Privacy Policy

This Privacy Policy explains how Aiqon Limited (“Aiqon”, “we”, “us”, “our”), trading as Cornerly, collects, uses, shares and protects personal data. It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the Irish Data Protection Acts 1988–2018, and the ePrivacy Regulations 2011 (S.I. No. 336/2011).

Who we are. Aiqon Limited is a company registered in Ireland and is the data controller and contracting entity for the Cornerly platform. You can reach our privacy team at privacy@cornerly.ie.

1. Our two roles (controller and processor)

Cornerly has a two-sided model, so our role depends on whose data it is:

• We are the data controller for personal data about the business owners, managers and staff who use the Cornerly admin (account details, login credentials, billing and usage data) and about visitors to our marketing site.
• We are a data processor for the customer and order data that a business (our client, the “Merchant”) collects through its own Cornerly-powered storefront. The Merchant is the controller of that data; we process it strictly on the Merchant’s documented instructions to provide the Service, under a data processing agreement that forms part of our Terms of Service. If you are a customer of a Merchant, please also see that Merchant’s own privacy notice.

2. Personal data we collect

• Account data (controller): name, business name, email address, phone number, password (stored only as a salted hash, never in plain text), role, and contact details.
• Billing data (controller): subscription plan, invoices, and usage of metered add-ons. Card details are handled by our payment processor; we do not store full card numbers.
• Order data (processor): a customer’s name, phone number, email (if provided), order contents, pickup/collection time, loyalty activity, and payment status, submitted through a Merchant’s storefront.
• Communications: messages you send us (support, demo requests, sales enquiries) and our replies.
• Technical & usage data: IP address, device/browser information, and application logs needed to operate, secure and debug the Service.
• Cookies & similar technologies: see our Cookie Policy.

We do not sell personal data, we do not use it for third-party advertising, and we do not carry out profiling that produces legal or similarly significant effects.

3. Why we use your data and our legal bases

We rely on the following legal bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): to create and run your account, provide the Service, process orders, and take payment.
• Legal obligation (Art. 6(1)(c)): to keep accounting, tax and transaction records required by law.
• Legitimate interests (Art. 6(1)(f)): to secure, maintain, troubleshoot and improve the Service, prevent fraud and abuse, and respond to your enquiries. We balance these interests against your rights.
• Consent (Art. 6(1)(a)): for optional marketing emails and for any non-essential cookies. You may withdraw consent at any time.

4. Sharing and sub-processors

We share personal data only with trusted service providers that help us run Cornerly, each bound by a written contract and appropriate safeguards, and only as needed for their function. Our current categories of sub-processor are:

• EU-hosted infrastructure — application hosting, database, file storage and transactional email
• Payments (when enabled) — Stripe
• SMS (only where a Merchant enables it) — Twilio
• WhatsApp messaging (only where a Merchant enables it) — Meta Platforms Ireland Limited (WhatsApp Business Platform)
• AI ordering assistant and voice-note transcription (only where a Merchant takes orders on WhatsApp) — Mistral AI (France, EU)
• Bot protection on the forms on our website — Cloudflare Turnstile, which checks a submission comes from a person rather than a script

Every provider we currently use is named, with what it does, on our sub-processor list, which forms part of this policy. It lives on its own page, with its own date, so that changing a provider does not mean re-issuing this policy — and so you can see at a glance when the list last changed.

We may also disclose data where required by law, regulation, legal process, or to protect the rights, safety and property of Aiqon, our clients or others. We will tell controllers of any new sub-processor where required by our processing agreement.

5. Ordering on WhatsApp

Some Merchants take orders on WhatsApp through Cornerly Orders, a WhatsApp Business number run by Aiqon for all participating Merchants. You choose the Merchant by tapping its link or QR code, or by typing its name.

• What we use: your WhatsApp phone number (already verified by WhatsApp), the profile name you have set in WhatsApp, the messages and voice notes you send, and the order you place.
• Who is responsible: the Merchant you order from is the controller of your order and your chat with it, and we process them on its behalf (section 1). We are the controller of the little we need to run the shared number itself: which Merchant you last chose, and limits that stop abuse.
• The AI assistant: an automated assistant, provided by Mistral AI, reads your message and replies using the Merchant’s live menu, prices and opening hours. It receives your message, your first name and your current basket — not your phone number. It cannot place an order on its own: an order is only sent to the Merchant when you confirm the summary. You can ask for a person at any time by typing “staff”.
• Voice notes: turned into text by Mistral AI’s speech-to-text service. The recording is not kept; only the text is.
• Merchants see only their own chats. A Merchant’s staff can read and reply to your chat with that Merchant; no other Merchant can see it.
• How long: the text of WhatsApp messages is deleted after 30 days. Orders are kept as the Merchant’s records (tax law typically requires six years).

Deleting your WhatsApp data. Send delete my data in the chat with Cornerly Orders, then reply DELETE when asked. This erases your messages and chat with that Merchant straight away. You can also email privacy@cornerly.ie from any address, giving your WhatsApp number, and we will delete your WhatsApp data with every Merchant within one month. Past orders stay in the Merchant’s records where the law requires.

6. International transfers

We host and process data within the EU/EEA where reasonably practicable. Where a provider processes personal data outside the EEA, we rely on a valid transfer mechanism — an EU adequacy decision or the European Commission’s Standard Contractual Clauses (SCCs), with supplementary measures where appropriate.

7. How long we keep data (retention)

• Account data: for as long as your account is active, then deleted or anonymised, except where we must retain records (e.g. invoices and tax records, typically kept for up to 6 years under Irish law).
• Order data (as processor): retained per the Merchant’s configuration and instructions, and deleted or anonymised when no longer needed for the purpose collected.
• WhatsApp messages: the text of messages is deleted after 30 days (section 5).
• Technical logs: kept for a limited period for security and troubleshooting, then deleted.

8. How we protect your data (security)

We implement appropriate technical and organisational measures, including: encryption of data in transit (TLS); passwords stored only as salted hashes; strict database-level tenant isolation so one business can never access another’s data; role-based access controls and least-privilege access for our team; and regular backups. No system is perfectly secure, but we work to protect personal data against unauthorised access, loss or alteration.

9. Data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours where required, and affected individuals and controllers without undue delay, in line with Articles 33–34 GDPR.

10. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (“right to be forgotten”) (Art. 17);
• restrict our processing of your data (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email privacy@cornerly.ie. We will respond within one month. If your request concerns data a Merchant controls (order data), we will forward it to, or ask you to contact, that Merchant. You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).

11. Marketing

We only send marketing emails where you have opted in or where permitted by law. Every marketing email includes an unsubscribe link, and you can opt out at any time by contacting us. Opting out of marketing does not affect service-related messages (e.g. billing or security notices).

12. Children

Cornerly is a business tool and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new “last updated” date and, for material changes, take reasonable steps to notify you.

14. Contact

Data protection enquiries: privacy@cornerly.ie. Aiqon Limited, Ireland — data controller and contracting entity for Cornerly.