LekkaTill — Privacy Policy & Data-Processing Agreement

LekkaTill, formerly Johnny POS ("the service"), is a point-of-sale application used by staff of a bar/venue to record sales, manage stock, run patron tabs, and track staff shifts and tips. It runs as a shared, hosted service: many independent venues ("pubs") use one backend, with each pub's data kept strictly isolated from every other pub's. This policy explains what information the service handles and how it is treated, and (for pub owners) sets out the data-processing terms between the pub and the service operator. The app is intended for use by authorised venue staff, not by the general public.

Who is responsible (controller and processor)

Each pub is the controller of the data entered for that pub — it decides what staff, products, and sales are recorded. LekkaTill (the service operator) is the processor: it stores and processes each pub's data solely to provide the point-of-sale service to that pub, on the pub's instructions, and for no other purpose. For any questions about this policy or your data, contact shepherdmark1968@gmail.com.

Information the app handles

• Staff account details. To sign in, a staff member uses a username (an email address, or a simple name chosen by the venue) and a password. Passwords are never stored in readable form — they are stored only as a salted scrypt hash on the venue's own server.
• Sales and operational records. Transactions (items sold, amounts, tips), stock levels, shift start/end times, and patron tab records are stored so the venue can run the till and produce sales reports.
• Patron tab labels. When a barman opens a tab, they type a name to identify it (typically a first name or nickname). This is a free-text label chosen by staff to find the tab again; the app does not ask for, or require, a patron's real identity, contact details, or payment card information.
• Photographs of supplier delivery notes. When stock is booked in, a member of staff may photograph the supplier's delivery note. The photograph is sent to the venue's server, where it is read automatically so the quantities and prices on it can be proposed to staff, and then kept against that delivery as the venue's record of what arrived. To read it, the image is passed to Anthropic (the Claude API) acting solely as a sub-processor on the venue's behalf: it is used only to read that note, is not used to train any model, and is not retained by LekkaTill anywhere other than against the delivery record. These photographs are of business paperwork. Staff should not photograph anything else, and the feature is optional — stock can be booked in by hand instead.

Payment-provider settings (per venue)

A venue may connect its own SnapScan merchant account so patrons can pay by QR into that venue's account. The venue's SnapScan API key and webhook key are entered by the venue's own administrator, stored encrypted (AES-256-GCM) on the server, are never displayed back or shared between venues, and are used only to create that venue's QR payments and verify its payment notifications. LekkaTill records only the payment result (amount, a reference, paid/failed) to reconcile the sale — no card or bank-account numbers.

How information is used

Information is used only to operate the point-of-sale system for the venue: to authenticate staff, ring up and total sales, manage stock, run and settle patron tabs, and generate the venue's own sales, shift, and tip reports. It is not used for advertising or profiling.

How information is stored and protected

Data is stored on a private backend server and database, reached over an encrypted (HTTPS) connection. Although many pubs share the service, each pub's data is isolated per pub: every record is tagged to its pub and access is enforced both in the application and at the database level (row-level security), so one pub's staff or administrators can never see another pub's data. Staff passwords are stored only as salted hashes. Each pub's admin portal is protected by that pub's own admin password.

Sharing and isolation between pubs

Sub-processors. LekkaTill uses one sub-processor for one purpose: Anthropic, to read a photographed supplier delivery note when staff book in stock (see Information the app handles). Only that image is sent, only when a member of staff chooses to use the feature, and only so the note can be read back as text. No sales, staff, tab or payment data is sent to it, and nothing is sent for advertising, analytics or model training. Where a venue has enabled SnapScan, that venue's own payment provider also processes the payments it takes.

Information is not sold and is not shared with third parties for their own purposes, and it is never shared between pubs. A pub's data is accessible only to that pub's authorised staff and administrators. Service operators handle only provisioning and platform operations and cannot sign in to a pub's portal or read a pub's sales, staff, or tab data. A separate demo pub with fabricated data is used for support and training so no real pub's data is needed to reproduce issues. Information may be disclosed if required by law.

Data retention

Sales, shift, and tab records are retained for as long as the venue needs them for business and accounting purposes. Staff accounts remain until the venue deactivates or removes them.

Your choices and requests

Because accounts are created and managed by the venue for its own staff, requests to access, correct, or delete staff account information should be directed to the venue owner at the contact address above.

Children

LekkaTill is a workplace tool for venue staff and is not directed to, or intended for use by, children.

Data-Processing Agreement (for pub owners)

When a pub is set up on LekkaTill, its owner accepts this data-processing agreement in the admin portal. It records that:

• The pub is the controller and LekkaTill is the processor of the pub's data (staff accounts, sales, stock, shifts, patron tab labels, and photographs of supplier delivery notes).
• LekkaTill processes that data only to provide the service and on the pub's documented instructions — never for advertising, profiling, resale, or sharing with other pubs.
• Authorised sub-processors. LekkaTill engages one: Anthropic, used only to read a photographed supplier delivery note when the pub's staff book in stock. It receives nothing else. LekkaTill will inform the pub before adding or replacing a sub-processor, so the pub can object.
• Data is isolated per pub and protected as described above; only the pub's authorised people can access it.
• LekkaTill keeps the data for as long as the pub uses the service and supports export or deletion of a pub's data on the owner's request.
• LekkaTill will notify the pub of any personal-data breach affecting its data, and will delete or return the data on termination, subject to any legal retention duty.

The acceptance (version and date) is stored against the pub. This agreement supports the pub's obligations under POPIA (South Africa) where LekkaTill acts as an operator/processor.

Changes to this policy

If this policy changes, the updated version will be posted at this address with a new "last updated" date.