What we do with your data, in plain language.

No certificates to wave. Here is what the product actually does today, and what it does not.

Signing in and accounts

Who gets in, and how.

Passwords are stored only as salted hashes that cannot be reversed (bcrypt). We cannot read them.
Your session is a signed cookie that the browser’s scripts cannot read.
Every request from a person who is signed in is checked against the database. A staff account you deactivate is locked out at once, even if their phone is still signed in.
Staff get exactly the permissions you give them: stock, approving swaps, the rewards code, the till, job roles.
Public forms and sign in pages limit repeated attempts. After a few wrong passwords, the wait grows each time.

Your data belongs to your venue.

Every query for stock, schedules, receipts and reviews is scoped to your venue. A venue never sees another venue’s guests.
The database is locked so that only our application can reach it. It is not open to the public API of the database host.
A guest’s rewards account is theirs. Each venue sees only the guests who hold its card, and never sees them again once they delete their account.

What we store, and what we check.

An uploaded PDF menu is checked before it is used. A PDF with scripts, attachments, launch actions or forms is refused.
Everything you type into a web menu is escaped before it is shown, and an uploaded HTML menu page is served in a sandbox that cannot read our cookies or call our API.
Uploaded images are checked by their first bytes, never by their file names.
Receipt and stock photos are kept in private storage, and only our server can read them.
A till receipt keeps what was sold and never the customer’s phone number or email. Its customer link works for 30 days, and the receipt is deleted 90 days after the sale.
When a guest deletes their rewards account, what we keep is erased automatically after 90 days.

What a guest is asked for, and what they are not.

A guest needs no account and no app to leave a rating. We store the rating, the time and the place it was left.
Location is read only at the moment a guest adds a purchase or redeems a reward, or a staff member clocks in. It is never tracked in the background.
Every guest is invited to Google the same way, at every rating. An automated test checks this on every change.
We never sell guests’ data or use it for advertising.

The page you are on.

This website loads no scripts from other companies, has no analytics and sets no cookies, so there is no cookie banner.
Connections are encrypted (HTTPS), and browsers are told to keep using HTTPS for two years.
The camera and your location are switched off on this site. Only the pages that need them can ask.
If you ask us for a demo, what you type is saved, emailed to us and read only by our staff. The site never emails you by itself.

We hold no security certificate or audit, and we will not say otherwise.
No system is perfectly secure. If a problem affects your data, the privacy policy says we will tell you.
Your own dashboard and the staff app are in English today.

Write to us and we will answer in plain words. The full privacy policy and terms are linked below.

Tell us what you run, and we will get back to you.