PokéWave

Draft template — not legal advice. Counsel must review before customer-facing launch. Engineering controls below are product posture, not a substitute for a DPA.

Where AI is used

Storefront generation from your prompt, URL scrape, or brand inputs
Sidekick edits (copy, layout, menu, theme) via configured LLM providers
Optional image generation when enabled in your deployment
QA and design scoring helpers

What we send to models

Prompts may include business name, menu items, scraped public website text, section structure, and edit instructions. Do not submit secrets, PCI data, health data, or personal data you are not authorized to share.

PII in logs & prompts

Application logs use structured route errors; raw prompt bodies are not written to stdout by default
Telemetry stores destination URLs and path aggregates — not end-customer names or emails
SDUI render errors store message hashes for grouping, not full exception text with PII
Operators should keep SENTRY_DSN scrubbing rules enabled in the Sentry project (strip Authorization, cookies, email fields)

Retention

Build artifacts and preview schemas persist for the life of the workspace (or until owner deletion). Telemetry events are retained for analytics windows (7/30-day merchant views; longer ops aggregates may apply). Support tickets remain until closed and purged per ops policy. Request deletion via Settings or privacy@tapmango.com.

Mock / demo mode

When USE_MOCK_AI=true, builds use deterministic offline templates — no external AI calls. Sidekick may still use rule-based edits unless a cloud model is configured.

Your responsibilities

Review all AI output before publish — accuracy, allergens, pricing, and claims
Ensure you have rights to images and copy you publish
Disclose AI-assisted content to customers if required in your jurisdiction

AI & Data