Thanks Boss

Privacy policy

Last updated 21 August 2026

This policy explains how AnalystAI, Inc. ("we", "us") collects and uses information when you use Thanks Boss at thanksboss.fr, app.thanksboss.fr and avisium.vercel.app.

AnalystAI, Inc. is a Delaware C-Corporation, formed 16 February 2024, file number 3118936 with the Delaware Secretary of State. Registered office: 131 Continental Drive, Suite 305, Newark, DE 19713, United States. Publication director: Ata Onat, founder and president.

Contact: login@thanksboss.fr or hello@analystai.ai.

Who this is for

Thanks Boss is a product for restaurants and similar venues. The restaurant owner (or the person they invite) is our customer. Guests who scan a QR badge are not asked to create an account with us.

Who controls the data

We are the controller of owner accounts, sign-in, billing, and the technical logs we need to run the service. For staff names, guest ratings, and private comments a venue collects through the product, the venue is the controller and we are the processor. The owner must have a lawful basis to give us staff names and to show guest comments to their team. A staff member who asks to be left out must be removed from the roster.

What we collect

  • Account. Email address, and a sign-in code we send to that address. We do not use passwords. A session cookie keeps you signed in after the code is used.
  • Restaurant profile. Venue name, address, staff names and aliases, reward settings, and onboarding answers the owner types.
  • Google Business Profile (only if the owner connects it). A refresh token for the Google account that manages the listing, and the reviews that account is allowed to read. Scope requested: https://www.googleapis.com/auth/business.manage. We use this to read reviews the owner has authorised, so we can credit staff who are named in them. We do not use it to post, reply, or change the listing unless the owner later asks us to and we update this policy.
  • Reviews we already hold for outreach. Public Google review text we collected for Paris restaurants that have not signed up, used only to show the owner an analysis if they look themselves up or if we send them a private link.
  • Guest QR flow. Star rating, optional comment, optional contact, and which staff badge was scanned. Some of that is sent to Google by the guest themselves when they write a public review.
  • Payments. Stripe handles card details. We store subscription status, plan, and Stripe customer or subscription ids. We do not store full card numbers.
  • Technical. IP address used to rate-limit public lookups, user agent on some guest submissions, and standard server logs.

Why we use it, and on what basis

To operate the product: sign the owner in, attribute reviews to staff, show the dashboard, bill the subscription, and send transactional email (sign-in codes). We do not sell personal data. We do not use Google user data for advertising.

  • Contract (GDPR article 6.1.b). Running the account, the diner flow, staff attribution, and the subscription the owner asked for.
  • Legitimate interest (article 6.1.f). Rate-limiting public lookups and keeping server logs so the service stays usable.
  • Legal obligation (article 6.1.c). Invoices and records we must keep for tax.

GDPR applies to people in the Union under article 3.2, because we offer the product to restaurants in France.

Google user data

Google user data obtained through OAuth is used only to provide Thanks Bossfeatures the owner asked for. We store the refresh token encrypted. The owner can disconnect in the product or by revoking access in their Google account. After revocation we stop calling Google for that venue and mark the connection dead.

We do not transfer Google user data to other advertising or data-broker services. Stripe and our email provider (Resend) receive only what they need to charge a card or deliver a sign-in code, not the Google token.

How long we keep it

Owner account and venue data last while the account exists, then three years after the last contact. Sign-in codes expire in ten minutes. Google tokens last until the owner disconnects or Google revokes them. Private analysis links expire after 90 days. Onboarding requests that go nowhere are deleted after twelve months. We delete or anonymise data when the owner asks, except records we must keep for tax or fraud (for example Stripe invoices).

Who we share with

  • Google, when the owner connects their Business Profile.
  • Stripe, for checkout and subscription billing.
  • Resend, to send sign-in codes from login@thanksboss.fr.
  • Vercel, which hosts the app, and Railway, which hosts the database.

We share data if required by law.

Transfers outside the EU

AnalystAI, Inc. is in the United States. Vercel, Railway, Stripe and GitHub also store or process data there. Those transfers use the European Commission standard contractual clauses and, where the provider has certified, the EU-US Data Privacy Framework. Resend delivers email from Ireland.

Data requests

AnalystAI, Inc. is established in the United States. The GDPR still covers the data of people in the EU, under article 3.2. Send any request about personal data straight to us at contact@anastudio.co or login@thanksboss.fr, and we answer within the deadlines the GDPR sets.

Your rights

If you are in the EEA or UK you can ask for a copy of your data, a correction, or deletion, and you can object to or restrict some processing. Email login@thanksboss.fr. We answer within one month. You can also complain to your local data protection authority (in France, the CNIL).

Cookies

We set one first-party session cookie after a successful sign-in, so the owner stays signed in. We do not set advertising cookies and we do not use third-party audience trackers. The diner flow does not require a cookie.

Children

Thanks Boss is for businesses, not for children under 16.

French legal notice

The landing site also publishes a French notice at thanksboss.fr/mentions.