1. Who we are and our two roles
Tillmora is provided by Tillmora ("Tillmora", "we", "us"). We have two roles:
- We decide how data is used (controller) for: restaurant owners and their staff's logins, people who contact us, visitors to tillmora.com, and guests' Tillmora accounts (the login a guest uses at every Tillmora restaurant).
- We process data for a restaurant (processor) for: the details of each restaurant's guests and staff that the restaurant keeps in Tillmora, such as orders, bookings and delivery addresses. The restaurant decides why they're collected, and its own privacy policy (at its address on tillmora.com, under Privacy) explains it. Our Data processing terms set out what we do for restaurants.
2. What we hold
About owners and staff
- Names, login emails, roles and which branches each person works at.
- How each login signs in: a password (as a secure hash only), passkeys (their public key, name and when they were added and last used), linked Google or Apple accounts (the email, name if allowed, and an account number they give us).
- Staff PINs, only as a secure hash, never the PIN itself.
- What people do in Tillmora that's recorded for your audit: voids, discounts, refunds, setting changes, with who and when.
About your business
- Menus, orders, bills, payments' outcomes, shifts, stock, settings and reports.
About guests, for each restaurant
- What they order, and a name, mobile, email or delivery address only when they or staff give it.
- Table bookings: name, mobile, email if given, party size, day and time, and what they tell the restaurant (an occasion, allergies or dietary needs, a note).
- Meal bookings: the meals and days chosen, contact details and a delivery address if delivered.
- Deliveries: the address and map pin, notes for the driver, a photo at the door if the restaurant uses them, and the driver's location while the order is on its way (shown to that guest).
- Whether they agreed to hear the restaurant's news, kept per restaurant.
Guests' Tillmora accounts
The email a guest signs in with and the restaurants they've used it at. Each restaurant sees only its own visits; details, allergies and choices about news are kept per restaurant.
About devices
- App version, device type, printer and sync state, and errors, so we can keep Tillmora working and help when asked.
3. Why we use it
- To provide Tillmora: run your tills, back office and guests' pages, and send the emails restaurants' guests expect (confirmations, receipts, reminders).
- To keep accounts and payments safe and to stop abuse and fraud.
- To help when you ask, and to fix problems.
- To bill subscriptions and meet our legal duties (tax, accounting, lawful requests).
- To improve Tillmora, using what devices report and how features are used, not the content of guests' orders.
We do this because it is needed to provide the service you asked for, to meet legal duties, or for our legitimate interest in running a safe and working service; where the law needs consent (such as a guest's choice to hear a restaurant's news), we ask for it. We don't sell personal data, and we don't use guests' details for our own marketing.
4. Ask Tillmora
Ask Tillmora answers questions using your restaurant's data and Tillmora's manual. To answer, the question and only the data needed for it, limited to what the person asking may see, are sent to Google's Gemini API, under Google's paid-service terms, which don't allow Google to use them to train its models. That data is names of dishes, categories, branches, tables and staff, amounts, counts and dates. It is never guests' names, phone numbers or emails, tax numbers, addresses, PINs, payment references or notes typed by staff.
We don't keep questions or answers. We record who asked, when, and the kind and topic of the question, so the owner can see how it's used. If someone taps 👎 and chooses to send the question to us, we keep that question and answer for 30 days to fix the mistake. The owner can turn off questions about the restaurant's data in Settings › Ask Tillmora.
5. Signing in
Passkeys: your face, fingerprint or screen lock never leave your device; we keep only the passkey's public key. Google and Apple tell us your email (Apple may give a private relay address), your name if you allow it, and an account number; never your password or anything else from those accounts. Emailed codes work once and for a short time. Each way to sign in that's added to or removed from your login is emailed to you.
6. Help requests and support access
When you ask us for help, we keep what you write and our replies while your account is open. The app adds the page you were on, its version, your device and branch and recent errors (from a till, also its printers and sync state), never orders, bills or guests' details. Pictures, videos and PDFs you send are stored privately, open only to you, your restaurant's owners and admins, and Tillmora support, through links that work for 10 minutes, and are deleted 90 days after the request is solved. Replies may be drafted for our team with an AI model from your request and our manual; a person always checks and sends them.
Tillmora support sees your back office only when the owner allows it (for 24 hours or 7 days), and everything support views or does is listed for you. In an emergency, access is limited, recorded and shown to you.
7. Payments
Subscriptions are paid through Stripe, or Razorpay in India; they hold your card or mandate, and we receive the outcome and the last digits. When a restaurant takes payments through its own Stripe or Razorpay account, the guest's card details go straight to the provider; Tillmora receives the amount, whether it was approved, the card type and its last four digits.
8. Our website
tillmora.com uses no analytics or advertising trackers. Pages are served through Cloudflare, which sees visitors' network addresses to deliver and protect the site. Fonts are loaded from Google Fonts, so your browser contacts Google. Guests' ordering pages use Google Maps for delivery addresses, and Cloudflare Turnstile to check that a person is ordering or booking; to stop abuse, a network address is kept only as a scrambled code for a day. What the browser stores is in Cookies.
9. Who we share it with
Only with the providers that run parts of Tillmora for us, listed with what they do and where on Sub-processors; with a restaurant, for its own guests and staff; with payment providers as above; and with authorities when the law requires it. If Tillmora's business is sold or reorganised, data passes to the new owner under this policy, and we will tell you.
10. Where it is stored
Tillmora's database is hosted by Supabase in Mumbai, India, and the service that keeps tills in sync runs in India. Some providers process data in other countries (see Sub-processors). When data moves across borders, we rely on the protections the law asks for, such as standard contractual clauses, and on our providers' security commitments. Each till also keeps an encrypted copy of its own branch's data.
11. How long we keep it
- Your account's data: while the account is open. When an owner closes the account (through Help), we keep it for 90 days so it can be downloaded or the account restored, then delete it, except records we must keep by law (such as our own billing records).
- Bills and payments: restaurants keep them as long as their tax law requires; when a guest is erased, their name comes off and the bill stays.
- Guests' details: until the restaurant or the guest removes them, or the restaurant's account is deleted.
- Help attachments: 90 days after the request is solved; Ask Tillmora feedback: 30 days; abuse checks: a day.
- Backups: daily backups expire on our database provider's schedule.
12. How we protect it
Data is encrypted in transit and at rest; each till's copy is encrypted with a key that never leaves the device; restaurants are kept apart in the database; sign-in supports passkeys and two-step; and access by our team is limited, recorded and, for your back office, only with your permission. More on Security. If a breach puts people at risk, we tell the restaurants affected, and the authorities and people affected where the law requires, without undue delay.
13. Your rights
Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, get a copy to take elsewhere, object to or limit how we use it, and withdraw consent you gave. Guests asking about a restaurant's records should ask that restaurant; restaurants erase a guest in their back office (Guests › Erase guest), and guests with a Tillmora account can download their details, leave one restaurant or delete the account under Details when signed in. For anything else, contact us (below). We answer within the time the law sets, usually within 30 days.
- Australia: the Privacy Act 1988 and the Australian Privacy Principles. You can complain to the OAIC (oaic.gov.au).
- India: the Digital Personal Data Protection Act, 2023. You can raise a grievance with us first and then the Data Protection Board of India.
- UK and EU: the UK GDPR and the GDPR. You can complain to the ICO (ico.org.uk) or your local data protection authority.
- New Zealand: the Privacy Act 2020 (Office of the Privacy Commissioner). Canada: PIPEDA. Singapore: the PDPA. UAE: the PDPL. United States: the privacy laws of your state, where they apply; we don't sell or share personal data for advertising.
14. Children
Tillmora is for businesses. Guests' pages aren't directed at children, and we don't knowingly collect children's data except as part of an order or booking made by an adult.
15. Changes
We update this policy when what we do changes, with the date at the top. For a material change, we email account owners before it applies.
16. Contact
Write to support@tillmora.com with "Privacy" in the subject, or use Help in the app.