LineQ App Icon
LineQ
Privacy & Compliance

Privacy Policy

Last updated: October 24, 2026 • Product: LineQ • Entity: StewardAxis LLC DBA LineQ

1. Overview & Data Minimization Commitment

StewardAxis LLC, doing business as LineQ ("LineQ", "StewardAxis", "we", "our", or "us"), operates LineQ, a zero-hardware virtual queue management platform. This Privacy Policy details our technical principles and operational practices regarding data collection, processing, and safeguarding when you interact with our marketing sites, customer ticketing interfaces, teller consoles, and administrative dashboards.

We operate under strict data minimization principles:

  • No mandatory customer accounts: Walk-in visitors can pull digital tickets and view live queue updates without registering, creating a password, or downloading an app.
  • Zero unnecessary telemetry: We do not track visitors across third-party websites or sell user behavioral data to advertising brokers.

2. Information We Collect

A. Walk-In Customer Queue Information

When a visitor generates a ticket at a branch entrance QR code, we store:

  • An ephemeral ticket identifier (e.g., A-042) and associated service category.
  • Timestamp of ticket issuance, call times, and service completion.
  • Optional customer phone number: Provided solely if the customer opts in to receive automated SMS notifications when their ticket is called.
  • Optional branch/department custom intake fields: Responses (such as account numbers or doctor names) required by the specific branch facility.

B. Tenant & Staff Account Data

For business administrators, branch managers, and counter tellers, we collect business email addresses, authenticated user names, assigned branch/counter associations, and authorization tokens processed via Better Auth.

C. System Telemetry & Display Sessions

Public Smart TV boards connect via read-only display tokens without transmitting user credentials. System operational metrics, API latency, and WebSocket connection heartbeat health are captured via automated telemetry to maintain high uptime.

3. Automated 48-Hour PII Anonymization Policy

To protect physical facility visitors, LineQ implements an automated retention purge rule:

Automated 48-Hour Purge: Any customer personal identifying information (PII)—including mobile phone numbers provided for SMS alerts and intake field responses—is automatically masked or permanently purged from operational database records within 48 hours of queue ticket completion or cancellation.

4. Mobile Information & SMS Privacy Policy

We strictly uphold telecommunications and carrier compliance standards for all transactional SMS communications. When you opt in to receive queue alerts:

Mandatory Carrier Non-Disclosure Commitment: No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Mobile phone numbers collected during queue intake are utilized exclusively to transmit automated transactional status alerts (such as ticket confirmations, counter announcements, and recall notices). These numbers are never used for marketing, automated sales pitches, or shared with third-party data aggregators. Furthermore, in accordance with our 48-Hour Purge policy, mobile phone numbers are permanently anonymized or deleted within 48 hours of service completion.

5. Data Security & Multi-Tenant Isolation

LineQ incorporates robust enterprise-grade security safeguards:

  • Multi-Tenant Data Segregation: All database queries strictly enforce logical tenant_id isolation constraints to prevent cross-tenant data leaks.
  • Encryption in Transit: All web traffic, REST APIs, and WebSocket channels strictly enforce TLS 1.3 transport encryption.
  • Encryption at Rest: All PostgreSQL database records and automated backups are encrypted using AES-256 standards.
  • HMAC Webhook Signatures: Outbound developer webhooks are cryptographically signed using SHA-256 HMAC headers (X-LineQ-Signature) to verify message authenticity.

6. Infrastructure Subprocessors

We do not sell, rent, or trade your personal information. We partner exclusively with vetted cloud infrastructure providers:

  • Neon: Serverless PostgreSQL database hosting with pooled connection partitioning.
  • Google Cloud Platform (GCP): Containerized API microservices hosted on Cloud Run.
  • Upstash: Serverless Redis Pub/Sub broker for real-time WebSocket ticket synchronization.
  • Twilio: Cloud telecommunications infrastructure for transactional SMS queue status alerts.
  • Resend: Transactional email delivery for passwordless OTP and staff invitations.
  • Dodo Payments: Merchant of Record (MoR) for subscription billing, invoices, and payment card handling.

7. Your Rights & Contact

Depending on your jurisdiction (including GDPR, CCPA, and applicable state privacy frameworks), you have the right to request access to, correction of, or permanent deletion of your account and facility data.

For any privacy inquiries or data compliance requests, contact:
Paul Abib Camano — StewardAxis LLC
Email: [email protected]