Privacy Policy

Effective Date: October 25, 2026 Last Updated: October 25, 2026

STAFFMA ("STAFFMA", "we", "us", or "our") is a software-as-a-service platform operated by BG ERA GAMES USA LLC, a New York limited liability company.

Legal Entity: BG ERA GAMES USA LLC Brand / Product: STAFFMA Registered State: New York, United States Business Address: 8718 Ridge Blvd, Apt 5C, Brooklyn, NY 11209, United States Email: staffma.com@gmail.com Website: https://staffma.com/

This Privacy Policy explains how personal information is collected, used, stored, and disclosed when you access or use STAFFMA, including the STAFFMA website, application, restaurant management tools, staff management features, customer feedback features, rewards features, and related services (collectively, the "Services").

1. Who We Are

STAFFMA is operated by BG ERA GAMES USA LLC.

For information that STAFFMA collects and uses for its own purposes, BG ERA GAMES USA LLC acts as the controller of that information where applicable.

STAFFMA also provides services to restaurants and other business customers. When a restaurant uses STAFFMA to process information about its employees, staff members, customers, or restaurant operations, the restaurant may determine the purposes and means of that processing.

In those circumstances, the restaurant or business customer may act as the data controller, while STAFFMA may act as a data processor or service provider processing information on the customer's behalf.

The applicable roles depend on the particular processing activity.

2. Information We Collect

The information collected by STAFFMA depends on how you use the Services.

2.1 Restaurant Owner and Account Information

When a restaurant owner or authorized business user creates or manages a STAFFMA account, we may collect:

Name Email address Account authentication information Organization information Restaurant information User role Account status Subscription information Communication and notification preferences 2.2 Restaurant Information

Restaurant owners and authorized users may provide information such as:

Restaurant name Restaurant address City Country Restaurant category Telephone number Website Restaurant description Restaurant settings Business hours or operational information Reward and points settings Other information necessary to operate the restaurant's STAFFMA account

Some restaurant information may be displayed publicly through STAFFMA's restaurant discovery and listing features.

2.3 Staff Information

Restaurants may use STAFFMA to manage members of their staff.

Depending on the features used by the restaurant, STAFFMA may process:

Staff member name Email address Restaurant affiliation Staff role or position Account information Performance-related information Customer feedback associated with staff activity Ratings Recognition information Points and rewards Tip-related information where the relevant feature is enabled Notification information Information relating to staff activity within the Services

The restaurant is responsible for determining the appropriate lawful basis for providing staff information to STAFFMA and for informing its staff members about the applicable processing where required by law.

When a staff member activates their account from a restaurant's invitation, STAFFMA also records that they accepted the Terms & Conditions, the version of the Terms & Conditions that they accepted (identified by its language and the date and time of its last update) and the date and time of their acceptance, as recorded by STAFFMA's servers.

2.4 Google Business Profile Information

If a restaurant owner connects a Google Business Profile location to STAFFMA, STAFFMA processes:

The Google account and location identifiers needed to read that location's reviews and to publish replies An authorization token for that Google account, stored encrypted The status of the connection Review information read from Google when it is needed, such as star ratings and review text

STAFFMA reads reviews from Google when an owner opens the Google Reviews page or when Google announces a new review. STAFFMA does not store review text in its database. In-app notifications about a new Google review contain the restaurant name and the star rating, not the review text and not the reviewer's name. Staff members receive notifications that contain the star rating only.

2.5 Telegram Notification Information

Telegram notifications are optional. They are available only to restaurant owners, and only when the feature is enabled and included in the restaurant's subscription plan. Staff members never receive Telegram notifications from STAFFMA. If an owner connects Telegram, STAFFMA processes:

A keyed hash of the owner's Telegram user ID, used to recognize the owner's chat The Telegram chat ID, stored encrypted, used to deliver messages to that chat A one-time connection link and a six-digit confirmation code, stored only as keyed hashes and valid for ten minutes The content of messages waiting to be delivered, stored encrypted until delivery The text of a review reply that the owner writes in Telegram, stored encrypted until it is posted or discarded, and for no more than fifteen minutes The identifier of the Google review that a Reply button refers to, stored encrypted for no more than 30 days, and removed earlier when the alert it belongs to is deleted For each Google review alert delivered: the Telegram message identifier and an encrypted copy of the chat ID, kept only until the alert is deleted from the chat and for no more than 48 hours after delivery, and a record of the deletion's result, kept for up to 7 days Delivery status information, such as whether a message was sent, failed or was cancelled

Telegram messages sent by STAFFMA may contain:

For a new Google review: the restaurant name, the star rating and the text of the review, but never the reviewer's name, username or photo. A comment longer than 3,500 characters is shortened at the end of a whole word, marked as shortened, and accompanied by a link to read the review in full in STAFFMA, where the owner must sign in For a staff payout request: the staff member's name, the restaurant, the points and the amount The restaurant owner's weekly report, which contains the restaurant's figures for the week and, for each staff member, their name and their ratings, points, tips (where the restaurant uses Tips), redeemed rewards and the number of happy or unhappy pieces of feedback

These messages are sent only to owners of the restaurant concerned. STAFFMA does not send Google review alerts to staff members through Telegram.

3. Customer Feedback

STAFFMA allows restaurant customers to provide feedback and ratings without creating a STAFFMA account.

Depending on the restaurant's configuration, customer feedback may include:

Ratings Written feedback Information voluntarily entered by the customer Information associated with the restaurant and feedback interaction Technical information used for security and abuse prevention

STAFFMA does not require customers to create an account simply to submit restaurant feedback.

STAFFMA may apply technical controls designed to prevent repeated or abusive submissions and to protect the fairness and integrity of the feedback system.

4. Location Information

Some STAFFMA features allow users to discover restaurants based on location or city.

Where supported, STAFFMA may request permission to access the approximate or precise location provided by a user's browser or device.

Location permission is optional.

If permission is denied, STAFFMA may continue to provide relevant functionality using manually selected or otherwise available city information.

STAFFMA does not require continuous precise location tracking for ordinary use of the Services.

5. Payment and Subscription Information

STAFFMA offers paid subscriptions to restaurants and business customers.

Payments and subscription billing are processed through Stripe, our third-party payment service provider.

When you make a payment, Stripe may process information such as:

Payment card information Billing information Customer information Transaction information Subscription information

STAFFMA does not intentionally store complete payment card numbers or card security codes on its own application database.

Payment information is processed by Stripe in accordance with Stripe's applicable privacy practices and terms.

6. Technical Information

When you access STAFFMA, certain technical information may be automatically processed, including where applicable:

IP address Browser type Device type Operating system Language preferences Date and time of requests Authentication events Security events Application errors Diagnostic information Information necessary to maintain the security and reliability of the Services

This information is used primarily to operate, secure, maintain, and troubleshoot STAFFMA.

7. How We Use Personal Information

We may process personal information for the following purposes:

Providing the Services

To:

Create and manage accounts Authenticate users Provide restaurant management functionality Provide staff management functionality Process customer feedback Provide ratings and recognition features Manage points and rewards Provide restaurant discovery features Process subscriptions and payments Security and Abuse Prevention

To:

Protect accounts Prevent unauthorized access Detect and prevent fraud Prevent abuse of feedback and reward functionality Investigate suspicious activity Maintain platform security Communications

To send:

Account-related communications Authentication emails Subscription and billing notifications Service notifications Security notifications Customer support communications Other necessary transactional communications Service Improvement

To:

Maintain the Services Diagnose technical issues Improve functionality Monitor reliability Develop and maintain platform features Legal Compliance

To:

Comply with applicable laws Respond to lawful requests Establish or defend legal claims Enforce our agreements Protect the rights, property, and safety of STAFFMA and its users

Optional Telegram Notifications

If a restaurant owner connects Telegram, to:

Send that owner alerts about new Google reviews, staff payout requests and the weekly report Allow that owner to reply to a Google review from Telegram, after reviewing a preview and confirming the reply Delete Google review alerts from the owner's chat automatically after delivery Recognize the owner's chat and protect the connection against misuse

8. Legal Bases for Processing

Where the GDPR or another applicable data protection law applies, we process personal information on appropriate legal bases.

These may include:

Contract

Processing may be necessary to provide the Services, manage an account, provide a subscription, process payments, or perform an agreement.

Legitimate Interests

We may process information where necessary for legitimate interests such as:

Platform security Fraud and abuse prevention Service administration Customer support Maintaining and improving the Services Protecting our legal rights

Where we rely on legitimate interests, we consider the applicable rights and interests of individuals.

Consent

Where required by law, we may process information based on consent.

Where processing relies on consent, you may withdraw that consent where legally applicable.

Legal Obligations

We may process information where necessary to comply with applicable legal obligations.

Telegram Notifications, Google Reviews and Staff Information

Telegram notifications are sent because a restaurant owner chose to connect Telegram and asked STAFFMA to deliver alerts there. For the owner's own information, this processing is necessary to provide the feature requested by the owner, and the owner can stop it at any time by disconnecting Telegram.

When a Telegram alert includes the text of a Google review, that text is content that the reviewer published on Google about the restaurant. STAFFMA makes it available only to the restaurant's own owners, so that they can read and respond to the review, and never includes the reviewer's name. Where applicable, this processing is based on the legitimate interest of the restaurant in responding to its reviews.

Payout alerts and weekly reports contain information about the restaurant's staff, including their names. The restaurant determines this processing, as the employer or business that manages its staff and their payouts, and STAFFMA processes the information on the restaurant's behalf. The restaurant is responsible for having an appropriate legal basis, such as the management of the working relationship and of payout requests made by the staff member, or the restaurant's legitimate interest in managing its team, and for informing its staff. Choosing Telegram as the channel is the owner's decision; the same information remains available in STAFFMA and by email.

Acceptance of the Terms & Conditions by Staff Members

When a staff member activates their account, they must accept the Terms & Conditions, which govern their use of STAFFMA. STAFFMA keeps a record of that acceptance, namely the version accepted and when it was accepted, to document the agreement and to be able to demonstrate it. Accepting the Terms & Conditions is not consent to the processing of personal data, and it is not consent to any international transfer of personal data. The processing of staff information is based on the grounds described in this section.

9. When We Share Information

We may disclose personal information to service providers that help us operate STAFFMA.

Depending on the service, these providers may provide:

Cloud infrastructure Database services Authentication services Payment processing Email delivery Security services Technical infrastructure Monitoring and error handling

Service providers may process personal information only as necessary to provide their services and subject to applicable contractual or legal requirements.

Where a restaurant uses STAFFMA, information may also be accessible to authorized users of that restaurant according to the restaurant's STAFFMA permissions and configuration.

We may also disclose information when:

Required by applicable law Required by valid legal process Necessary to protect rights, safety, or property Necessary to investigate fraud or abuse Necessary to enforce our agreements In connection with a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction

Google

If a restaurant owner connects a Google Business Profile location, STAFFMA exchanges information with Google to read that location's reviews and, when the owner asks, to publish the owner's reply. A reply published through STAFFMA, including a reply sent from Telegram, is published by Google and is publicly visible.

Telegram

If a restaurant owner connects Telegram, the messages described in this Privacy Policy, including staff names in payout alerts and weekly reports and the text of Google reviews, are delivered through the Telegram Bot API. Telegram (Telegram Messenger Inc.) receives the content of those messages, and the information of the owner's Telegram account, and processes them under its own terms and privacy policy (https://telegram.org/privacy) as a provider chosen by the owner. Telegram stores these messages on its own servers. They are not sent in a Telegram secret chat, which is the only kind of Telegram chat that is end-to-end encrypted.

10. Restaurant-Controlled Information

When you use STAFFMA through a restaurant or other organization, that organization may control certain information processed through its STAFFMA account.

For example, a restaurant may have access to information concerning:

Staff accounts Staff roles Staff activity Customer feedback Ratings Points Rewards Restaurant-related performance information

Where a restaurant or organization determines the purposes and means of processing, requests concerning that information may need to be directed to the relevant restaurant or organization.

STAFFMA may assist the organization in responding to applicable privacy requests as required by law and the applicable agreement.

11. International Data Transfers

BG ERA GAMES USA LLC is located in the United States, and STAFFMA uses service providers that may process information in countries other than the country where a user resides.

Accordingly, personal information may be transferred to or processed in the United States and other jurisdictions.

Where applicable law requires safeguards for international transfers, STAFFMA will use an appropriate legal mechanism for the transfer, such as an adequacy decision, appropriate contractual safeguards, or another lawful transfer mechanism.

Telegram Notifications

Telegram Messenger Inc. is also located outside the European Economic Area. STAFFMA sends messages to Telegram only when a restaurant owner has chosen to connect Telegram, and only to that owner's own chat. When this happens, the personal information in those messages, such as staff names in payout alerts and weekly reports and the text of Google reviews, is transferred to Telegram Messenger Inc., which processes it under its own privacy policy. That policy states that the data of users who signed up for Telegram from the European Economic Area or the United Kingdom is stored in data centers in the Netherlands.

For these messages, STAFFMA does not rely on an adequacy decision of the European Commission and has not entered into a data transfer agreement with Telegram, such as the standard contractual clauses approved by the European Commission. Telegram notifications are optional and are sent only to owners who connect Telegram; the same information remains available in STAFFMA and by email. Staff members and other people whose information may appear in these messages can contact their restaurant, or STAFFMA using the contact details at the end of this Privacy Policy, with any questions about this.

12. Data Retention

We retain personal information for only as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

Provide the Services Maintain accounts Provide customer support Maintain business and transaction records Prevent fraud and abuse Maintain security Resolve disputes Comply with legal, tax, accounting, and regulatory obligations

The applicable retention period depends on the type of information, the reason for processing, and applicable legal requirements.

When information is no longer required, it may be deleted, anonymized, or securely disposed of, subject to applicable legal requirements and legitimate business needs.

Specific retention periods include:

Record of a staff member's acceptance of the Terms & Conditions: kept for as long as the account exists, and deleted with the account In-app notifications about a new Google review: up to 10 days for owners and up to 7 days for staff members Google review text: not stored in STAFFMA's database; when a Telegram alert includes it, it is kept encrypted only until the message is delivered, and for no more than 48 hours Google review alerts in the owner's Telegram chat: STAFFMA asks Telegram to delete each alert from the chat from about 46 hours after delivery, and keeps trying until Telegram's 48-hour limit for deleting a bot's message. STAFFMA records an alert as deleted only when Telegram confirms it. If Telegram cannot delete it in time, for example because the bot was blocked, the message was already removed, or Telegram was unavailable, the alert may remain in the chat until the owner deletes it Telegram connection links and confirmation codes: up to 10 minutes Review replies being written in Telegram: up to 15 minutes The Google review identifier used by a Telegram Reply button: up to 30 days, and removed when the alert is deleted The information needed to delete an alert (message identifier and encrypted chat ID): until the alert is deleted, and no more than 48 hours after delivery; the record of the result: up to 7 days Telegram delivery records: up to 30 days Telegram connection information: until the owner disconnects Telegram or the account is deleted

Payout alerts and weekly reports are not deleted automatically. Like any other delivered message, they remain in the owner's Telegram chat, under Telegram's own practices, until the owner deletes them in Telegram.

13. Data Security

STAFFMA uses reasonable technical and organizational measures designed to protect personal information.

These measures may include:

Authentication controls Role-based access controls Database access controls Encryption in transit Security monitoring Access restrictions Abuse prevention mechanisms Protection against unauthorized access

No internet-based service can guarantee absolute security. Accordingly, we cannot guarantee that personal information will always be completely secure.

14. Cookies and Google Analytics

STAFFMA uses cookies and similar technologies to operate, secure, and improve the Services.

STAFFMA uses Google Analytics, a web analytics service provided by Google, to understand how visitors use the STAFFMA website and to measure website traffic and usage.

Google Analytics may collect information such as:

Device and browser information Approximate geographic location Pages visited Interaction and usage information Session information Technical information associated with website visits

Google Analytics may use cookies, including the _ga cookie, to distinguish users and sessions.

Where required by applicable law, STAFFMA will obtain the user's consent before using analytics cookies and will respect the user's consent choice. Google provides Consent Mode mechanisms that allow websites to communicate a user's consent choice to Google and adjust Analytics behavior accordingly.

Users may manage or withdraw applicable cookie consent through the cookie settings provided on the STAFFMA website, where available.

Google's processing of information collected through Google Analytics is also subject to Google's applicable privacy policies and terms.

15. Your Privacy Rights

Depending on your location and applicable law, you may have rights including:

The right to access personal information The right to correct inaccurate information The right to request deletion The right to restrict certain processing The right to object to certain processing The right to data portability The right to withdraw consent where applicable The right to lodge a complaint with a competent data protection authority

These rights are subject to applicable legal limitations and exceptions.

To submit a privacy request, contact:

staffma.com@gmail.com

We may request information necessary to verify your identity before processing certain requests.

Restaurant owners can disconnect Telegram at any time from the Telegram page of their STAFFMA workspace. Disconnecting deletes the connection, cancels every message still waiting to be delivered and deletes its content. Google review alerts already delivered are still deleted automatically as described above. Blocking the STAFFMA bot in Telegram also stops further messages, but may prevent STAFFMA from deleting alerts already delivered.

16. European Economic Area, United Kingdom and Switzerland

If you are located in the European Economic Area, United Kingdom, or Switzerland, additional rights may apply under applicable data protection laws.

These may include the right to:

Obtain access to your personal information Request correction or deletion Restrict or object to processing Request portability Withdraw consent where applicable Lodge a complaint with your relevant supervisory authority

The GDPR requires controllers to provide information about the purposes and legal bases of processing, recipients, international transfers, retention and applicable rights.

17. California Privacy Rights

California residents may have additional rights under applicable California privacy laws.

Depending on the applicable law, these may include rights concerning access, deletion, correction, and information about certain processing or disclosures.

STAFFMA does not sell personal information for monetary consideration.

California privacy requests may be submitted to:

staffma.com@gmail.com

We may verify requests as permitted or required by applicable law.

18. Children's Privacy

STAFFMA is designed for businesses, restaurant staff, and customers using restaurant services.

The Services are not directed to children.

We do not knowingly collect personal information from children where applicable law requires parental consent.

If you believe a child has provided personal information to STAFFMA in circumstances where such collection was not permitted, please contact us at:

staffma.com@gmail.com

19. Third-Party Services

STAFFMA uses third-party providers to support the operation of the platform.

These may include providers for:

Hosting and infrastructure Database services Authentication Payment processing Email delivery Security Technical operations

Third-party providers may process information according to their own terms and privacy practices, as well as their contractual obligations to STAFFMA.

Where a restaurant chooses to use them, these also include Google (Google Business Profile, for reviews and replies) and Telegram (for optional notifications to restaurant owners).

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be made to reflect:

Changes to STAFFMA New features Changes in data processing Changes in applicable law Changes in security practices Changes in our business operations

When required by applicable law, we will provide additional notice of material changes.

The date at the beginning of this Privacy Policy indicates when it was last updated.

21. Contact Us

For questions, privacy requests, or concerns regarding this Privacy Policy or STAFFMA's processing of personal information, contact:

BG ERA GAMES USA LLC STAFFMA

8718 Ridge Blvd, Apt 5C Brooklyn, NY 11209 United States

Email: staffma.com@gmail.com

Website: https://staffma.com/