបក្នុងរយៈពេលប្រហែលមួយថ្ងៃ។

ឬសុំឱ្យយើងលុបគណនីរបស់អ្នកឱ្យ ពីជំនួយក្នុងកម្មវិធី ឬតាមអ៊ីមែល។ យើងពិនិត្យថាគណនីនោះជារបស់អ្នកជាមុនសិន ហើយលុបវាដូចក្នុងកម្មវិធីដែរ។

កម្មវិធីទាំងពីរបង្ហាញពាណិជ្ជកម្មបន្តិចបន្តួច ពី Google។ ហាងដែលប្រើគម្រោងបង់ប្រាក់ មិនឃើញពាណិជ្ជកម្មទេ។ ការកំណត់ពាណិជ្ជកម្មក្នុងទូរស័ព្ទរបស់អ្នក អាចកំណត់ឡើងវិញ ឬលុបលេខសម្គាល់ពាណិជ្ជកម្ម។

Changes

When this policy changes, the date at the top of this page changes with it. The app does not know that date, so it does not tell you by itself that this page has changed; the date is how you can tell. When the Terms of Use change in a way that affects what you are agreeing to, the app asks you to agree again, in the app, the next time you publish your shop, place an order, write on an order or review a shop.

A note on what "we cannot see it" means

It is the ordinary meaning. Your sales are written to a database file inside the app's private storage on your own device. That file itself is never sent anywhere, no key is held by us, and there is no mechanism by which we could request one.

Two precisions, because a policy that is nearly true is worse than one that is plain. If you have connected a second phone, the sale summaries described above do reach Firebase, because that is the only way the owner's phone can show them. That is a few numbers per sale, a seller's name and, from a staff phone, which items it sold, as codes; and the owner's items, prices and counts reach the shop's own phones. And if you are logged in, your book — what you sold, what it cost you, what you made, your stock, your expenses — is also kept as the copy in your own account described under "A copy in your account", which the server's rules let only your account read.

If you are not logged in and your phone is lost, we cannot help you — there is nothing on our side to restore from. That is the trade this design makes on purpose, and it is why the backup exists and why it is yours to keep: logged out, the file you save is the only copy there is, and where it lives is your decision rather than ours. Logged in, the copy in your account is the second one, and you restore it yourself from More → Reports → Safe keeping → Restore from my account.

Merchant discount settings are kept with the shop. Published customer offers, their revision history, applied receipt amounts and reserved/paid usage are stored privately to validate prices and prevent duplicate redemption. Entered codes are retained on the corresponding order. A verified account may be linked to an account-limited redemption; anonymous phone text is not a verified account. Deleting a merchant account removes its private promotion settings, history and redemption ledgers. Deleting a customer account removes its code and account links/counters while the merchant retains the receipt's monetary amounts and global usage without that customer's identity.