Privacy Policy

1. About this policy

APOS is a point of sale, restaurant management and guest experience platform made by Applause Technology Pty Ltd (ABN 23 613 658 763) (“APOS”, “we”, “us”, “our”). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains how we handle personal information across our websites (aposgo.com.au and aposgo.com), APOS Register, waiter tablets, kitchen displays, the owner app, APOS Portal, APOS-powered booking, ordering and payment pages, APOS AI features, and our sales, onboarding and support channels (the “Services”).

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

2. Who this policy covers

Merchants: businesses that use APOS, and their owners, directors and account contacts.
Registered Users: managers, staff, bookkeepers and others a merchant invites to use APOS.
Guests: people who book, join a waitlist, order, pay, give feedback or call a venue that uses APOS.
Visitors and prospects: people who visit our websites, request a demo, apply to be a Launch Partner or contact us.
Partners and suppliers: people who work for our integration, hardware and service partners.

3. Our role: for ourselves or for a venue

We handle personal information in two ways:

For our own purposes. We decide how we use information about merchants, account contacts, visitors, prospects and partners, for example to provide our services, bill merchants and provide support. This policy applies in full.
On behalf of venues. Information about a venue’s guests and staff is collected by the venue and stored in APOS for the venue. The venue decides how it is used, and the venue’s own privacy policy applies. We handle it only to provide the Services to the venue, under our agreement with the venue, and as the law requires. If you are a guest or staff member and have a question about how a venue uses your information, please contact the venue first. We will help it respond.

A venue can’t see guest information held by other venues, except venues owned by the same company that choose to share one guest record.

4. Personal information we collect

Who	What we collect
Merchants and account contacts	Name, job title, email, phone, business name, ABN, addresses, venue details, plan and billing history, payment method details (handled by our payment partners), signed agreements, support records, and identity and business information needed by our payments partner to approve APOS Payments.
Registered Users	Name, email, phone, role and permissions, places you can access, login details and PIN (stored securely, never in plain text), clock-in, break and shift records, device used, and an activity log of actions such as voids, refunds, discounts, comps and opening the cash drawer.
Guests	Name, mobile number, email, booking details (date, time, party size, occasion, requests), waitlist entries, orders and visit history, spend, tips, tags and notes the venue adds, preferences, allergies and dietary needs you choose to share, feedback and ratings, receipts, marketing consents and opt-outs, and, for card payments, a token and limited card details (such as card type and last four digits) from the payment provider. If a venue uses the Voice AI host, call recordings and transcripts.
Visitors and prospects	Name, work email, phone, business name, venue type and size, your current systems, what you tell us in forms and conversations, and your light or dark appearance choice.
Everyone using our apps and websites	Device and technical information, such as device model, operating system, app version, IP address, browser type, time zone, crash and error logs, network status of APOS devices, and pages or features used.

We don’t collect or store full card numbers or card security codes. Card payments are handled by PCI DSS-certified payment providers.

5. Sensitive information

Allergy and dietary information can be health information, which is sensitive information under the Privacy Act. Venues collect it only with your consent, to keep you safe and serve you well. By telling a venue about an allergy or dietary need through APOS, you consent to it being recorded on your booking, order and guest profile and shown to the venue’s staff. You can ask the venue to remove it at any time. We don’t otherwise seek to collect sensitive information, such as information about racial or ethnic origin, religion or biometrics, and ask venues not to record it in notes.

6. How we collect it

From you directly, when you fill in a form, sign up, book, order, pay, give feedback, call a venue or contact us.
From venues, when a venue or its staff enter or import information into APOS.
Automatically, from APOS devices, apps and our websites.
From third parties, such as our payments partner, identity verification services, integrations a venue connects (for example accounting software), public registers such as ABN Lookup, and referral partners.

If you give us personal information about someone else, such as people in your booking, please make sure they know and, for sensitive information, agree. If we receive personal information we didn’t ask for and don’t need, we destroy or de-identify it.

7. Dealing with us anonymously

You can browse our websites without telling us who you are. You can usually book under a first name only, as long as the venue can contact you, and pay at a venue without giving contact details. We can’t provide accounts, bookings with deposits, receipts by email or SMS, or support without some personal information.

8. Why we use it

Purpose	Examples
Providing the Services	Taking bookings, orders and payments for venues; sending confirmations, reminders and receipts; syncing devices; showing guest notes and allergies to staff.
Accounts and billing	Setting up and verifying merchant accounts; billing; collecting overdue fees.
Support and onboarding	Importing menus, enrolling devices, training, answering questions and fixing problems, including remote support with permission.
Security and fraud prevention	Protecting accounts, detecting misuse, keeping activity logs, investigating incidents.
Improving APOS	Understanding how features are used, fixing errors and building new features, using de-identified or aggregated data where possible.
Communicating with you	Service updates, changes to terms, and marketing about APOS where allowed (section 10).
Legal obligations	Tax and accounting records, responding to lawful requests, meeting our payments partner’s anti-money laundering obligations.

We use personal information only for the purpose we collected it, a related purpose you would reasonably expect, or another purpose the law allows. We don’t sell personal information, and we don’t use one venue’s guest information to market to guests for ourselves or for another venue.

9. APOS AI and automated decisions

Some APOS features use automated processing and AI. They include:

Menu scan: reading a menu photo or file to suggest items, prices and allergens.
Auto-tags and guest insights: suggesting tags such as “regular”, “big spender” or “at risk” from visit and spend history, and predicting return visits.
Table and wait-time predictions: estimating when a table will be free and how long a wait will be.
Drafted replies: drafting responses to reviews and feedback for staff to edit.
Voice AI host: answering calls, taking bookings and adding guests to the waitlist, using call audio and transcripts.

These features use booking, visit, order, feedback and call information. They help venue staff and do not make decisions that significantly affect a person’s rights or interests without a person at the venue being involved. Venue staff can see, change or remove tags and suggestions. We don’t use personal information held for venues to train AI models shared with other venues, and we require our AI service providers not to train their models on it.

10. Direct marketing

From APOS: we send marketing about APOS to merchants and prospects only with consent or where the Spam Act 2003 (Cth) allows. You can unsubscribe at any time using the link in our emails or by telling us.
From venues: venues use APOS to send their own marketing to guests who have agreed. Each venue is responsible for its marketing. Every marketing message sent through APOS has an unsubscribe option, and APOS processes opt-outs automatically. Opting out from one venue doesn’t affect others.
Service messages, such as booking confirmations, receipts and account notices, are not marketing and you will still receive them.
We don’t sell or rent contact lists, and we don’t use advertising networks to target you based on your bookings or orders.

11. Who we share it with

Venues: guest information is shared with the venue you book, order or pay at, and, if you choose, venues in the same company.
Our payments partner: to process payments, approve merchants, prevent fraud and meet anti-money laundering and card scheme obligations.
Service providers: companies that help us run APOS, such as cloud hosting, email and SMS delivery, telephony and speech-to-text for the Voice AI host, AI processing, customer support and ticketing, and security tools. They may use the information only to provide services to us and must protect it.
Integrations: services a venue connects to APOS, such as accounting software, when the venue asks us to.
Professional advisers: our lawyers, accountants, auditors and insurers.
Authorities: regulators, courts, law enforcement and government agencies where the law requires or allows it, or to protect someone’s life, health or safety.
Business transfers: a buyer, investor or successor if all or part of our business is sold or restructured, under confidentiality and with this policy continuing to apply.
Anyone else with your consent.

12. Overseas disclosure

APOS data is hosted in Australia. Some service providers may store or access limited personal information overseas, for example for email and SMS delivery, support tools or AI processing. The countries where this is likely to happen are the United States. Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contract terms.

13. Where and how we store it

Cloud data is hosted on Amazon Web Services and other providers in Australia, with encrypted backups.
Data is encrypted in transit and at rest. Data stored on APOS devices is held in an encrypted local database.
Access is limited by role, protected by strong sign-in and multi-factor authentication for our staff, and recorded in activity logs.
Devices are enrolled to the venue and can be locked or wiped remotely if lost.
Our team is trained in privacy and security, and we test our security regularly.

No system is completely secure, but we take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure.

14. Data breaches

If we suspect a data breach, we act quickly to contain it and assess the risk. If it is likely to cause serious harm, we notify the people affected and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. If the breach affects information we hold for a venue, we tell the venue without undue delay and within 72 hours and work with it on any notifications.

15. How long we keep it

Information	How long
Venue data, including guest and staff information	While the venue’s account is active, and for 60 days after it ends so the venue can export it. A venue can delete guest profiles at any time.
Billing, invoices and tax records	7 years, as Australian tax law requires.
Activity logs	As long as the venue’s plan keeps report history, and at least 12 months for security.
Voice AI call recordings and transcripts	90 days unless the venue chooses a shorter period.
Support records	3 years after the support request closes.
Enquiries from people who don’t become customers	2 years, unless you ask us to delete them sooner.
Backups	Overwritten in the normal backup cycle, usually within 35 days.

When we no longer need personal information, we destroy or de-identify it.

16. Cookies and similar technologies

Our websites don’t use advertising or cross-site tracking cookies. We use only what is needed:

Name	Type	Purpose	How long
apos-theme	Browser storage	Remembers your light, dark or automatic appearance choice	Until you clear it
apos-region, apos_region	Browser storage and functional cookie (global site)	Remembers if you chose to stay on aposgo.com instead of going to the Australian site	12 months
APOS Portal session	Essential cookie	Keeps you signed in securely	Until you sign out or the session expires
Google Fonts	Third-party request	Delivers the fonts our pages use; Google receives your IP address	Not stored by us

If we add analytics or other cookies in future, we will update this section first and ask for consent where required. You can block or delete cookies in your browser; essential cookies are needed for APOS Portal to work.

17. Your rights and choices

Access. You can ask for a copy of the personal information we hold about you.
Correction. You can ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Merchants and Registered Users can update most details in APOS Portal.
Deletion. You can ask us to delete information we no longer need. Guests can ask a venue to delete their guest profile.
Marketing. You can opt out at any time.
Consent. You can withdraw consent you have given, for example to keep allergy information on your profile.

Email partnersupport@aposgo.com.au with “Privacy request” in the subject. We will confirm your identity, respond within 30 days, and won’t charge you for making a request. If we refuse a request, we will tell you why and how to complain. For information we hold for a venue, we will pass your request to the venue and help it respond.

18. Children

APOS is a business service and is not directed at children. Guests under 18 should use booking and ordering features with a parent or guardian. We don’t knowingly collect personal information from children under 15 for our own purposes and will delete it if we find we have. Venues are responsible for information they collect about children in their bookings.

19. If you live outside Australia

If you contact us or use the Services from another country, we handle your information under this policy. Depending on where you live, you may have additional rights, for example under the New Zealand Privacy Act 2020, the EU or UK General Data Protection Regulation, or US state privacy laws, such as the rights to deletion, portability, restriction and objection. Where the GDPR applies, we rely on the legal bases of performing a contract, our legitimate interests in running and improving APOS, consent (for marketing) and legal obligations. Email us to use these rights. We will add country-specific sections before APOS opens in each new country.

20. Complaints

If you think we have mishandled your personal information, email our privacy contact at partnersupport@aposgo.com.au with “Privacy complaint” in the subject, and tell us what happened and how you would like it resolved. We will acknowledge your complaint within 5 business days, investigate, and aim to give you a written response within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner:

Website: oaic.gov.au
Phone: 1300 363 992
Email: enquiries@oaic.gov.au
Post: GPO Box 5288, Sydney NSW 2001

21. Changes to this policy

We may update this policy as APOS and the law change. We will post the new version here with a new date and, for significant changes, tell merchants by email or in APOS Portal before they take effect.

22. Contact us

Privacy contact, Applause Technology Pty Ltd · ABN 23 613 658 763 · ACN 613 658 763 · partnersupport@aposgo.com.au