Privacy notice
Effective 24 Sep 2026
How TabletPOS handles personal information in the console, and the rights you have under South Africa’s Protection of Personal Information Act (POPIA).
Who we are
TabletPLUS is run by TabletPOS South Africa (Pty) Ltd, registration number 2016/534747/07, a company registered in South Africa and based in Cape Town. For the console, TabletPOS is the responsible party under POPIA: we decide what personal information it holds and why.
Our Information Officer answers questions and requests about your information at [email protected].
Who this notice is for
Everyone with a console account: restaurant owners and managers, their teams, resellers and TabletPOS staff. It also covers the waiters whose names appear on kitchen orders.
What we hold
- Your account. Your email address, your name if TabletPOS has added it, and whether your account is active. Your password is kept only in a scrambled form that no one, TabletPOS included, can read back.
- Your access. The groups and sites you can use, your role at each, who gave it to you and when.
- What you change. The audit log records the changes people make in the console: who made each change, what changed and when. For groups, resellers and sites it keeps the details before and after. Invitations are recorded the same way.
- Kitchen orders. KDS servers send each site’s kitchen orders to TabletPOS for the site’s reports. An order can carry the name of the waiter who took it, as the POS gives it, with the table, items and notes. We hold these for the business that runs the site.
- Technical information. Supabase keeps a record of each sign-in. Vercel keeps logs of the requests your browser makes, including your IP address and browser, to keep the console running and secure. The audit log records neither.
Cookies and your browser
- Sign-in cookies keep you signed in until you sign out. If you don’t, they expire 400 days after you last used the console. The console can’t work without them.
- A cookie holds your place while you accept an invitation. It lasts up to 7 days and is removed once your password is set.
- Two preferences: how many rows a list shows, in a cookie kept for a year, and light or dark mode, saved in your browser.
The console uses no advertising or analytics cookies and loads nothing from other websites.
Why we use it
- To let you sign in and use the groups and sites you have access to.
- To show your team who has access, and to let administrators manage it.
- To keep a record of who changed what, so mistakes and misuse can be traced.
- To send your invitation email.
- To show each site’s kitchen reports to the people who can view them.
- To keep the console secure and working.
We rely on this being needed to provide the console to your business, and on our legitimate interest in keeping it secure and accountable (section 11 of POPIA). We don’t sell personal information, use it for marketing, or make automated decisions about you.
Whether you have to give it
An account needs an email address: without one you can’t be invited or sign in. Your name is optional.
Who can see it
- Your group’s admins and managers, and its reseller if it has one, see your email address, name, your roles there and whether your account is active. Location managers see only the people at their own sites.
- People who can view the audit log see the changes made in their groups and when. They also see who made each change, by name or email, if that person is someone they can see. An invitation shows only to the person who sent it and to TabletPOS staff.
- TabletPOS staff can see every account, to set up and support the console.
- Waiters’ names aren’t shown on any console page. Only TabletPOS staff and people who can view that site’s reports have access to them.
Who we share it with
- Supabase, which stores the console’s information and runs sign-in.
- Resend, which delivers Supabase’s sign-in emails, such as your invitation.
- Vercel, which runs the console’s pages.
- Authorities, where the law requires us to.
Each provider works for TabletPOS under its own data protection terms. We don’t send personal information to your POS.
Where it’s processed
The console’s information is stored in Ireland, in the European Union. Vercel, and Resend for emails, may process personal information outside South Africa too, including in the United States and the European Union. The EU’s data protection law gives protection comparable to POPIA, and our providers are bound by contract to protect personal information. That is how we meet section 72 of POPIA, which covers sending personal information out of South Africa.
How long we keep it
- We don’t yet delete any of this on a schedule.
- Your account and roles stay after your access ends. A removed role is marked as removed rather than erased, and your account stays so each audit entry still records who made it.
- Audit log entries and kitchen orders are never changed or deleted.
- Supabase’s sign-in records stay too. Vercel keeps its logs for a time it sets.
To have your account or other information deleted, email [email protected]. We’ll delete what we can, and tell you what we have to keep and why.
Your rights
Under POPIA you can:
- ask whether we hold personal information about you, and for a copy of it
- ask us to correct information that’s wrong, or to delete it
- object to our use of it, on reasonable grounds
- complain to the Information Regulator.
The console doesn’t let you change your own details yet, so email [email protected].
The Information Regulator takes complaints at [email protected] and general enquiries at [email protected], with its forms at inforegulator.org.za.
How we protect it
The console is served only over encrypted connections. What each person can see is limited by their role, and those limits are checked on every request, not just on screen. Changes made in the console are recorded in the audit log. If a breach affects your personal information, we’ll tell you and the Information Regulator, as POPIA requires.
Changes to this notice
When what we hold, or why, changes, we’ll update this page and the date at the top.