norua Privacy Policy

This Privacy Policy covers two different norua apps, and the openpos.site and order.openpos.site websites and the services they connect to:

• norua — the point-of-sale (POS) app used by restaurant staff to take orders and accept payments in-store. Sections 1–9 describe it.
• norua Go — the customer ordering app, used by diners to browse partner restaurants, order ahead for pickup, and follow their order. Section 10 describes it, and applies instead of Sections 1–3 for that app.

Sections 11–13 apply to both.

norua is a tool operated on behalf of the restaurant ("the merchant") that uses it. Where the merchant decides what data is collected from its customers, the merchant is the controller of that data and its own privacy terms also apply.

1. Information we collect

• Staff account information — name, email, phone number, and login credentials (PIN), used to sign in staff and control access to POS functions.
• Customer information (only where the merchant enables it) — name, phone number, and email for membership, loyalty, and order lookup.
• Sales contact information — restaurant name, restaurant address, and phone number when you submit the contact form on openpos.site.
• Order and transaction records — items ordered, amounts, taxes, tips, and payment status, used to operate the point-of-sale and produce receipts and reports.
• Payment information — card payments are captured and processed by our payment providers (Stripe, WorldPay) through their own SDKs. norua does not store full card numbers.
• Photos you choose to upload — used only to attach images to menu items.
• Device information — device identifiers and diagnostic information used to pair and license in-store devices to a merchant and to keep the service working.
• Approximate location — accessed only when a connected card reader (Stripe Terminal) requires it to authorize a payment. See Section 3.

2. Device permissions

• Camera — to scan QR codes and barcodes.
• Bluetooth & Microphone — to connect to supported card readers.
• Photo Library — only when you choose to upload a menu image.
• Location — see Section 3.

Each permission is requested only when the related feature is used, and can be managed in your device settings.

3. Why the app uses location

When a card reader is used to accept payments, our payment provider (Stripe Terminal) requires device location to help authorize the transaction and reduce fraud. If location is unavailable, card payments through that reader are disabled. norua does not use location for advertising, does not track your movements, and does not build a location profile.

4. How we use information

Information is used solely to operate the point-of-sale service for the merchant: taking and fulfilling orders, processing payments, producing receipts and business reports, managing membership where offered, responding to requests from restaurants interested in norua, and keeping devices paired and secure. We do not sell personal data and do not use it for third-party advertising.

5. Sharing

We share information only as needed to operate the service:

• Payment providers (Stripe, WorldPay) process card payments under their own privacy terms.
• The merchant that operates the POS, for its own orders and customers.
• Service providers that host and support the software, under confidentiality obligations.
• When required by law, or to protect the safety and rights of users.

6. Data security

Data is transmitted over encrypted connections (HTTPS/TLS). Card data is handled by PCI-compliant payment providers and is not stored by the app. Access to POS functions is controlled by staff login and per-store permissions.

7. Data retention

Order and account records are retained for as long as needed to operate the service for the merchant and to meet applicable tax, accounting, and legal requirements. When no longer needed, data is deleted or anonymized. Sales contact information is retained only as long as needed to respond to the request and manage the resulting business relationship.

8. Your rights

Depending on your location, you may have the right to access, correct, or delete your personal data, or to object to certain processing. Because most data is held on behalf of the merchant, requests are usually handled by the merchant that provided the app; you may also contact us using Section 13 and we will route the request appropriately.

9. Children

norua is a business tool for restaurant staff. norua Go is a general-audience food ordering app. Neither is directed to children, and we do not knowingly collect personal information from children under 13.

10. norua Go (consumer ordering app)

This section applies to norua Go, the customer app for ordering from restaurants that use norua (iOS bundle site.openpos.order, and the order.openpos.site website). Where it differs from Sections 1–3, this section governs. Each restaurant remains the controller of its own customer data, as described in the introduction.

10.1 What we collect, and why

• Phone number — you sign in with your phone number and a one-time code. It identifies your account and is attached to your order so the restaurant can reach you about it.
• Name — you provide a name for your order so staff can hand it to the right person. You can also set a name on your account profile.
• Email address (optional) — an optional field on your account profile. Signing in and ordering never require it.
• Delivery address (only if you order delivery) — collected only when a restaurant offers delivery and you choose it, and used only to deliver that order.
• Your orders — items, options, notes you write, amounts, taxes, tips and payment status, used to place and fulfill your order, to show you your order history, and to operate loyalty points where the restaurant offers them.
• Loyalty points, store credit and gift card balances — where the restaurant offers them, so balances follow your account.
• Notification token — see 10.3.
• Location — see 10.2.
• Error diagnostics — when something goes wrong (an app error, or a request to our servers that fails), the app sends us a short technical report so we can fix it. It contains the screen path, the failing request and its status code, and a request id. It excludes query strings, and credentials, email addresses and phone numbers are stripped out before the report is stored. We use it only to keep the service working.

norua Go contains no third-party analytics, advertising, or tracking SDKs. We do not track you across other companies' apps or websites, and we do not sell personal data.

10.2 Location

norua Go uses your location only when you tap "Use my location", to sort nearby restaurants by distance. Your location is never stored or shared. It is read once, held in the screen you are looking at, and never sent to our servers or written to your device's storage. The app never reads your location in the background. Declining leaves the full, searchable restaurant list and everything else working exactly the same.

The restaurant map is drawn using map tiles from a third-party provider (OpenFreeMap). When the map is shown, that provider receives the requests needed to draw the area you are viewing, and could infer your approximate area from them. We do not send it your coordinates or your identity.

10.3 Notifications

If you tap "Notify me when it's ready" on an order, your device gives us a push notification token, which we store attached to that single order so we can send you one notification when the kitchen marks it ready. The token is not used for marketing, is not shared, and is not reused for other orders — a later order requires you to turn notifications on again. It is deleted as soon as that order reaches its final state, if your device stops accepting notifications, or if you delete your account — whichever comes first. The app asks for notification permission only at the moment you tap that button, never at launch, and declining affects nothing else.

10.4 Payments

Where a restaurant accepts online payment, card details are entered on the payment processor's own secure checkout page (WorldPay, via our payments partner USezPay) and are handled under that processor's privacy terms. norua Go never sees or stores your card number. Where a restaurant does not accept online payment, you simply pay at the restaurant. Gift card, store credit and loyalty balances are held by us on the restaurant's behalf.

10.5 Sharing

• The restaurant you order from — receives your order, your name and phone number, so it can prepare your order and contact you about it.
• Payment processor (WorldPay / USezPay) — processes your card payment under its own privacy terms.
• Map tile provider (OpenFreeMap) — see 10.2.
• Apple — delivers push notifications to your device.
• Service providers that host and support the software, under confidentiality obligations, and disclosures required by law.

10.6 Retention, and deleting your account

Order records are retained for as long as the restaurant needs them to run its business and to meet tax and accounting requirements. Account details are retained until you delete your account.

You can delete your account at any time, from inside the app: Account → Profile → "Delete account" at the bottom. The same option is available on the web at order.openpos.site, on that restaurant's Account page, without installing the app. Before you confirm, we show you exactly what will be destroyed, including any remaining store credit by amount.

Deletion is real, not a hidden flag: your name, phone number, email and other personal details are irreversibly overwritten, your phone number is released, and your store credit, loyalty points and coupons are voided and cannot be recovered. Any notification token still attached to an order of yours is deleted at the same moment, so we stop contacting your device. Past order records are kept for the restaurant's accounting, but the name and phone number stored on them are erased at the same time, so those orders can no longer be traced back to you.

10.7 Your rights

Section 8 applies. The quickest route for access or erasure is the in-app deletion above; for anything else, contact the restaurant you ordered from, or us at Section 13.

10.8 中文摘要

norua Go 是顾客点餐端 App。我们收集：手机号（登录）、姓名（取餐）、可选邮箱，以及你的 订单记录与积分、礼品卡、储值余额。 定位仅在你点击「使用我的位置」时读取，只用于按距离排序附近餐厅， 不上传、不存储（地图瓦片由第三方 OpenFreeMap 提供，它会收到绘制当前视图的请求）。 推送令牌仅在你对某一笔订单点「订单好了通知我」时才获取，只绑定那一笔订单， 订单结束或你删除账号时即删除，不用于营销。 卡号在收单方（WorldPay / USezPay）的托管收银页输入，我们拿不到。 App 内无任何第三方分析或广告 SDK，不出售个人数据。 删除账号：「账户」▸ 资料 ▸ 底部「删除账号」（网站同一入口），确认前会明确 告知哪些内容会作废，包括剩余储值金额。

11. Text messages (SMS)

If you give a mobile number to a merchant that uses norua and check the box agreeing to receive text messages, we send transactional texts on that merchant's behalf about your own order or visit (order confirmation, order-ready and table-ready alerts, booking confirmations, receipts, and one-time sign-in codes). We do not send marketing texts on this program. Message frequency varies; message and data rates may apply. Reply STOP to opt out and HELP for help. We keep a record of your consent or opt-out (number, time, and the wording you agreed to) so we can honor it. Your mobile number and SMS consent will not be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging providers (for example Twilio or Amazon Web Services) process messages on our behalf solely to deliver them. Full program terms are in Section 7 of our Terms and Conditions.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

13. Contact

Restmesh Inc, 2439 152nd Ave NE, Redmond, WA 98052, United States · support@openpos.site. Questions about this policy can also be directed to the merchant that provided this app.