ValYou

Physical businesses — restaurants, cafés, retail, salons, clinics — depend on Google reviews for discovery. In practice, staff forget to ask, customers forget to follow through, and the interaction leaves no trace.

Owners also lack a basic view of engagement: which branch, which counter, which card is actually generating interactions. The tools that exist are built for marketers who spend their day in dashboards, not for a café owner with ten minutes a week.

Each business receives NFC/QR cards for its locations. A tap or scan opens a branded page in English or Arabic that leads to the Google review flow and lets the customer optionally share their name and phone number — with clear, privacy-focused messaging and no mandatory promotional sign-up.

Every interaction is recorded with its card, location and source. Owners see engagement per location and card in a dashboard, and receive a weekly email summarising what happened. Plans scale by the number of locations and cards a business can run.

The frontend is a Next.js App Router application serving three audiences: public customer pages, the business-owner dashboard and the super-admin console. It talks to a single Express + TypeScript REST API.

Inside the API, routes stay thin: validation and authorization happen at the edge, business rules live in services, and Prisma handles persistence to PostgreSQL. Anything slow, scheduled or dependent on a third party — weekly reports, transactional email, Google data sync — is pushed to BullMQ queues on Redis and processed by separate worker processes.

The most important early decision was getting the ownership graph right. A Business owns its Locations; Cards belong to a Location and carry a stable public code; every tap or scan is an immutable Event that references the card, the location and the source. The Subscription attaches to the Business, not to a location or a user.

Users relate to businesses through a role, so an owner, a staff member and a platform super-admin all resolve permissions through the same path — and every query is scoped by business.

Concurrency is the hard part of refresh tokens. When a dashboard fires several requests with an expired access token, naive clients send several refresh calls, and with rotation enabled all but one fail — logging the user out.

The client wraps the fetch layer so the first 401 starts a refresh and every other request waits on that same promise, then retries with the new token.

The API enqueues; workers execute. Weekly reports, transactional emails and integration sync are BullMQ jobs on Redis, with retries and backoff for transient failures. Workers run as separate PM2 processes, so a slow SMTP response or third-party API never blocks a customer's tap.

ValYou runs on an Ubuntu VPS. Nginx terminates TLS and reverse-proxies to the Next.js app and the API; PM2 supervises the web, API and worker processes. Configuration is environment-based, and email is delivered through Brevo SMTP on the product domain.

ValYou is live at valyou-lb.site with three tiers — Starter, Pro and Premium — that scale by locations and cards, and a provisioning flow for onboarding new businesses.

The architecture leaves room to grow: new plans are configuration, new reports are jobs, and new entry points are just another event source.