Point of Sale Privacy Notice
Effective Date: 15 September 2026 Last Updated: 18 September 2026
This notice covers DiscoverWorthy Till, our point-of-sale app, and the counter features behind it. It sits alongside our Privacy Policy and adds to it — everything in that policy still applies. Where this notice is more specific about the till, this notice governs.
It exists because a till is different from the rest of the platform. Everywhere else, the personal information we hold is mostly yours. At a counter it is mostly your customers' — the person buying a coffee, the account customer who settles up at the end of the month. That deserves saying plainly rather than folding into a general policy.
1. Who is responsible for what
For your own account information — your business details, your staff, your subscription — we are the data controller.
For your customers' information — the mobile numbers, names and balances you put into the till — you are the controller and we are your processor. We hold that information because you asked us to, and we act on your instructions. We do not decide what to do with your customers' details, and we do not use them for our own purposes.
Two consequences worth being clear about:
- Your customers are yours. We never use a customer list from your till for DiscoverWorthy's own marketing, and we never sell it.
- If one of your customers asks what you hold about them, that request is yours to answer — it is your record. Your dashboard shows everything the till holds about them, and we will help you answer if you need us to.
2. What the till collects
| Data | When collected | Purpose |
|---|---|---|
| Sale records (items, amounts, time, payment method) | Every sale | Your takings, receipts, reporting, tax records |
| Refunds | When you give one | Matching a refund to the original sale, preventing a double refund |
| Customer mobile number | Looking up loyalty, credit or an account | Identifying a customer at the counter — it is the identity a counter person can type |
| Customer name | Account and loyalty customers | So the counter knows who they are serving |
| Account balance and credit limit | Account customers | What a customer owes you, and the advisory limit that warns your counter |
| Loyalty points | Loyalty customers | Accruing and redeeming rewards |
| Staff name | Staff setup | Attributing a sale to whoever rang it up |
| Staff PIN | Staff setup | Stored only as a one-way hash — the digits themselves are never stored or recoverable |
| Till device name and identifier | Pairing a tablet | Telling your tills apart, and cutting off a lost one |
| Trading hours, tax settings, price lists | Shop setup | Pricing and receipts |
3. What is stored on the tablet itself
The Till is built to keep working when the internet does not. A sale is written to the tablet and is complete before any network call is attempted. That is deliberate: a shop should never be unable to take money because of a problem at our end.
It has a consequence worth stating plainly:
A copy of your customer list lives on the tablet. Mobile numbers, names, balances and credit limits are held on the device so your counter can serve an account customer with no signal. Sales that have not yet reached us are also held there until they do.
How that is protected:
- The tablet's storage is encrypted at rest by Android.
- The credential that lets a till talk to us is held under a hardware-backed key in the Android Keystore, not in ordinary app storage.
- You can cut off a tablet at any time from your dashboard. Its credential stops working immediately — which is what to do if a tablet is lost or stolen.
Because of this, a till tablet should be treated like a cash drawer: it holds your customers' details, and it should be kept where you would keep money.
4. Card payments
We never see a card number.
In-person card payments go through your own payment terminal, connected using Linkly. The card details pass between the terminal, your bank and the card scheme. They do not pass through the Till app, and they do not pass through us. What we record is the outcome — that a payment of a certain amount succeeded, and the reference printed on the receipt.
For online orders, card processing is handled by Stripe. The same holds: card details go to Stripe, not to us.
5. What the app asks permission for
The Till app requests these Android permissions and no others:
- Internet and network state — to sync with DiscoverWorthy, and to know whether it currently can.
- Bluetooth (three permissions, two of which apply only to Android 11 and below) — to talk to a receipt printer and a card terminal on the same counter. Used for nothing else.
- Location — only for Tap to Pay, and explained below.
Location, plainly. Taking a card on the phone itself uses Stripe's Terminal SDK, and that SDK refuses to take a payment unless it can establish where the payment happened. It is a fraud and dispute control, and it is Stripe's requirement rather than ours.
- The permission is requested at runtime only when an owner switches Tap to Pay on. A till that never uses Tap to Pay never asks, and the counter never sees a location prompt.
- It can be declined. Tap to Pay then does not work; every other part of the till — ringing up a sale, printing, taking cash, a card terminal on the counter — is unaffected.
- The location goes to Stripe, with the payment. DiscoverWorthy does not record where your till is, and there is no tracking of any kind in the app.
Depending on the Android version this is coarse or precise location, and Stripe's SDK also brings in wifi state. Neither is kept by us.
It does not ask for contacts, camera, microphone, or access to your files. There is no advertising identifier in the app, and no analytics or crash-reporting tool of any kind — the app reports nothing about how you use it.
6. The demo till
The app offers a demo shop for anyone who does not have a pairing code, so the till can be tried before it is set up.
A demo till holds no credential of any kind and never contacts our servers. Nothing you do in a demo leaves the tablet, and nothing about it reaches us — including the fact that you tried it.
7. Where it is kept, and for how long
Till data is stored in Microsoft Azure in the Australia East region.
| Data | Retention |
|---|---|
| Sales and refund records | While your account is open, and as long as tax law requires — 7 years in Australia |
| Customer accounts and balances | Until you delete the customer, or your account closes |
| Loyalty records | Until you delete the customer, or your account closes |
| Data held on a tablet | Until the till is disconnected or the app is uninstalled |
| Backups | Point-in-time backups are kept for 7 days. Deleted information can persist in them for up to a week before it is gone for good. We keep no long-term backup archive. |
When you close your organisation we delete the data belonging to it. That deletion is handled in application code that walks every table your organisation owns, rather than relying on the database to cascade.
8. Who else sees it
Beyond the providers listed in our Privacy Policy, the till involves:
| Provider | Purpose | Data shared |
|---|---|---|
| Linkly | Routing in-person card payments to your own terminal | Transaction amount and reference. No card numbers reach us |
| Google Play | Distributing the Android app | Whatever Google collects as the app store — see Google's own policy |
We do not send your customers' details to any AI provider as part of the till. The AI features described in our Privacy Policy are elsewhere in the platform.
9. Your obligations as the merchant
Because you are the controller for your customers' information, a few things are yours rather than ours:
- Tell your customers you keep their details, if you collect a mobile number for loyalty or an account. A line at the counter or on your receipt is usually enough.
- Only collect what you need. The till works without a customer's details; they are required only for loyalty and account sales.
- Keep your tablets secure, and disconnect one promptly if it is lost.
- Give your staff their own logins rather than sharing one, so a sale can be attributed correctly.
10. Contact
Questions about this notice, or about what the till holds:
Email: dpo@discoverworthy.com Address: 140 Keilor Road, ESSENDON NORTH, VIC 3041
If you are a customer of a business that uses DiscoverWorthy Till and you want to know what they hold about you, please ask that business first — it is their record. If you cannot reach them, contact us and we will help.