Privacy policy

Last updated 30 October 2026

This policy explains what personal information NoPOS collects, why, who we share it with, how long we keep it and what your rights are under the Protection of Personal Information Act (POPIA). It covers the NoPOS ordering app (NoPOS Order) and website, the NoPOS Till app, the NoPOS Driver app, the NoPOS Owner app, and the NoPOS services restaurants use to run their stores.

Who is responsible for your information

• Restaurants that use NoPOS decide how their own customers' and staff's information is used when you order from them or work for them. For that information the restaurant is the responsible party and NoPOS processes it on the restaurant's behalf, as its operator.
• NoPOS is the responsible party for your NoPOS app account itself (your sign-in, saved addresses and account settings) and for the information we need to run and secure our service.

What we collect in the NoPOS ordering app

• Phone number, to sign you in with a one-time code sent by WhatsApp or SMS.
• Name, so the restaurant knows whose order it is.
• Delivery addresses you save, including an optional map pin, unit number and delivery instructions.
• Location, only when you tap to use your current location to find a nearby restaurant or fill in your address, and only while the app is open. You can type an address instead.
• Orders: what you ordered, from which restaurant, when, and how it was collected or delivered.
• Wallet, vouchers and loyalty points if the restaurant offers them.
• Payments: card payments are processed by our payment provider. NoPOS never sees or stores your full card number; for saved cards we keep only a token from the provider.
• Notifications: if you turn on order updates, a notification address for your device (in the Android and iPhone apps, a token from Google's Firebase Cloud Messaging).
• Security information: your IP address and device or browser type in security logs, to prevent abuse such as repeated sign-in attempts.

What we collect in the NoPOS Till app and restaurant services

• Staff names, roles and PINs. PINs and passwords are stored only in hashed form.
• Sales, orders, payments, refunds, stock counts and cash-ups recorded on the restaurant's devices.
• Device identifiers, security keys and health information (for example whether a device is online, its sync backlog and printers, error and crash counts and the last few lines of its log), so the restaurant's devices can sync safely and the restaurant can see them in its back office.
• On Android tills, a notification token (Firebase Cloud Messaging), so the till can announce new online orders.
• Customer details the restaurant captures for delivery orders (name, phone number, address), stored for that restaurant only.

What we collect in the NoPOS Driver app

NoPOS Driver is used by a restaurant's own delivery drivers. The restaurant is the responsible party for this information.

• The driver's name and PIN (stored only in hashed form), set up by the restaurant.
• Location, only while a delivery trip the driver started is on the road, including when the app is in the background or the screen is off (Android shows a notification while it is shared). It is shown to the customers of that trip and to the restaurant. Nothing is collected when the driver is not on a trip.
• Proof of delivery: the customer's delivery PIN, or a photo of the order at the door.
• Deliveries made and reasons for orders that could not be delivered. Drivers do not take payments: delivery orders are paid before they leave the restaurant.
• A notification token (Firebase Cloud Messaging), so new trips reach the driver's phone.

What we collect in the NoPOS Owner app

NoPOS Owner is used by restaurant owners and managers with a NoPOS HQ account that their organisation made for them. The organisation (the restaurant or restaurant group) is the responsible party for this information.

• Your HQ sign-in: email address and name, your password (stored only in hashed form), and two-step sign-in or passkeys if you use them.
• Signed-in devices: the type of device and its IP address for each sign-in, so you can see and end your sessions.
• Your alert settings, quiet hours and sales targets.
• A notification token (Firebase Cloud Messaging) if you switch alerts on.
• App lock: if you lock the app with your fingerprint, face or screen lock, your phone checks it and only tells the app yes or no. NoPOS never receives biometric information.

The figures the app shows are the restaurant's business totals (sales, orders, staff voids and refunds, cash-ups). The app shows no customer personal information.

What we collect on this website

• Visit counts: when a page on nopos.co.za opens, or someone taps "Book a demo" or starts the demo or reseller form, the page tells our own server which page it was and which link or ad led there (the campaign tags in the link, an ad click id from Google or Meta if there was one, and the address of the referring website without its path). The server adds one to a daily total for that page and campaign. It does not store your IP address or anything that identifies you. Your browser keeps where the visit came from only until you close the tab.
• OpenAI ads pixel: every page on nopos.co.za loads a small script from OpenAI (bzrcdn.openai.com) that tells OpenAI which pages were visited and when a demo request was sent (only that one was sent, not what you wrote in it), so we can measure our advertising on OpenAI's services. Your browser connects to OpenAI for this, so OpenAI receives your IP address and browser details, and the script may store an identifier in your browser. See OpenAI's privacy policy. You can block it with your browser's tracking protection or an ad blocker; the website works the same without it. Our own visit counts and demo requests are not shared with OpenAI.
• Meta pixel: every page on nopos.co.za also loads Meta's pixel (connect.facebook.net), which tells Meta (Facebook and Instagram) which pages were visited and when a demo request was sent (only that one was sent, not what you wrote in it), so we can measure our advertising on Facebook and Instagram. Your browser connects to Meta for this, so Meta receives your IP address and browser details, and the pixel sets a cookie; if you are signed in to Facebook or Instagram in the same browser, Meta can link the visit to your account under its own terms. See Meta's privacy policy. You can block it with your browser's tracking protection or an ad blocker; the website works the same without it.
• Google Analytics: every page on nopos.co.za also loads Google's tag (googletagmanager.com), which tells Google which pages were visited, how you got there and roughly how long you stayed, so we can see how the website and our ads are doing. Your browser connects to Google for this, so Google receives your IP address and browser details, and the tag sets cookies; if you are signed in to Google in the same browser, Google can link the visit to your account under its own terms. See Google's privacy policy. You can block it with your browser's tracking protection or an ad blocker; the website works the same without it. These three (Google's, OpenAI's and Meta's) are the only third-party scripts on the website.
• Demo requests: the name, business, email address, phone number, number of stores and message you send with the "Book a demo" form, with the link or ad that brought you, so we can reply and know which advertising works. They are emailed to our sales inbox and kept for NoPOS staff to follow up. We delete them after 24 months, or sooner if you ask.
• Reseller applications: the contact details, company details (name, registration and VAT numbers, website, areas covered, years in business, client base, the systems you sell and your team size) and message you send with the "Become a reseller" form, with the link or ad that brought you, so we can assess the application and reply. They are emailed to our sales inbox and kept for NoPOS staff to follow up. Sending one is not reported to OpenAI, Meta or Google. We delete them after 24 months, or sooner if you ask.
• Free trial sign-ups: the name, business name, email address, mobile number and web address you choose on the trial sign-up form at trial.nopos.co.za, to set up your trial and contact you about it. With them we keep the link or ad that brought you: the campaign tags in the link and, if you came from a Google ad, the ad click id (gclid) Google adds to the link. Once you confirm your email address, the trial server tells our main NoPOS server that a trial started, with that campaign, ad and click id and the time, but not your name or contact details. We count trials per campaign, ad and keyword to see which advertising works, and we upload the click id and the time of the sign-up to Google Ads as a conversion, so Google can report which ads led to trials. Google receives no name, email address or phone number from us.

Why we use it

• To place, prepare, deliver and support your orders.
• To sign you in securely and protect accounts and payments from fraud.
• To keep the financial records the law requires, such as VAT records.
• To run, maintain and improve NoPOS, using aggregated information that does not identify you.

We do not sell personal information, and we do not use it for advertising. The exceptions are measuring our own ads: for a free trial that came from a Google ad, we send Google the ad's click id and the time of the sign-up, and the OpenAI and Meta pixels on this website report page visits and demo requests to OpenAI and Meta (see above).

Who we share it with

• The restaurant you order from, and its delivery driver for delivery orders (your first name, address and delivery instructions). Drivers call you through the restaurant's line, so they never see your phone number.
• Our payment provider, to process card payments and refunds.
• Messaging providers, to send sign-in codes and order updates (WhatsApp, operated by Meta, and an SMS provider).
• Map and address services, to turn an address into a map location. We use OpenStreetMap-based services first; Google is used only if a restaurant group has enabled it and the address cannot otherwise be found.
• Google Maps, for the maps shown in the ordering website and app, the NoPOS Driver app, NoPOS HQ and on the tills, when the restaurant group's NoPOS server has Google Maps set up. The map is loaded from Google by your browser or app, so Google receives your IP address and the area of the map being shown, as with any Google map. Pins (such as your door or a driver's position) are drawn on the map by the app. See Google's privacy policy. Without Google Maps set up, no map is loaded and links open Google Maps only if you tap them.
• Google Ads, to measure our own advertising: for a free trial that started from a Google ad, the ad click id and the time of the sign-up (no name or contact details). See Google's privacy policy.
• Google Analytics, to see how our website and ads are doing: its tag on nopos.co.za reports page visits, with your IP address and browser details, and sets cookies (see What we collect on this website). See Google's privacy policy.
• Meta (Facebook and Instagram), to measure our own advertising there: its pixel on nopos.co.za reports page visits and demo requests, with your IP address and browser details, and sets a cookie (see What we collect on this website). See Meta's privacy policy.
• OpenAI, to measure our own advertising on OpenAI's services: its ads pixel on nopos.co.za reports page visits, with your IP address and browser details (see What we collect on this website). See OpenAI's privacy policy.
• Google Firebase Cloud Messaging, to deliver notifications to the NoPOS apps on Android and iPhone. It receives the app's notification token and the text of each notification (for example "Order #123 is on its way" or a new trip's order numbers).
• Delivery platforms such as Uber Eats or Mr D, only for orders you place through those platforms.
• Where the law requires it, regulators or law enforcement.

Some of these providers may process information outside South Africa. When that happens we make sure the information is protected to the standard POPIA requires.

AI features

Some NoPOS features can use AI services, for example to understand a typed order. These are off unless a restaurant group turns them on. Before anything is sent to an AI service, names, phone numbers and addresses are removed.

How long we keep it

• Your details (name, phone number, addresses and order history) are kept so that the restaurant has your order history, and so that you can receive specials if you opted in to them. You can ask for your data to be deleted at any time (see Your rights).
• A restaurant group can choose to clean up older details, for example removing names, phone numbers and addresses from old orders or anonymising accounts that have not been used for a while. Customers who opted in to specials keep their details. The order totals always remain for the restaurant's reports.
• WhatsApp ordering conversations are kept unless the restaurant group sets a clean-up period, and deleted immediately if you send STOP.
• Delivery proof photos are kept for 30 days. A driver's last known position is deleted when their shift ends, and after 7 days at most.
• Notification tokens are deleted when you sign out or delete your account, and when the notification service reports them no longer valid.
• Financial records are kept for 5 years for VAT purposes, without personal details beyond what the law requires.

How we protect it

All connections to NoPOS over the internet use encryption (HTTPS). Restaurant devices sign every sale they record. Back-office access is limited by role; NoPOS staff and the administrators NoPOS invites must use two-step sign-in (an authenticator app or a passkey), and every back-office user can turn it on. Passwords and PINs are stored only as secure hashes.

Your rights

You may ask to see the personal information we hold about you, correct it, delete it, or object to how it is used. In the NoPOS app you can download your information or delete your account under Account. Deleting an account with a wallet balance needs the balance to be used or refunded first. For information a restaurant holds about you, contact the restaurant, or contact us and we will pass your request on.

If you are not satisfied with how we handle your information, you may complain to the Information Regulator (South Africa) at inforegulator.org.za.

Deleting your account

• NoPOS Order (the NoPOS app) and restaurants' own ordering apps: in the app, open Account and tap Delete account. Or email hello@nopos.co.za with the phone number of the account; we check that the number is yours and delete the account within 30 days. We delete your phone number, name, email address, saved addresses, saved cards (and the card token at the payment provider), notification tokens and sign-ins. Your past orders stay in the restaurant's records without your name, phone number and address, and financial records are kept for 5 years for VAT. A wallet balance must be used or refunded first.
• NoPOS Driver, NoPOS Till and NoPOS Owner: these accounts are made by the restaurant or restaurant group you work for. Ask them to remove you in NoPOS HQ, or email hello@nopos.co.za and we will pass the request on and confirm when it is done. Sales and delivery records stay in the restaurant's books as the law requires.

Children

NoPOS is not intended for children under 13, and we do not knowingly collect information from them.

Changes

We will update this page when our practices change and show the date of the latest version at the top.

Contact

NoPOS is a product of Novasys IT (Pty) Ltd, Reg. 2018/058452/07 (company details). NoPOS Information Officer: email us, or call 012 942 4242.