POS Cafe System — Web application (React + Node.js/Express)
This cafe point-of-sale records orders, member loyalty, and payments. Most of what it stores is business data; the personal part is limited to loyalty members and staff accounts.
POS Cafe System is software that an organization installs and runs on its own infrastructure. The cafe operating a given installation decides what data is entered into it and is the data controller for that installation. This page documents what the application itself collects and processes by design; it is the reference policy for the software, and an operator may publish additional terms on top of it. As the developer, I have no access to any production database unless an operator explicitly grants it for maintenance.
| Data | Why |
|---|---|
| Loyalty member data | Name, phone number or email, membership number, point balance, and visit history — collected only when a customer chooses to join the loyalty program. |
| Order data | Items, modifiers, table, total, and timestamps. Walk-in orders carry no customer identity. |
| Payment records | Method, amount, status, and for card payments a Stripe reference plus the last four digits. Full card numbers are never stored. |
| Staff accounts | Name, role, and hashed password. |
| Inventory data | Ingredient stock and movements — no personal data. |
| Technical logs | IP address, user agent, and action timestamps. |
| Service | What it does |
|---|---|
| Stripe Privacy policy ↗ | Processes card payments. Card numbers are captured by Stripe’s SDK and never reach this application’s server — it only receives a token, the last four digits, and a status. |
Joining the loyalty program is voluntary. Points and visit history are used to apply member benefits and to let the cafe understand aggregate visit patterns — not to build advertising profiles, and never shared outside the cafe. A member can ask staff to close their membership, which removes their contact details; past sales stay in the books without an identity attached.
Order updates are pushed between the counter, the kitchen, and the tablets over a WebSocket connection on the cafe’s own network or server. The payloads contain order contents — no customer personal data beyond an optional member name.
The application uses cookies only for functionality:
There are no advertising cookies, no third-party analytics or tracking pixels, and no cross-site profiling. Clearing cookies simply logs you out.
Data stays within the cafe’s installation and its payment provider. It is not sold or shared with advertisers. Sales records are kept for as long as bookkeeping and tax obligations require; membership records last until the member closes their account.
The application applies standard protections: passwords are stored as one-way hashes (never in plain text), access is limited by role, and all traffic between client and server is expected to run over HTTPS/TLS.
No system is perfectly secure. Server hardening, backups, and access management for a live installation are the responsibility of the organization operating it.
The system is a staff-facing tool. Loyalty membership is intended for adults, and records are created by staff.
You have the right to ask for access to, correction of, or deletion of your personal data, and to object to certain processing.
Because your data lives in the installation run by the organization you deal with, address those requests to that organization first — they hold the data and can act on it. If you cannot reach them, or you believe the application itself is at fault, contact the developer at mhdlutfidev@gmail.com and I will assist technically.
If this policy changes, the “Last updated” date at the top of this page will be revised. Material changes will be reflected in the application release notes.
Questions, complaints, or privacy requests about this application:
I aim to respond within 7 business days.