Who we are
Rica (myrica.store) is a tool for small businesses: one page that is a shop, a booking calendar, an event, a subscription, and an inbox for the texts, WhatsApp messages, Instagram DMs and website chats that bring customers in. Too Punjabi For You, a business in Ontario, Canada, runs it and is responsible for the data it holds (the data controller). Questions: hello@myrica.store.
What we store, and why
- Shop owners. Your name, email, password (hashed), business details, the products and pages you create, your settings, and the numbers and accounts you connect. We need these to run your shop.
- Your customers. What a customer gives a shop to buy, book or ask: name, email, phone, delivery address, the order, booking or ticket, and the messages they send the shop. Each shop owner sees only their own customers. Rica does not sell, rent or share customer lists.
- Payments. Card details never touch Rica: Stripe takes the payment on the shop's own Stripe account. We keep the order and its Stripe references.
- Messages. Texts and WhatsApp messages go through Twilio and Meta; Instagram DMs through Meta. Rica stores the conversation so the shop can answer it, and the assistant may draft or send replies from the shop's own products, hours and notes when the shop turns that on.
- Page analytics. Rica counts visits and the path from a visit to a sale on the shop's own page: no cookies, no third-party trackers, nothing sold on.
Instagram and Facebook data
When a shop owner connects an Instagram professional account, Rica receives, through Meta's Instagram API, the account's id and username, the direct messages sent to that account, and the sender's name and username, and may send replies on the account's behalf. Rica uses this data only to show those conversations in the shop's inbox and to reply to them. It is not used for advertising, not combined across shops, and not shared with anyone but the shop that connected the account. Disconnecting the account in Rica, or removing Rica from the Instagram account, ends the access; Meta's data deletion request removes the stored messages too (see data deletion).
Google Calendar and Zoom data
A shop owner can connect a Google account or a Zoom account under Integrations, so each online booking gets its own video call. Rica asks Google only for permission to manage calendar events (calendar.events) and for the account's email address; it asks Zoom only to create, update and delete meetings and to read the connected user's name, email and id.
- What Rica does with it. For each confirmed online booking, Rica creates one event with a Google Meet link on the owner's primary Google Calendar (with the customer as a guest), or one Zoom meeting. When the booking moves, Rica changes that event's or meeting's time; when it is cancelled, Rica deletes it. Rica never reads, lists or changes any other event or meeting.
- What Rica stores. The connected account's email address (and, for Zoom, its user and account ids), the access and refresh tokens that let Rica act for it, and, on each booking, the event or meeting id and its join link. Tokens are never shown in the admin and never leave Rica's servers except to call Google or Zoom.
- Who sees it. Only the shop that connected the account, and the customer of each booking, who receives that booking's join link. It is not used for advertising, not used to train any model, not sold, and not shared with anyone else.
- Ending it. Disconnect under Integrations: Rica deletes the tokens and asks Google or Zoom to revoke its access. Removing Rica from your Google account's third-party connections or your Zoom account's Added Apps ends the access too: the stored token stops working, and Rica deletes a Zoom connection as soon as Zoom tells it. Events and meetings already made stay in your calendar and Zoom account, where you can delete them yourself.
Rica's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Who else sees data
Only the services that make the product work, each for its own part: Amazon Web Services (hosting, in the United States), MongoDB Atlas (the database), Stripe (payments), Twilio (texts, calls, WhatsApp), Meta (WhatsApp, Instagram, Messenger), Resend (email), Cloudinary (images), Google and Zoom (the video calls of online bookings, for shops that connect them), Anthropic (the assistant's model; it sees the conversation it is drafting a reply for, and nothing is used to train models).
Requests from public authorities
We give a user's data to the police, a court or any other public authority only when a legally binding request makes us. We review every request for legality, challenge any we believe is unlawful or too broad, disclose only the minimum the request requires, and keep a record of each request, our response and the reasons for it.
How long
For as long as the shop is open. A closed shop's data is deleted within 30 days, except the records a tax law makes us keep. A customer can ask any shop to delete their data, and a shop owner can delete a customer from their admin.
Your rights
See, correct, export or delete what we hold about you: write to hello@myrica.store. We answer within 30 days. If you are in the EU, UK or Canada, the law gives you these rights by name; we honour them everywhere.
Changes
If this page changes in a way that matters, shop owners get an email first.