// privacy
Posoda makes point-of-sale and management software for hospitality businesses — cafés, restaurants, bars, and food trucks. This policy explains what personal information we collect, why, who we share it with, where it is processed, and the rights you have over it.
// two very different roles
Most of what this policy has to explain follows from one distinction, so it comes first.
A business that subscribes to Posoda, or someone who works for one — we decide how your information is handled. We are the controller of that information and this policy governs it directly.
This policy is the whole answer.
You booked a table, joined a loyalty program, ordered online, or simply bought something — the business you dealt with decides what is collected and what it is used for. We only hold and process that information on their instructions, as their processor. That business is your first point of contact for access, correction, or deletion, and their own privacy policy governs how they use it. We will still help you reach them, and we act on their instructions promptly.
Ask the venue first — we’ll help you reach them.
Where this policy says “the business” or “the venue”, it means the merchant operating the till you bought from — not Posoda.
“We”, “our”, and “us” mean Posoda Limited and its wholly owned subsidiaries. You can reach us about anything in this policy at support@posoda.com. If you would prefer to write, ask us for the postal address of the entity that holds your information and we will provide it.
Account and billing. The name, email address, phone number, and country of the person who signs up; the trading name, address, and settings of each venue; and the subscription and invoice records tied to them. Card details for your subscription are entered directly into Stripe and are never stored on our systems.
Staff records. Names, email addresses, the numeric PIN used to unlock a till, role and permission assignments, and — for venues using the roster, timesheet, and payroll-export features — pay rates, availability, shifts scheduled, and clock-in and clock-out times. These records are created and managed by the business that employs you. If you work at a venue that uses Posoda and want to see or correct what is held about you, ask your employer first; we will act on their instruction.
Devices. When an iPad is paired to a venue we record a device name and type, a device key, a hashed user-agent string, and the time of the last heartbeat, so that a lost or stolen till can be identified and revoked.
Support. Anything you send us when you contact support, including diagnostic reports you choose to submit from the app.
We hold the following on behalf of the business you dealt with. What is collected depends on which features that business has switched on.
First and last name, email address and mobile number, an optional date of birth, points balance and full earning and redemption history, the version of the loyalty terms you accepted, the IP address you accepted them from, and whether you separately opted in to marketing and when. Agreeing to marketing is never a condition of joining.
Name, email address, phone number, party size, the time and table booked, and any note you or the venue added to the reservation.
The contents of your cart, the contact details you enter at checkout, a delivery address if you choose delivery, and the order’s status history.
What was ordered, the amounts, the payment method, any tip or refund, and the time and till involved. Where a sale is linked to a loyalty account or an online order, it is linked to you.
Loyalty enrolment is confirmed by a one-time code sent to the email address or mobile number you give, so an account cannot be created against contact details that are not yours. You must be at least 16 to join a loyalty program.
We never see or store card numbers.
In-person card payments run on an external EFTPOS terminal supplied by the venue’s payment provider; the card never touches the Posoda app, and the app receives only an approval result and a printable receipt. Online payments are handled by Stripe on Stripe’s own hosted infrastructure. We keep the amount, the outcome, and a payment reference so that receipts, refunds, and reports work.
Diagnostics. When the app or the dashboard hits an error we send a crash report to Sentry so we can fix it. Reports identify the user only by an opaque internal id, and names, email addresses, phone numbers, tokens, and similar values are stripped from error payloads and breadcrumbs before they leave the device.
Websites. On posoda.com and the dashboard we collect standard server and analytics data — IP address, browser and device type, pages viewed, and referring links — to keep the sites working and understand which pages are useful.
The POS app does not collect your location, does not use advertising identifiers, and does not track you across other companies’ apps or websites.
On Android it requests location permission only where the operating system requires it to scan for Bluetooth printers, and the scan is flagged as not being used to derive location. The camera permission is used solely to scan QR codes and barcodes; images are processed on the device and never uploaded.
Depending on where you live, our legal basis is performance of a contract with you, our legitimate interests in operating and securing the service where those interests do not override your rights, compliance with a legal obligation, or your consent — which you can withdraw at any time.
We do not sell personal information, and we do not use guest data from one business to market to them on behalf of another.
Our API runs in Sydney, Australia. Some of the providers listed above process data outside your country — Sentry in particular processes diagnostic data in the United States, and Stripe, Resend, Twilio, and Anthropic operate internationally. Where we transfer personal information across a border we rely on contractual protections with each provider requiring them to handle it consistently with this policy and applicable law. Ask us at support@posoda.com if you want the detail for a specific provider.
Business account and transaction records are kept for as long as the business subscribes and afterwards for as long as we need them for tax, accounting, or legal reasons — usually seven years for financial records. Loyalty and booking records are kept while the account is active and the business continues to use the feature. Crash reports are kept for a short retention window and then deleted. When a business closes its account we delete or anonymise its data once the retention periods above have run.
Data is encrypted in transit. Access to production systems is restricted to the people who need it. Tills authenticate with device-bound tokens that we can revoke immediately if a device is lost, and the app is configured to keep its offline database out of automatic device backups so that a lost or stolen till does not leak its local copy. No system is perfectly secure; if a breach affects you and the law requires it, we will notify you and the relevant regulator.
Subject to local law, you can ask us to:
Tell you what we hold about you and why.
Correct anything inaccurate or out of date.
Delete your information, where we are not required to keep it.
Give you a copy in a portable format, or send it to someone else.
Restrict or stop a particular use, including objecting to processing based on our legitimate interests.
To make a request, email support@posoda.com. If your request concerns a loyalty account, a booking, or an order at a particular venue, the fastest route is to ask that venue directly — the data is theirs, and we act on their instruction. You can also ask any member of their staff, or email us and we will pass the request on.
Marketing. You can opt out at any time using the unsubscribe link in any message, by asking staff at the venue, or by emailing us. Withdrawing marketing consent never affects your loyalty account, your points, or your ability to redeem a reward.
Posoda is not directed at children. Loyalty enrolment requires you to be at least 16, and the enrolment form rejects a date of birth under that age. If you believe we hold information about a child, contact us and we will delete it.
If you are unhappy with how we have handled your information, tell us at support@posoda.com and we will investigate and respond. You can also complain to the data protection authority where you live — in New Zealand the Office of the Privacy Commissioner, in Australia the Office of the Australian Information Commissioner, and in the EU or UK your national supervisory authority.
Email support@posoda.com from the account holder’s address to see a copy of your data, correct it, or close the account and have it deleted.
Loyalty memberships, bookings and order history belong to the venue you dealt with. Ask them first, or write to us and we will pass the request on.