Privacy Policy

From Square, once you connect your account:

• Your Square merchant ID, business name and the email address on the account.
• Your locations — name, address and timezone.
• Your catalogue items and their stock counts.
• An access token for your Square account, so we can keep the above in sync.

From you, as you use the product:

• Waste and stock movements you log — the item, quantity, reason and cost.
• Recipes and their ingredients, quantities, units, costs and selling prices.
• Per-item costs and reorder points you set.

Our servers also keep ordinary technical logs of requests — timestamps, paths, status codes and browser user-agent — which we use to diagnose faults. They are not used to build a profile of you.

• Your Square password. The connection uses OAuth, so we never see it.
• Your customers' personal information.
• Your sales, orders or transaction history.
• Your payment card number. Stripe handles billing and we only store the customer reference it gives us.

Only to run the product for you: showing your stock levels, costing your waste and recipes, producing your reports, keeping Square in sync, and managing your subscription. We also use your email address to contact you about the service — a failed payment, a change to these terms, or a fault affecting you.

We do not use your data to train machine-learning models.

• Data is stored in Sydney, Australia (AWS ap-southeast-2).
• Square access tokens are encrypted at rest. They are never displayed back to you or written to logs.
• All traffic between your browser, our servers, Square and Stripe uses HTTPS/TLS.
• Incoming webhooks from Square are rejected unless their HMAC-SHA256 signature verifies.
• Your session is held in a signed, HttpOnly cookie, so it is not readable by scripts in your browser.

We use these providers to run the service. Each sees only what it needs, and none of them receive your data for their own marketing.

• Square — the source of your catalogue, inventory and locations.
• Stripe — subscription billing and card processing.
• Supabase — the database holding your data.
• Render — the servers running the application.
• Vercel — serving the web interface.

We do not sell, rent, or share your data with anyone for advertising.

When your trial or subscription ends, your account becomes view-only for 30 days: you can still sign in and see your data, but you cannot add, edit or delete anything. Your data is kept for that whole period and is not deleted before it ends. Exporting your data requires an active subscription.

We keep your data for as long as your account exists. Ask us to delete it and we will.

Ask us from the address on your account. We will delete your data, including the stored Square token, within 30 days and confirm when it is done. Email support@conceptr.com.au.

To be straightforward about it: this is a manual process, not a button in the app. There is no self-serve disconnect or delete control yet, and we would rather say so than describe one that does not exist. You can revoke our access to your Square account at any time from your Square dashboard, which stops us reading anything further — that does not by itself delete what we already hold, so tell us as well if that is what you want.

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. We handle personal information in line with the Australian Privacy Principles. If you are unhappy with how we have handled a request, you can complain to the Office of the Australian Information Commissioner.