Privacy Policy

Last updated: October 12, 2026

Reaksa ("we", "us") is a business app from Tomnerb, based in Phnom Penh, Cambodia. It helps sellers keep track of orders, stock, payments and accounts. This policy explains what data Reaksa handles, why, and what choices you have.

1. Who is responsible for what

  • Your account data (your name, email, password, plan and billing) — we are responsible for this.
  • Your business data (your products, orders, customers, cash records and accounts) — you are the owner of this data and decide what goes in. We process it on your behalf to run Reaksa for you. If your business collects personal data from your own customers, you are responsible for doing so lawfully and for telling them.

2. What we collect

A. Information you give us

  • Account: name, email address and a password. We store only a scrambled (hashed) version of your password, never the password itself. If you sign in another way (see below) there may be no password at all.
  • Signing in with Google, Facebook or Telegram: if you choose one of these, we receive only what it gives us: your name, your email address (if you share it), and the account's ID with that service. From Telegram we receive your Telegram ID and name when you send our bot the sign-in code. We do not read your Facebook friends or posts, we do not post for you, and we do not get your Google or Facebook password. We use this only to sign you in and to link that account to yours. If you share no email, your account has a placeholder address until you add one.
  • Business records: products, prices, stock, photos and logo, orders, cash entries, supplier and customer details, accounting entries, and the team members you invite. For restaurants this also includes the menu, recipes, tables, bills (including service charge, VAT and tips) and kitchen tickets, and the daily cash count.
  • Your customers' details: names, phone numbers, delivery addresses and notes that you enter, that appear in orders you capture, or that a buyer types when ordering from your shop.
  • Shop buyers: when someone orders from your Telegram shop we receive their Telegram ID and name (from Telegram), plus the phone number and address they enter. On the web shop buyers type their name, phone number and address; we also use their IP address to limit spam orders.

B. Chat screenshots and messages

  • When you send a screenshot or forward a chat to the Reaksa bot, it is read by an AI service to extract the order (items, prices, customer name, whether it was paid). We save the order details that were read, not the screenshot. We also keep a one-way fingerprint of the image so we can tell if you send the same screenshot twice.
  • Payment notices from the ABA bot that you add to a linked chat are read and recorded as cash entries.
  • The bot only sees chats you add it to, forward to it, or connect through Telegram Business. You can remove the bot at any time.

C. Collected automatically

  • Technical data: IP address, browser type and request times, kept in server logs to run and secure the service and to limit abuse.
  • Browser storage: the app stores your sign-in token and your language and theme choices in your browser so you stay signed in. We do not use advertising or tracking cookies.

3. How we use it

  • To run Reaksa: record orders, move stock, keep your books, show reports and export to Excel.
  • To send you service emails: a link to confirm your email address, team invitations, password reset links, and notices about your plan. We do not send marketing email without asking.
  • To process plan payments and confirm them.
  • To keep the service safe: rate limits, spotting abuse and fixing errors.

We do not sell your data or your customers' data, and we do not use it for advertising.

4. Who we share it with

We use a small number of providers to run Reaksa. They only receive what the feature needs:

  • Google (Gemini AI): receives the screenshot or chat text you send to be read, to return the order details.
  • Google, Facebook (Meta) and Telegram, for sign-in: only if you choose to sign in with them. They tell us who you are; we send them nothing about your business.
  • Tripo (3D models): receives a product photo only when you press "Generate 3D from photo". It is optional and off unless you use it.
  • Telegram: delivers messages between you, the bot and your shop buyers, under Telegram's own privacy policy.
  • Email provider: delivers our invitation and password-reset emails.
  • Cloudflare: delivers the website and app, and sits in front of our servers.
  • Banks and Bakong (KHQR): payments you make or receive go through the bank network; we receive payment confirmations, never card or bank passwords.
  • Your team: people you invite to your business can see the business data their role allows.
  • Authorities: if the law requires it, we may disclose information to Cambodian authorities.

Reaksa's database runs on servers operated by us. These providers may process data outside Cambodia.

5. How long we keep it

  • We keep your account and business data while your account is open, because your books and stock records depend on it.
  • If you stop paying, your plan moves to Free and your data is kept.
  • The link between your account and a Google, Facebook or Telegram account is kept until you unlink it or delete your account.
  • When you ask us to delete your account, we delete your business data. Encrypted backups are kept for up to 14 days and then expire. We may keep limited records we are required to keep, for example payment records for tax.

6. Your choices

  • Access and correct: you can see and edit your account and business data in the app, and export your orders to Excel.
  • Delete: see "Delete your data" below.
  • Unlink a sign-in method: in Settings you can unlink Google, Facebook or Telegram at any time, as long as you keep another way to sign in.
  • Your customers: if one of your customers asks about their data, they should ask you; we will help you act on the request.
  • Emails: you cannot turn off essential service emails such as password resets.

7. Delete your data

You can have your account and its data deleted at any time, including an account you created with Facebook, Google or Telegram:

  1. Email contact@tomnerb.com from the email address on your account (or, for a Telegram or Facebook account with no email, send us the Telegram or Facebook name you used), with the subject "Delete my Reaksa data".
  2. We confirm it is you, then delete your account, your business data and the links to your sign-in accounts, normally within 30 days. Encrypted backups expire within 14 days after that.
  3. We may keep limited records we are legally required to keep, such as payment records for tax.

If you signed in with Facebook, you can also remove Reaksa under Facebook "Settings → Apps and websites". That stops Facebook sign-in but does not delete your Reaksa data: for that, email us as above.

8. Security

We protect your data with encrypted connections (HTTPS), hashed passwords, separation between businesses so that one business cannot see another's data, limits on repeated sign-in attempts, regular backups, and role-based access inside your team. No system is perfectly secure, so please use a strong password and only invite people you trust.

9. Children

Reaksa is for businesses. It is not intended for children under 16 and we do not knowingly collect their data.

10. Changes

We may update this policy. If the changes matter, we will tell you in the app or by email before they take effect.

11. Contact

Questions or requests: contact@tomnerb.com.