Privacy Policy

Version 1.0 · effective [DATE] · Appenzeller Group Pty Ltd [ABN ___ ___ ___]

Draft for legal review. Confirm the hosting location and every service provider listed below before publishing.

1. Overview

This policy explains how Appenzeller Group Pty Ltd handles personal information in AppenPOS, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For the business data you put into AppenPOS about your own customers and staff, you are responsible for your own privacy obligations; we handle that information on your behalf to provide the service.

2. What we collect

• Account owners: name, business name, email address, password (stored only as a salted hash) and billing details held by our payment provider.
• Staff you add: names, roles and PINs (stored only as salted hashes) and an activity log of what each person does in AppenPOS.
• Your customers: anything you enter on a sale, such as a name, phone number or email address for a receipt, and what they bought. Card numbers are never sent to AppenPOS.
• Shoppers using Tilly: the questions they type on the customer display.
• Website visitors: details entered in the demo request form.
• Technical: device names, connection times and error logs.

3. How we use it

To provide and support AppenPOS, send service emails (receipts you ask us to send, password resets, trial and billing notices), keep the service secure, prevent misuse and meet legal obligations. We don’t sell personal information or use your customers’ information for our own marketing.

4. Who we share it with

• Hosting and database: Render Services, Inc. Data is stored in the [Singapore] region. [Confirm region.]
• Email delivery: [Resend / Postmark]
• Billing: Stripe
• Appenzeller Group apps the store links (AppenCRM, AppenSales, AppenStock and others): customer names, contact details, purchases and stock, only for the kinds of data the store chooses to share with each app
• AI answers for Tilly, if switched on: Anthropic, which receives shoppers’ questions and your product list.
• Services you connect, such as Square, Stripe, Xero, QuickBooks, Shopify or AABOS, which receive the data each connection needs.

Some of these providers store or process information outside Australia, including in Singapore and the United States. We take reasonable steps to make sure they protect it consistently with the APPs.

5. Security

Data is encrypted in transit. Passwords and PINs are hashed, and access tokens for connected services are encrypted. Each business’s data is kept separate, and every action is checked against the staff member’s role and logged. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

6. Keeping and deleting information

We keep information while your account is active. After cancellation you have 30 days to export your data, then we delete it, except records we must keep for tax or legal reasons.

7. Access, correction and complaints

You can ask to see or correct personal information we hold about you by emailing info@appenzellergrp.com.au. If you have a complaint, contact us first and we will respond within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Contact: Privacy Officer, Appenzeller Group Pty Ltd · info@appenzellergrp.com.au · 1800 757 988