Security & privacy

Protect account access

Use separate staff identities. Give only the modes and extra permissions needed. Remove staff access when someone leaves. Verify the business name before changing services, QR assignment or billing. Keep the owner's phone and linked Google account protected; do not share OTPs. Sign out of a shared reception device at the end of the shift using its Logout / Log Out control. Do not leave reports, payment pages or customer history open to waiting-room viewers.

Keep the TV paired as a display, not as a signed-in merchant workstation. If a TV is sold or moved, unlink it deliberately. Public customer details should be minimal. Selecting Name or Vehicle number for TV is an intentional disclosure; a clinic should consider whether token-only status is more appropriate.

Collect customer information responsibly

Tell customers which business is collecting the information and why. Request only needed fields; do not add identity documents, unnecessary medical information or financial secrets to a queue form. Required/optional is a product control, not proof that a collection purpose is lawful.

The public QR notice describes the business, token/queue purpose, collected details, any location requirement, language choice and assistance/data-rights links. The adult self-service declaration is for an adult taking their own token. For a child or someone the visitor represents, use reception and an appropriate assisted process. A checkbox is not verified parental consent or identity verification.

Keep WhatsApp limited to the visit-update purpose described to the customer. Do not treat supplying a mobile number for a token as authorization for unrelated marketing. Follow the available withdrawal/update preferences and the published policy. An update preference does not remove statutory records or cancel the visit.

Data access and retention

Use Privacy Policy and Your Data Rights for current information. Ask the visited business or InCue for help locating, correcting or requesting deletion of records. Provide just enough identifying context privately, such as business and visit date; support may need to verify the requester before disclosing data.

The published policy describes configurable retention, with queue customer data normally erased after 365 days unless a different supported period applies. It does not guarantee that every copy disappears on that exact day. Payment, security and legally required records can remain longer. This guide does not replace the current policy or legal advice. Merchant activity logs, TV cache and billing records have different purposes; no universal “delete everything now” customer button was verified.

Shared-device checklist

• Use the right staff login and screen lock. Do not save an owner's OTP in a shared note.
• Hide customer phone numbers/visit details from general waiting-room view.
• Keep browsers/apps updated and avoid unsupported extensions on payment devices.
• Share only the correct individual tracking link with its customer.
• Redact names, phone numbers, medical information, OTPs, API keys and bank details before sending troubleshooting screenshots.