The minimum
Anonymous sales are the rule: a customer record is only useful for credit or loyalty. The phone number is only saved with the customer's consent (a tick box); the till records who collected it and when.
The customer's rights
In the customer's record › Personal data (manager):
- Export their data (JSON or CSV): record, consents, credit book, receipts.
- Correct the name or phone number.
- Withdraw contact consent: the phone number is deleted.
- Anonymise this customer: name, phone number and notes are permanently replaced by a pseudonym; sales, credit book and balance stay accurate. This cannot be undone. If the customer still owes money, only the owner can do it, with a reason: the debt stays owed under the pseudonym.
Retention
Accounting records (sales, returns, till) are kept for at least 10 years. The Data retention card in Data and exports flags inactive records to review; nothing is deleted automatically unless you set it up.
Phone number for the “order ready” text message (café plan)
When the till has text messaging set up, a number can be noted on a café order, with the customer's consent, to let them know their order is ready. It is never shown in full or written in the audit log, it never leaves the till, and it is deleted as soon as the message is sent or the order is handed over or cancelled, at the latest after 24 h. See Kitchen and handing over orders.
Diagnostics
Share a diagnostic shows exactly what will be sent to support (versions, status, sync, recent errors) before it is sent: names, phone numbers and email addresses are masked, and your sales and keys are never included. Nothing is sent without your ticked consent.
On screen
A customer's balance only appears on the till screen after Show balance.