App Provider: Nomos Apex AI LLC, a limited liability company formed in New York
Product: Dynamic.ly
Publication Candidate URL: www.dynamicly.app/legal/clover-privacy-policy
Effective Date: The date the approved version of this Privacy Policy is first publicly published at the Publication Candidate URL.
Dynamic.ly is a restaurant-intelligence software product operated by Nomos Apex AI LLC.
1. Scope and App Provider
This Dynamic.ly Clover Privacy Policy (“Privacy Policy”) explains how Nomos Apex AI LLC (“App Provider,” “we,” “us,” or “our”) collects, uses, discloses, retains, and otherwise processes information in connection with the current Dynamic.ly integration authorized by a Clover merchant (“Merchant”).
This Privacy Policy applies to the Clover-authorized Merchant integration and related Dynamic.ly account, mapping, security, support, and audit activity. It does not replace a separate general website privacy policy or another product-specific policy unless an approved published version expressly says so.
This document is a non-final internal draft. It will not become effective until an approved version is publicly published.
2. Data Received from Clover
Subject to the permissions approved by the Merchant and the actual Clover data available for the Merchant, Dynamic.ly may receive and process selected fields from these categories:
- Merchant identifiers and business context;
- authorized Clover locations and location metadata;
- inventory and menu items;
- categories and subcategories where available;
- item groups, variants, attributes, and options;
- modifier groups and modifiers;
- item-stock, availability, and related inventory evidence;
- orders and order status;
- order line items and quantities;
- line modifications and applied modifiers;
- discounts and service charges;
- order type and other selected operational order attributes;
- provider object identifiers, timestamps, versions, freshness, and coverage metadata; and
- app-installation, authentication, synchronization, and field-filtered webhook receipt metadata.
Dynamic.ly treats Clover information as provider source evidence. Provider identifiers do not by themselves create Dynamic.ly authority or confirmed Restaurant truth.
3. Data Intentionally Not Requested or Persisted
The current Dynamic.ly Clover integration is not designed to request or persist these categories as product data:
- payments, payment instruments, tender details, card data, or Online Payments data;
- Clover customer profiles, buyer names, buyer email addresses, buyer phone numbers, or other buyer contact data;
- Clover employee personal data;
- unnecessary device identifiers;
- unrestricted free-form notes; or
- unbounded full raw Clover API payloads.
A provider response could unexpectedly contain a field that Dynamic.ly did not request or intend to retain. Dynamic.ly uses allowlisting and field filtering and does not intentionally persist excluded fields. Unexpected fields may exist transiently during bounded processing and are discarded unless a technically required, approved, field-filtered fragment is retained under an applicable retention rule.
4. Dynamic.ly Account and Operational Data
Dynamic.ly may also process information created through or needed to operate the Service, including:
- authorized Dynamic.ly user, session, membership, role, and permission data;
- Restaurant and Location records;
- reviewed Clover-to-Dynamic.ly mappings;
- manager confirmations, corrections, and Manager Decisions;
- Action Card, deterministic analysis, and explanation metadata;
- source freshness, coverage, health, and reconciliation state;
- authentication, synchronization, security, audit, and support records;
- request, trace, and idempotency identifiers; and
- credential status and key-version metadata that do not expose the credentials themselves.
5. How We Use Information
We use information to:
- connect and authenticate the Merchant’s authorized Clover account;
- identify the authorized Merchant and selected locations;
- retrieve and normalize permitted Clover source evidence;
- produce provider-neutral Signals and deterministic analyses;
- display source freshness, coverage, and integration health;
- prepare manager-reviewed insights and Action Cards;
- record Manager Decisions, mapping decisions, and audit lineage;
- prevent duplicates, reconcile changes, and maintain idempotency;
- secure, monitor, debug, maintain, and support the integration;
- investigate incidents, misuse, and unauthorized access;
- comply with applicable instructions, contracts, and legal obligations; and
- enforce the applicable Dynamic.ly terms and protect the Service.
We do not use Clover data for global model training or cross-tenant learning.
6. Canonical Truth and Manager Authority
Clover information is source evidence, not automatic Dynamic.ly business truth. Clover provider identifiers do not grant Dynamic.ly tenant or Location authority.
Manager review is required to confirm semantic Restaurant mappings and other business-specific facts. Dynamic.ly does not automatically turn Clover item-stock or availability information into confirmed Ingredient inventory, an InventoryLot, expiry truth, or a manager-approved reconciliation.
An Action Card or Manager Decision does not itself change Clover or another external system.
7. AI and Model Use
The currently certified Clover connector processing path is model-off. The current connector uses provider adapters, allowlisted normalization, deterministic rules, and manager-reviewed mappings.
Clover data is not used for global model training or cross-tenant learning. A future material use of models with Clover data requires an updated product authorization and updated disclosure before activation.
Dynamic.ly may use AI-assisted features in other separately disclosed product contexts. AI suggestions do not mark data confirmed, grant authority, approve mappings, or execute external actions.
8. Sharing and Subprocessors
We may disclose information only as reasonably necessary to:
- Clover or Fiserv in connection with the Merchant-authorized platform relationship;
- service providers that support hosting, database, security, logging, communications, email, support, content delivery, or other infrastructure functions;
- professional advisers subject to appropriate duties;
- governmental or legal authorities when required or permitted by law;
- investigate or prevent security, fraud, abuse, or legal violations; or
- complete a merger, financing, acquisition, reorganization, sale of assets, or similar transaction subject to appropriate safeguards.
We do not sell customer personal data. We do not disclose one Merchant’s Clover data to another Merchant to create cross-tenant business truth.
A maintained subprocessor disclosure is intended to be available at www.dynamicly.app/subprocessors. Before public publication or live Merchant use, that page must identify each source-supported production provider, its purpose, the applicable data category, and processing region where known.
9. International Processing
The App Provider is a New York limited liability company. Service providers and third-party platforms may process information in the United States or other locations where they operate, subject to the applicable agreement and safeguards.
We will not represent that a particular international-transfer mechanism, privacy-law role, or processing region applies unless it is supported by the actual production configuration and applicable legal review.
10. Security
Current technical safeguards are designed to include:
- encrypted transport;
- backend-only encrypted Clover credentials;
- least-privilege permissions;
- tenant, Restaurant, and Location authorization controls;
- field filtering and bounded persistence;
- source and version tracking;
- authentication, synchronization, and security logging with redaction;
- idempotency, replay protection, and audit records; and
- credential destruction or unusable-state handling on disconnect.
No security program can eliminate all risk. We do not guarantee that information will never be accessed, used, disclosed, altered, or destroyed without authorization.
We do not claim SOC 2, ISO 27001, PCI DSS, HIPAA, or another certification unless and until an applicable certification is independently established and publicly disclosed.
11. Retention
The current founder-approved retention policy is:
| Data class | Retention | Trigger | Exceptions and notes |
|---|---|---|---|
| Clover OAuth credentials | Destroyed or made unusable promptly | Dynamic.ly disconnect, Clover revocation, or terminal credential invalidation | Minimum security/audit metadata may remain; token values do not remain available for use |
| Full raw Clover API payloads | Not retained by default | Bounded receipt and processing | A technically required fragment may be retained only when field-filtered, bounded, encrypted, and covered by an approved rule |
| Normalized Clover Evidence and provider-neutral Signals | 30 days | Dynamic.ly disconnect or offboarding | After 30 days, delete or irreversibly de-identify unless a written Merchant agreement, legal obligation, dispute hold, or Merchant instruction authorizes longer retention |
| Filtered webhook receipt metadata | 30 days | Receipt time | Longer only for an active incident, dispute hold, or written Merchant agreement; no Clover Auth Code or unnecessary raw fields |
| Redacted security, authentication, synchronization, and support logs | 90 days | Event time | Longer only for an active investigation, legal hold, or written contractual requirement; no secrets, customer identity, payment/tender data, or employee personal data |
| Merchant mapping, decision, disconnect, and minimum audit records | Minimum period reasonably required for the applicable contractual, legal, security, deletion-proof, or dispute-defense purpose | Applicable event, disconnect, or deletion | Not used to continue ordinary Clover collection after disconnect |
| Legal or dispute-hold information | Duration of the applicable hold or obligation | Hold or legal obligation | Deleted or de-identified when the hold or obligation is released and no other approved basis remains |
The 30-day and 90-day policies are founder-approved legal policies. Public publication must not claim that every automatic purge, backup deletion, or retention-enforcement mechanism is implemented unless the H5 source/operational audit proves that enforcement or documents an approved manual process.
12. Disconnect, Uninstall, Offboarding, and Deletion
When the Merchant disconnects Dynamic.ly from Clover:
- new Clover collection stops promptly after the disconnect is processed;
- access and refresh credentials are destroyed or made unusable;
- provider jobs requiring authorization stop;
- retained information is handled under the retention table above; and
- the Merchant’s Dynamic.ly account, reviewed business mappings, or audit history are not automatically deleted unless the applicable deletion or offboarding process requires it.
Clover uninstall, Dynamic.ly disconnect, Dynamic.ly account closure, pilot offboarding, and legal deletion are different actions. An authorized request may be required to close the Dynamic.ly account or delete eligible data.
13. Merchant Choices and Rights
An authorized Merchant administrator may:
- disconnect or revoke Clover access;
- request access to or correction of eligible Dynamic.ly account information;
- request an export where available and appropriate;
- request deletion or de-identification of eligible information; and
- ask questions about the current Clover data practices.
We may verify the requester’s identity, authority, and relationship to the Merchant before acting. Privacy rights vary by jurisdiction and apply only where legally applicable. This Policy does not promise a universal right or a particular privacy-law classification.
Requests may be sent to privacy@dynamicly.app after that mailbox is created and verified.
14. Children
Dynamic.ly is a business service intended for authorized restaurants and business users. It is not directed to children.
15. Changes and Effective Date
The effective date will be the date the approved version is first publicly published at www.dynamicly.app/legal/clover-privacy-policy.
We may update this Policy to reflect changes in the Service, Clover, infrastructure, law, or our practices. Material changes will be identified using a reasonable notice method appropriate to the Merchant relationship, and the updated Policy will state its effective date.
16. Contact
App Provider: Nomos Apex AI LLC
Product: Dynamic.ly
Public legal notice address: 10 Ridgecrest N, Scarsdale, NY 10583, United States
Privacy email: privacy@dynamicly.app — pending creation and verification before publication
Support email: support@dynamicly.app — pending creation and verification before publication
Support website: www.dynamicly.app/support
Canonical legal host: www.dynamicly.app
Founder decision status: Founder-approved as an internal drafting basis.
Counsel-review status: NOT_REVIEWED.
Publication status: Not approved or effective until the exact publication candidate is reviewed, previewed, approved, and publicly deployed under the gated H5 process.