The system a business runs on

Tap your card on the tablet by the door, type a PIN, and your own desk opens — carrying only what the owner turned on that your role actually reaches. Two people on the same tablet get two different workspaces, and there is nothing to train.

That intersection is enforced in the database rather than in the screen: a module your role does not carry returns no rows even to a request that goes around the interface. The owner is the single exception and sees every module that is on.

A number of your own answers the phone in the caller’s language and books on your calendar; guest mail arrives already read, sorted and drafted in your words. Both work off your live rows, not off a script written in advance.

It acts only behind a card naming the exact change, which a person presses — which also means it cannot work while nobody is looking. It has no screen of its own: it opens as a drawer over whatever you are doing, and AI credits are the only thing anyone pays for.

A client, an order, a payment, a shipment is one row read from several angles. The register writes the rows the day’s numbers count and the books post from, so there is nothing to reconcile between four apps at closing time.

What happened is written once and never rewritten: stock moves, payment events and every action the AI took are append-only rows carrying who did it and when. A correction is a new row, so the trail never loses the original.

A full export of the business as one file, any time — from a locked, unpaid screen too, because the day you most want your client book is the day you stopped paying. Closing the account and erasing it for good are both self-serve.

Erasure waits thirty days, then purges table by table. Day to day the same data reads through your own revocable keys, or arrives at your systems as a signed webhook — eight topics, retried for about fourteen hours, every attempt recorded.

An order opened, a line added to it, the work marked done, the cash taken for it — all of that goes on while the network is down. The writes wait on the device and replay in order once it returns, each landing on the business day it really happened.

Every queued write carries an id made on the device, so a replay that arrives twice is applied once. What is deliberately not queued says so on the screen: a card sale, a PIN-gated void and every settings change need the network.

Booking, paying and checking what they booked all happen on one link under your own name and colour. Nobody creates a password, because there is no account to put one on.

The guest’s page never talks to your database — a server checks their one-time link first, and nothing they do there can reach anything of yours.