Privacy for businesses

This notice covers Tillspark Business: the app shops use to sell, run tables and the kitchen, take bookings, manage stock and run their team. It is for shop owners, managers and staff. If you shop at a business that uses Tillspark, read the privacy notice for shoppers.

Who we are

Earvin Ryan Esajas runs Tillspark from the Netherlands and decides how the data about owners and staff in this notice is used.

For anything about your data, write to privacy@tillspark.com. For help with the app, write to business@tillspark.com.

Two kinds of data, two roles

Data about you, as an owner or a member of staff. We decide how this is used, and this notice explains it.

Data your shop keeps about its own customers and its own team: its customer list, the contact details it enters to send receipts, the sales it records, and staff hours and pay. Your shop decides what it records and why, and is responsible for telling those people. We store and process that data only to provide Tillspark Business to your shop, on its instructions, and never for our own purposes.

What we collect about owners and staff

• Your account: name, email address, role, and the sign-in details for your PIN or password, stored in a protected form.
• The business profile: the shop’s name, address, opening hours, tax details, branding and catalogue, including the product photos you upload.
• Operational logs: who changed a sale, a refund, stock, cash or a setting, and when.
• Time and pay records, if your shop uses the time clock or payroll: clock-ins, breaks, leave, shift swaps and payslips.
• Location, while you take card payments on a phone (our payment provider requires it), and for couriers, in the background during a delivery, so the customer can follow it.
• Your device’s push token, for notifications.
• Crash and error reports, so we can fix bugs.

Payments

Card payments are handled by Stripe or Adyen, under their own terms. When your shop sets up card payments, they collect the identity and bank details they are required to check. We never receive or store card numbers.

Why we use it, and on what basis

• To provide the service (contract): running the till, tables, kitchen, bookings, stock, team and payroll features your shop uses.
• To keep the service safe and accountable (legitimate interests): preventing fraud and abuse, audit logs, and fixing errors.
• Because the law requires it (legal obligation): keeping sales and tax records.

How long we keep it

• Your account and your shop’s data: while the shop uses Tillspark Business. When a shop closes its account, we delete its data, except what the law requires to be kept longer.
• Sales and tax records: in the Netherlands a business usually has to keep these for seven years. Export them before you close your account.
• Email addresses and phone numbers entered to send a receipt: removed after the receipt has been sent.

Who else processes it

We do not sell personal data, and we do not share it for anyone else’s marketing. These companies process data on our behalf:

• Vercel: hosts the web version of Tillspark Business.
• Supabase: database, sign-in and server functions.
• Capgo and Google Firebase: app updates and push notifications.
• Sentry: error reports.
• Stripe and Adyen: card payments.
• Resend and Twilio: receipts and messages sent by email or SMS.

If your shop connects another service, such as Shopify or Square, data moves to it on your shop’s instruction. Some of these providers may process data outside the European Economic Area. Where they do, they use safeguards such as the European Commission’s Standard Contractual Clauses.

Your rights

You can ask for a copy of your data, and ask us to correct it, delete it, limit how we use it, or send it to you in a portable format. You can object to processing based on legitimate interests. Write to privacy@tillspark.com. If a shop’s customer or employee asks us about data the shop keeps, we pass the request to the shop and help it answer.

To close your shop’s account, see deleting a business account.

If you are unhappy with how we handle your data, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the country where you live.

Changes

When this notice changes, we update the date at the top of this page.