Privacy policy
OnaPOS is a set of services for restaurants and their guests, operated by Finis Ventures LLC (“Ona”, “we”). This policy covers:
- this website, onapos.com;
- Ona Manager (the back office in the browser) and the OnaPOS app (for staff, on phones, tablets and in the browser);
- guest-facing services that restaurants run on OnaPOS: booking pages, menus and QR ordering, and Ask Ona, our assistant on restaurant menus and on WhatsApp.
1. Who is responsible for your data
The restaurant is the data controller for the information its staff and guests enter into OnaPOS: orders, tabs, table activity, bookings, guest notes, shift records and its own staff accounts. We act as its processor and handle that data only on the restaurant’s instructions.
We are the controller for:
- the limited technical data we need to run the service securely, for example sign-in records, device push tokens and error logs;
- the messages you send us through this website;
- your conversations with Ask Ona and the orders you place through it. When you order through Ask Ona, we pass the details needed to prepare and deliver your order to the restaurant and to the rider service, which handle them for that purpose.
If you work at a restaurant and want to exercise a right over your data, you can contact your employer (the restaurant) or us directly (section 10).
2. What we collect
Restaurants and their staff
| Data | Why |
|---|---|
| Staff account: name, work email, job role, a one-way hashed password and a hashed 4-digit PIN | To sign you in, lock a shared device between users and record who did what (who took an order, who closed a tab), as needed for accountability and tax records. |
| Operational records you enter: tabs, order lines, covers, discounts and their reason, payment type (cash, card or other), voids, clock-in and clock-out times, optional clock-in selfies | To run the floor and produce the restaurant’s sales, cash and staffing reports. |
| Fiscal records: numbered simplified invoices | Required by invoicing law. A correction is issued as a void plus a new document, never by rewriting history. |
| Push notification token and interface language | To deliver floor alerts to the right device in the right language. |
| Diagnostic logs: timestamps, error messages, request identifiers | To keep the service reliable and investigate faults. |
Guests
- Bookings: your name, contact details, party size, date and time, and any note you add, shared with the restaurant you book with.
- Orders: what you order from a restaurant’s menu or QR code, shared with that restaurant.
- Ask Ona: your phone number, so we can chat with you on WhatsApp; the delivery addresses you give us; the orders you place, what you paid and when; your messages with Ona, kept so we can help you and improve the service; and basic technical data, such as clicks on links we send you. Chats on WhatsApp are also subject to WhatsApp’s own privacy policy.
Guests’ phone numbers are always masked for restaurant staff: the OnaPOS app and Ona Manager never show the full number.
Visitors to this website
- Messages you send us through the contact or waitlist forms: name, restaurant, city, email, and optionally phone, current POS and your message. We use them only to reply to you or to contact you about early access.
- Anonymous usage statistics: Vercel Web Analytics and Speed Insights count page views and measure performance without cookies and without identifying you.
What we do not collect
No advertising identifiers, no cross-app or cross-site tracking, no location tracking and no payment card numbers. OnaPOS records only the payment type (cash, card or other); card data is handled by the restaurant’s own payment terminal.
3. Device permissions (OnaPOS app)
Each permission is requested only when you first use the feature that needs it, and the app works without them:
- Camera: to scan table QR codes and product barcodes, and for optional clock-in selfies.
- Photo library: to attach an image to a menu item, or to save a receipt image if you choose to export one.
- Bluetooth: to connect to nearby receipt printers, barcode scanners and scales.
- Notifications: to receive floor alerts.
4. Where your data is stored
On Amazon Web Services in the European Union (Ireland, eu-west-1). Databases are encrypted at rest, and all traffic between the apps and our servers uses TLS. Passwords and PINs are stored only as salted one-way hashes.
5. Who we share it with
We do not sell personal data and we do not share it for advertising. We use a small number of processors, strictly to deliver the service:
| Provider | Purpose |
|---|---|
| Amazon Web Services | Hosting, database and file storage (EU) |
| Apple (APNs) | Push notifications to staff devices |
| Vercel | Hosting of this website and of the browser versions of the apps; cookieless website statistics |
| Brevo | Delivery of the messages sent through this website’s forms, and of transactional email |
| Meta (WhatsApp) | Conversations with Ask Ona on WhatsApp |
| Payment processors | Payment for orders placed through Ask Ona. We never store full card numbers. |
| Restaurants and rider services | For Ask Ona orders: the restaurant receives the order and the name you gave; the rider receives your address and phone number, for that delivery only |
We may also disclose data where the law requires it, for example to a tax authority in relation to invoicing records.
6. How long we keep it
- Staff accounts: while the restaurant keeps the account active; deactivated accounts are kept while they remain attached to records that must stay auditable.
- Fiscal and accounting records: for the period the law requires (in Spain, currently up to 6 years for invoices). These cannot be deleted on request.
- Messages sent through this website: as long as we need them to answer you or to manage the waitlist.
- Ask Ona: while you use it, plus up to 12 months after your last order for support and disputes. Chat transcripts are kept while we need them to help you, and you can ask us to delete earlier conversations at any time.
- Push tokens: until you sign out, uninstall the app or the token becomes invalid.
- Diagnostic logs: a short rolling window.
7. Your rights
In the EU and the UK you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive a copy in a portable format. You can also complain to your data protection authority.
To delete your data, write to contact@onapos.com from the email address concerned, or ask the restaurant to remove your staff account. We act on requests within 30 days and confirm when it is done. Invoices already issued cannot be erased, because Spanish tax law requires us to keep them; in that case we restrict the record instead of deleting it and tell you what was kept and why.
8. Security
We use encryption in transit and at rest, access controls on internal tools and regular reviews of who can see what.
9. Children
OnaPOS is a workplace tool, and its guest services are not meant for anyone under 16. We do not knowingly collect data from children. If you think a child has shared information with us, write to contact@onapos.com and we will delete it.
10. Contact
Questions, requests or complaints about privacy: contact@onapos.com. We reply within 30 days.
11. Changes
If we change this policy, we update the date above. For material changes, we notify restaurant administrators in Ona Manager, and Ask Ona users on WhatsApp or with a clear notice on this page.