Privacy policy

Last updated 4 November 2026

NUTPOS is a point-of-sale service for cafés and restaurants, made up of the NUTPOS iPad app and the NUTPOS servers it connects to. It is operated by NUTPOS LIMITED ("we"). This policy explains what personal information the service holds, why, and for how long. We handle personal information in line with the Australian Privacy Principles.

Who is responsible

Each business that uses NUTPOS (a "store") decides what it records about its staff and customers. We hold and process that information for the store so the service can work. Questions about a store's own records can go to the store or to us.

What we hold

• Store accounts: business name, ABN and address as printed on receipts, and store settings.
• Staff: name, email address, role, a hashed password or PIN, and a record of actions taken in the app (for example who applied a discount or closed a shift).
• Devices: the name of each registered iPad, its app version and when it was last seen.
• Orders and payments: items, prices, tables, payment method and amounts. We do not receive card numbers: card payments are taken on the store's own EFTPOS terminal.
• Customers of a store: for pickup and phone orders, the name, phone number and email address the store enters, so the order can be prepared, labelled and, if the store turns it on, the customer can be sent a text message about it.

What we do not do

The app has no advertising, does not track you across other apps or websites, and does not use third-party analytics. We do not sell personal information.

Where it is stored

The service runs on servers in Sydney, Australia (DigitalOcean). Encrypted backups are kept with Cloudflare R2 in the Oceania region. Text messages, when enabled, are sent through a messaging provider that receives only the phone number and the message.

How long we keep it

• Customer names, phone numbers and email addresses on orders are removed 90 days after the order.
• Order, payment and shift records are kept while the store uses NUTPOS, because businesses must keep sales records for tax purposes.
• Backups are deleted after 35 days.
• When a store stops using NUTPOS, we delete its data on request, unless the law requires us to keep it.

Security

Connections use HTTPS. Passwords and PINs are stored only as hashes. Staff only see what their role allows. A lost iPad can be disabled from another device, which signs it out at once.

Your choices

You can ask to see or correct personal information we hold about you, or ask us to delete it, by emailing support@nutpos.com. If you are a customer of a store, you can also ask the store. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

If we change this policy, we will update this page and the date at the top.