Draft: not yet in effect. Details marked like {{THIS}} are still to be filled in.
VoraTill Privacy Policy
Draft. Effective {{EFFECTIVE_DATE}}.
This policy explains how {{COMPANY_NAME}} ("VoraTill", "we") handles personal data. It covers two different situations:
- Shop owners, their staff, and visitors to our website. Here we are the controller and decide how the data is used.
- Data shops keep about their own customers, staff and suppliers in VoraTill. Here the shop is the controller and we only process the data on its instructions, under our Data Processing Agreement. If you are a shop's customer, contact that shop about your data.
Contact for privacy questions: {{PRIVACY_EMAIL}}, {{COMPANY_ADDRESS}}.
1. What we collect, and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Owner name, email, shop name, country, currency, time zone | Create and run your account; contact you about it | Contract |
| Device details: name, platform, app version, last seen time | Pair devices, enforce device limits, support | Contract |
| Staff names and roles; PINs are stored on the device as hashes | Sign-in and permissions inside your shop | Contract (on the shop's behalf) |
| Subscription status, plan, billing events | Know whether your shop is subscribed | Contract |
| Payment details for your subscription | Taken directly by {{BILLING_PROVIDER}}; we receive only the status and a reference | Contract |
| Support messages | Answer your questions | Legitimate interest |
| Security and audit logs, such as sign-ins and changes to shop settings | Keep the service secure and investigate problems | Legitimate interest |
We don't sell personal data, show ads, or use tracking or analytics tools in the app.
2. Data shops store about their customers
Shops can store customer names, phone numbers, emails, addresses, loyalty points and purchase history, along with sales, staff and supplier records. We store and sync this only to provide VoraTill to that shop. We don't use it for anything else, and we don't contact the shop's customers.
3. Card payments
Card payments in a shop are processed by the payment provider the shop connected (such as Stripe, SumUp, Square or PayPal). VoraTill passes the payment request and receives the result, such as approved or declined and a reference. We never receive or store full card numbers.
4. Who we share data with
Only service providers that help us run VoraTill (our sub-processors), under contracts that protect the data:
- Supabase: database, sign-in and server functions, hosted in {{DATA_REGION}}.
- {{BILLING_PROVIDER}}: subscription payments.
- The shop's chosen card payment provider: when that shop takes a card payment.
The current list, with locations, is in DPA Annex 3. We may also disclose data if the law requires it, or to protect our rights or someone's safety.
5. International transfers
Our main data store is in {{DATA_REGION}}. Some providers are based in other countries, such as the United States. Where data leaves the UK or EU, we rely on adequacy decisions (such as the EU–US Data Privacy Framework) or Standard Contractual Clauses.
6. How long we keep data
- Account and shop data: while your shop is active. After you ask for deletion, it can be restored for 30 days and is then permanently deleted.
- Billing records: as long as tax and accounting law requires, usually 6 to 10 years.
- Security logs: up to 12 months.
- Data on your own devices stays until you delete it there.
7. Security
Data is encrypted in transit and at rest. Access to each shop's data is restricted to its members by database rules. Cloud sign-in tokens are kept in the device's secure storage, and staff PINs are stored only as hashes. Our staff can reach shop data only through audited tools, when needed for support or security.
8. Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, to restrict or object to our processing, and to withdraw consent where we rely on it. Email {{PRIVACY_EMAIL}} and we will reply within one month. Shop owners can export and delete their shop's data themselves in Settings → Cloud workspace.
You can also complain to your data protection authority. In the UK that is the ICO; in the EU, it's your country's supervisory authority.
9. Children
VoraTill is a business tool and is not intended for children under 16.
10. Changes
We'll post updates here and, for material changes, email shop owners before they take effect.