Privacy Policy — Caterliner

Operator: Caterliner (sole trader; business name registration in progress) (ABN: to be confirmed) ("Caterliner", "we", "us", "our"). Contact: support@caterliner.com.au · caterliner.com.au · Victoria, Australia

Caterliner is a point-of-sale, ordering and staff-management app for small hospitality businesses ("Venues"). This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Two kinds of data, two roles

• Our customers (Venue account holders). When a Venue subscribes, we collect and control their account information — we are the entity responsible for it.
• A Venue's own data (their customers and staff). Venues use Caterliner to record orders, customer details and staff/payroll information. For that data the Venue is responsible (the controller) and Caterliner acts on the Venue's behalf (a processor). Each Venue is responsible for having a lawful basis and its own privacy notice for the people whose information it enters.

2. Information we collect

Venue account information: business name, ABN, contact name, email, phone, address, login credentials, billing details, and subscription/usage records.

Data a Venue enters or generates in the app: - Customers: optional first name and phone number (for order pickup and loyalty), email address (if a receipt is emailed), and order history. - Staff: name, role, employment type and award level, PIN, contact details, date of birth, start date, superannuation fund/member number, bank BSB/account (entered by the staff member), tax-free-threshold flag, clock-in/out records, rosters, leave and pay estimates. - Operational records: orders, menu, stock, suppliers, waste, cash-ups, food-safety temperature logs.

Technical information: device/app version, basic log and diagnostic data, and (on the web app) standard server logs.

We do not store full card numbers — card payments are processed by our payment provider (see below).

3. How we collect it

Directly from Venues and their staff (entered into the app), automatically through use of the app, and from customers when they place an order via QR/kiosk.

4. Why we use it

• To provide and operate the app (ordering, kitchen, rostering, timesheets, pay estimates, reporting).
• To process subscriptions and payments.
• To provide support, security, fraud prevention and to maintain/improve the service.
• To meet legal obligations.

We do not sell personal information.

5. Who we share it with (and overseas disclosure)

We use trusted service providers to run the app. Some store or process data outside Australia, so by using Caterliner you acknowledge personal information may be disclosed to overseas recipients: - Supabase — database, authentication and file storage (AWS Sydney, ap-southeast-2). - Vercel — web app hosting. - Stripe — card payment processing (PCI-DSS compliant; we don't store card numbers). - Resend — sending receipt/notification emails (only when that feature is used). - Expo / app stores (Apple, Google) — app delivery and updates. - A public holiday calendar API (date.nager.at) — no personal information is sent.

We may also disclose information where required by law.

6. Storage and security

Data is stored with the providers above. We use access controls (database row-level security), encryption in transit (HTTPS/TLS), and restrict access to authorised people. No system is perfectly secure; we cannot guarantee absolute security.

7. How long we keep it

We keep personal information while a Venue's account is active and as needed to provide the service and meet legal/record-keeping obligations (for example, Australian employee and tax records must generally be kept for 7 years). Venues can request deletion of their data subject to those obligations.

8. Access, correction and complaints

You can ask us to access or correct your personal information (APP 12 & 13) by contacting us at support@caterliner.com.au. We will respond within a reasonable time. If you have a privacy complaint and are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Staff and customer rights at a Venue

If you are a customer or staff member of a Venue, direct access/correction/deletion requests to that Venue in the first instance, as they control their data. We will assist the Venue as their processor.

10. Cookies / analytics

The web app uses only the storage necessary to run (e.g. remembering a device's role). We do not currently use third-party analytics. If this changes, we will update this section.

11. Children

Caterliner is a business tool not directed at children and is not intended for use by anyone under 16 to create an account.

12. Changes

We may update this policy; we will post the new version with an updated date and, for material changes, notify Venue account holders.

13. Contact

Caterliner — support@caterliner.com.au — Victoria, Australia.