Data Processing Terms

Why this document exists

When a restaurant uses Cobblestone POS, we end up holding personal information about that restaurant's customers — names, phone numbers, email addresses, order history. The restaurant decides what happens to that information. We only handle it to run the Platform.

These Data Processing Terms set out that arrangement. They form part of the Terms of Service and apply automatically to every merchant — you do not need to sign anything separately, though we will sign a copy if you need one for your records.

Roles

You are the controller:

You decide what customer information to collect, why, how long to keep it, and who may see it. You are responsible for having a lawful basis to collect it, for your own privacy notice, and for the consent behind any marketing.

We are the processor:

Cobblestone POS LLC processes that information only to provide the Platform to you, on your instructions, and for no independent purpose of our own.

Our vendors are subprocessors:

The vendors listed below process it on our behalf, under contracts that pass these obligations down to them.

For information about you and your staff — your account, your business records, your support history — we are the controller, and our Privacy Policy governs instead.

Scope of processing

Subject matter:

Providing the Cobblestone POS platform and related support.

Duration:

For as long as your account is open, plus the retention periods described in the Privacy Policy.

Nature and purpose:

Collecting, storing, organizing, transmitting, displaying, backing up, analyzing and deleting customer data so that orders, payments, loyalty, messaging and reporting work.

Types of personal information:

Name, phone number, email address, delivery address, order and purchase history, loyalty balance and activity, messaging consent records, card brand and last four digits with a gateway token, booking details, and call recordings or transcripts where you enable the AI phone receptionist.

Categories of individuals:

Your customers, including online ordering, in-store, loyalty, wholesale and catering customers.

What we commit to

• Process only on your instructions. We will not use your customer data for our own purposes, will not sell it, and will not use it to market to your customers. If we believe an instruction from you would break the law, we will tell you instead of acting on it.
• Confidentiality. Access is limited to personnel who need it to provide or support the Platform, each bound by confidentiality obligations and using the least privilege required.
• Security. We maintain the technical and organizational measures described in section 6 and on our Security page, appropriate to the risk.
• Breach notification. If we become aware of a personal data breach affecting your customer data, we will notify you without undue delay and no later than 72 hours after becoming aware, with what we know about what happened, who is affected, the likely consequences and what we are doing about it. We will keep you updated as we learn more and will help you meet your own notification duties.
• Assistance with individual requests. If a customer contacts us directly about their information, we will refer them to you and tell you about it. On your instruction we will provide, correct, export or delete a record, at no charge for ordinary requests.
• Cooperation. We will give you the information you reasonably need to complete a data protection assessment or answer a regulator, and will cooperate with a lawful regulatory enquiry.
• No onward disclosure. We will not disclose your customer data to anyone other than the subprocessors below, unless you instruct us to or the law compels us. If we receive a binding legal demand for your data, we will tell you before responding unless we are legally prohibited from doing so.

Subprocessors

These are the vendors your customer data passes through, what each one does, and where it sits. This list is maintained from the actual integrations in the Platform, not from a template.

We remain responsible to you for a subprocessor's performance. Each is engaged under a written contract with data protection terms at least as protective as these.

If we add or replace a subprocessor that handles your customer data, we will give you at least 30 days notice by email or in the admin panel. If you object on reasonable data protection grounds, tell us within that period and we will work with you to find an alternative; if we cannot, you may close your account without penalty and export your data.

Security measures

Our measures include:

• Encryption in transit (TLS) for all connections, and encryption at rest for stored data via our cloud provider.
• Per-merchant data isolation, so one merchant's records are stored and queried separately from another's, enforced by server-side authorization rules rather than by the client.
• Authentication through a managed identity provider, with role-based permissions and hashed credentials. Register PINs are stored hashed.
• Least-privilege access for personnel and for service accounts.
• Secrets held in managed secret storage, never in source code or in a committed configuration file.
• Rate limiting, request validation and standard HTTP security headers on our API.
• Audit logging of significant actions, including voids, refunds, discounts, price overrides and permission changes.
• Automated backups of the database, with point-in-time recovery available from our cloud provider.
• Rejection of raw card data at the API boundary, so a client cannot cause card data to be stored even by mistake.

See the Security page for more detail, including what we do not currently claim.

International transfers

Your customer data is stored and processed in the United States. Two optional vendors, Hostinger and Canva, may process limited data outside the United States as noted in the table. We do not transfer your customer data to any other country without telling you.

Audits and information

On reasonable written request, and no more than once a year unless a regulator or a security incident requires otherwise, we will provide the information you need to verify our compliance with these terms — our security documentation, our subprocessor list, and written answers to a security questionnaire. We do not currently hold a SOC 2 report or an equivalent third-party audit, and we will tell you plainly rather than imply otherwise.

Deletion and return

You can export your data from the admin panel at any time. When your account closes, you have 30 days to request a full export, which we will provide at no charge in a usable format.

After that window we delete or de-identify your customer data in the ordinary course, except where we are required to retain records to meet a legal, tax, accounting or dispute-resolution obligation. Retained records stay subject to these terms for as long as we hold them. Backups age out on their own retention cycle.

You can also instruct us to delete a specific customer record at any time while your account is open, and you can do most of this yourself in the admin panel.

Liability and precedence

Each party's liability under these terms is subject to the limitation of liability in the Terms of Service. Nothing here is intended to increase that cap.

If these Data Processing Terms conflict with the Terms of Service about the handling of your customers' personal information, these terms control on that subject. For everything else, the Terms of Service control.

Requesting a signed copy

If your own compliance program needs a countersigned data processing agreement, or a completed security questionnaire, email hello@cobblestonepos.com and we will provide one.

Privacy questions and data requests: hello@cobblestonepos.com.