Privacy & Data Security Policy

1. Who We Are & Permanent Establishment

JamaicanReply ("we", "us", "our") is an AI-powered conversational commerce and order management platform owned and operated by Kortesy Group Limited, registered at Lot 235 Phoenix Park Village, Greater Portmore, St. Catherine, Jamaica. This Privacy Policy outlines our standards for collecting, processing, and safeguarding personal and payment data across jamaicanreply.com.

2. Information We Collect

We collect information provided directly by users and merchant customers:

• Account Credentials: Business owner name, email address, contact numbers, and authentication keys.
• Merchant Profile: Business name, location, opening hours, menus, pricing, and operational settings.
• Customer Order Details: Customer name, telephone number, delivery address, order items, and fulfillment preferences.
• Customer Inquiries: Inbound and outbound chat messages handled on behalf of businesses.

We also gather essential technical telemetry automatically:

• Device type, browser version, and approximate IP geolocation
• Operational logs and session security timestamps

3. Payment Card Data Transmission & PCI-DSS Compliance

We take payment card protection with the highest level of rigor. All online credit and debit card transactions conducted through CaymanReply are secured in partnership with First Atlantic Commerce / Powertranz and National Commercial Bank (JNCB):

• Encrypted transmission: Card details (the card number, the cardholder name, the expiry date and the security code) are sent over TLS to our payment endpoint, which relays them over TLS to the PCI-DSS Level 1 certified gateway operated by First Atlantic Commerce / Powertranz. They are held in memory only for the length of that request.
• Nothing is stored and nothing is logged: Full card numbers and security codes are never written to our databases, our logs or any file. What is kept is the masked card (for example "Visa ending 1234") and the gateway's transaction reference, which are what a receipt and a reconciliation need.
• 3D Secure 2.0 Authentication: Transactions on Visa and Mastercard are protected with 3D Secure 2.0 (Visa Secure and Mastercard Identity Check) two-factor authentication, verifying cardholder identity directly with the issuing bank before authorizing funds.

4. How We Use Information

• To route and fulfill customer food, beverage, and retail orders
• To power intelligent, accurate conversational AI assistance for merchants
• To facilitate secure payment authorization and provide verifiable digital receipts
• To send vital order notifications (receipt confirmations, preparation status, ready alerts)
• To maintain platform reliability and prevent fraudulent or abusive activity

5. Data Sharing & Service Providers

We share data strictly with certified infrastructure partners essential to delivering the Service:

• Powertranz / First Atlantic Commerce & JNCB: Payment gateway and merchant acquiring bank for card authorization and settlement
• Anthropic: Enterprise conversational AI engine (data is not used to train public foundation models)
• Supabase: Encrypted relational database and authentication
• Resend: Secure transactional email dispatch
• Vercel: Global application hosting with Web Application Firewall (WAF)

We do not sell, rent, or monetize your personal or business data under any circumstance.

6. Data Retention & Customer Rights

Customer orders and conversation records are retained for active operational fulfillment and accounting audits. Users have the right to inspect, correct, or request deletion of their personal information at any time by contacting our data officer at info@jamaicanreply.com.

7. Contact & Legal Establishment

For inquiries regarding privacy, data rights, or card security, please contact: