1. Who we are and how to reach us
POSse is a platform for hospitality venues: QR menus, table booking, pickup orders, ordering and payment at the table, email campaigns. The platform website is getposse.app, the venue panel is getposse.app/admin, and each venue's menu lives on a subdomain such as name.psse.me or on the venue's own domain.
Platform operator: sole proprietor (FOP) Yehor Kupriienko, Ukraine, Kyiv, 30 Yerevanska St., tax ID 3588911091. For anything about personal data, write to privacy@getposse.app.
This policy is written in plain language. Where the law needs precise wording, it is there; where a short sentence will do, we use one.
2. In short: three roles, three groups of people
We handle data about three groups of people, and our role differs for each.
Visitors of getposse.app and venue administrators: for their data we are the controller (the data owner under Ukrainian law). We decide what we collect and why, and we answer to you directly.
Guests of venues — people who open a menu, book a table, order pickup, pay at the table or receive a campaign email: for their data the venue is the controller, and we are the processor acting on the venue's instructions under the data processing addendum to our Terms. The venue decides which modules to switch on, which integrations to connect and whom to email; we do it technically.
The practical rule that follows: a guest who wants to access, correct or delete their data contacts the venue and sends us a copy of the request. We help the venue answer and do not hold things up.
3. Visitors of getposse.app
The request forms on the website ("Leave a request", the pop-up, the contact page form) send what you typed — name, phone or other contact, your question, venue type, your POS and bank if you named them — to our internal Telegram chat. Requests are not written to a database: they exist only in that chat until we delete them. Basis: our legitimate interest in answering you, and your act of pressing "send".
Website analytics: PostHog (servers in the European Union) and Google Analytics 4. Until you answer the cookie banner, no cookies are set, no session recording runs and Google Analytics is not loaded; in this mode PostHog counts page views and clicks in the tab's memory, with no identifier that survives closing the browser. After "accept", PostHog and Google Analytics set their cookies and PostHog starts session recording (movements and clicks on the page, never the contents of input fields). After "decline", everything stays as before the answer. Details are in the section "Cookies and analytics".
Panel sign-in: the page getposse.app/sign-in takes an email address for a sign-in link, or sign-in with Google. We neither store nor ask for passwords.
4. Venue administrators
What we keep: your email address, your name (if you entered it or it came from Google), your role at the venue, invitations, the panel language you chose, and a flag if you opted out of our single marketing email. Sign-in is by one-time email link or with Google; the session is kept in Supabase Auth cookies.
Why: so you can manage the venue, so we can email you about the state of the account (confirmation, end of trial, payment, arrears, suspension), and once — on day three — offer help. Basis: the contract (our Terms) and our legitimate interest in maintaining the account; the help email rests on legitimate interest, with a one-click opt-out link in the email itself.
Subscription payments run on Stripe: card details are entered on Stripe's pages and never reach us. We keep the Stripe customer and subscription identifiers, the plan, the billing period and the next charge date. Stripe receives the account name and the owner's email.
Venue data you publish (name, address, phone numbers, opening hours, menu, photos, Wi-Fi password, social links) becomes public on the venue page — that is your decision as the venue owner. Integration keys (POS, acquiring, Meta Pixel, Google Analytics) are stored encrypted and used only by the server.
5. Guests of venues
Who the controller is: the venue whose menu you opened. It is named in the page header and footer, and its phone number is in the "About" block. We process your data on the venue's behalf.
Browsing a menu without a request: your device gets a random identifier (in the browser's local storage) and a tab identifier; with them, the events "opened menu", "opened dish", "added to favourites" and "added to cart" go to the server. Your IP address and browser version are not stored. From these events the venue sees view statistics and popular dishes; the identifier is not linked to your name, but it is a pseudonymous identifier, not an anonymous one. Basis: the venue's legitimate interest in menu statistics without advertising trackers.
Table booking: name, phone, email (if given), date, time, party size, comment, and the language you filled the form in. Pickup: name, phone, email (if given), order contents, time, comment. Ordering and the bill at the table: order contents, table, amount; name and phone only if the venue asks for them. Basis: the contract between you and the venue (booking, order) and its legitimate interest in receiving the request.
Where request data goes: to the venue — into its panel and its Telegram chat (the notification contains name, phone, email and comment), to the venue's POS if connected (Poster receives phone, name, email and comment; iiko or Syrve receive phone and name), and to you — as an email about the request, if you gave an email address.
Paying at the table or prepaying a pickup order: the payment page belongs to the venue's acquirer (monobank, Multicard, LiqPay); the full card number is entered there and never reaches us. We receive and keep the amount, currency, status, the acquirer's payment identifier, a receipt link and the technical payment notification exactly as the acquirer sends it — it may contain a masked card number and the payer's name. We do not pass your name or phone to the acquirer. Tips are part of the payment amount.
The "Guests" database and campaigns: from your requests the venue gets a record about you (name, phone, email, language, request history). The venue may send you emails about itself in the language you used for the request. No separate marketing consent is asked for at the request form: sending is allowed only to the venue's own guests and only about its services, and every email carries an unsubscribe link that works in one click and is understood by mail clients (List-Unsubscribe header). If an email bounces or you report it as spam, we mark you as unsubscribed automatically. Campaigns are sent through our email service Resend on the venue's behalf from our address; replies are not read — the venue's phone number is in the email.
The venue's analytics and advertising: if the venue has switched on Meta Pixel or Google Analytics 4, they load only after you press "Accept all" in the banner. Then Meta and Google receive your IP address, browser details and their cookies directly, and our server mirrors events (view, add to cart, purchase, booking) to Meta: with the IP address, browser version, Meta cookies and a hash (a non-reversible fingerprint) of the device identifier; on purchases and bookings — with hashes of the email, phone and name that Meta matches against its users. Raw email, phone and name never go to the pixel. The pixel and the counter belong to the venue; it is responsible for the lawfulness of its advertising. If you press "Reject all", these services do not run at all.
The map on the venue page is an embedded Google map; when it loads, Google receives your IP address and may set its cookies. Details are in the section "Cookies and analytics".
Your rights as a guest: contact the venue (the controller) by the phone number or address on its page, and send a copy to us at the address in section 1. We answer the venue and you within 30 days and delete or correct data on the venue's instruction. You can unsubscribe from campaigns with the link in any email, with no request needed.
6. Who we share data with and in which countries
Our sub-processors (serving every venue and us): Vercel — application hosting, London, United Kingdom; Supabase — database, files (venue photos and videos) and panel sign-in, London, United Kingdom; Stripe — venue subscriptions (Ireland; card processing under Stripe's rules); Resend — email sending and delivery reports; PostHog — website analytics (European Union); Google — website analytics (only with consent), menu text translation, venue data for the rating, and the map; Telegram — the notification channel for venues and for website requests. Each works under its own data processing agreement; current links are available on request and in the data processing addendum to the Terms.
Integrations the venue connects itself (its sub-processors, for which the venue is responsible): the POS systems Poster (Ukraine), iiko (servers in Kazakhstan) or Syrve (servers in the European Union) — the venue chooses which to connect; the acquirers monobank and LiqPay (Ukraine), Multicard (Uzbekistan); Meta Pixel and Google Analytics 4 (United States and European Union under the terms of Meta and Google); the venue's own Telegram chat.
Where data is stored: in the United Kingdom (database and application); guest data of venues in Kazakhstan and Uzbekistan is also kept in a local database on the territory of the respective country (sections 14 and 15). For venues and guests from the European Union: the European Commission has found the United Kingdom's data protection adequate (adequacy decision of 2021, extended in 2025), so the transfer needs no separate safeguards; transfers to the United States (Stripe, Resend, Meta, Google) rest on standard contractual clauses and the EU–US framework in those companies' agreements. For Ukraine: the United Kingdom and EU countries are parties to Convention 108, so the transfer is permitted. For Kazakhstan, Uzbekistan and Kyrgyzstan see sections 14–16.
7. How long we keep data
Website requests are not written to a database and live in our internal chat until deleted by hand.
Administrator account data — as long as the account exists. A venue whose trial ended without payment may be archived no sooner than 14 days later: its pages close, its data is kept until the venue is deleted. You can ask for deletion of an account or a venue at the address in section 1.
Guest data (requests, orders, the "Guests" database, campaign recipients) — without a time limit: while the contract with the venue lasts and after it ends, until the venue is deleted at the Client's request (section 13 of the Terms) or on our initiative. The venue may delete a guest earlier at the guest's request.
Payments and subscription data — while the contract lasts and afterwards for the periods set by accounting law and limitation periods (in Ukraine, at least three years).
Menu view events and likes, the email send log and campaign delivery reports — until the venue is deleted. We are working on automatic deletion of events older than 24 months and of the email log older than 12 months; when it ships, the period will be stated here.
Cookies and browser storage — see the periods in section 11.
8. How we protect data
Connections to the website, the panel and menus are HTTPS only. Each venue's data is isolated: at the application level every operation is limited to the venue it acts for, and at the database level access policies are additionally enabled on every table; isolation is verified by automated tests on every release.
Venues' POS, acquiring and advertising keys are stored encrypted (AES-256-GCM) and decrypted only on the server at the moment of use. Notifications from Stripe, Resend, Telegram and the acquirers are accepted only with a verified signature. Panel sign-in has no passwords: a one-time link or Google.
The platform operator has database access for support and maintenance. If an incident affects guest data, we notify the venue within 48 hours of learning about it and help it notify the supervisory authority and the guests where the law requires.
9. Your rights and how to use them
You may learn what data we hold about you, get a copy, have it corrected or deleted, restrict processing, object to processing based on legitimate interest, withdraw consent (without affecting processing before the withdrawal) and, in the European Union, receive your data in a machine-readable form.
Website visitors and administrators write to us at the address in section 1. We answer within 30 days; in complex cases we may extend this by two more months and will tell you. To verify an administrator's identity we use the account's email address.
Guests contact the venue as the controller and send us a copy — that gets the request done faster. If the venue does not answer, write to us: we will contact it and help.
To unsubscribe from a venue's emails, use the link in the email. To opt out of POSse's help email, use the link in that email.
10. Children
The venue panel and the website are for businesses and adults. Guest menus, booking and pickup are available from the age of 16; younger guests only with a parent or guardian. We do not verify age and do not knowingly collect children's data; if you know that a child left data without parental consent, write to us and we will delete it together with the venue.
11. Cookies and analytics
This section is the single cookie document for the website getposse.app, the venue panel and every guest menu on psse.me and on venues' own domains. The "Learn more" link in the consent banner on a venue page leads here.
Venue panel (getposse.app/admin): Supabase Auth sign-in session cookies (sb-…-auth-token) — for the life of the session; posse-locale — panel language, one year; active_location — the selected venue, until the browser closes; poster_oauth_state — protection of the Poster POS connection, 15 minutes. All of these are strictly necessary cookies; no consent is needed, and the panel does not work without them.
Website getposse.app: your banner answer is kept in the browser's local storage (posse-site-consent) and is not a cookie. Until you answer, no analytics cookies are set. After "accept": PostHog cookies (ph_…, up to one year), Google Analytics cookies (_ga, _ga_…, up to two years) and PostHog session recording. After "decline": nothing beyond minimal statistics in the tab's memory. The banner is shown once; to change your choice, clear the site data for getposse.app in your browser settings and the banner returns.
Guest menu (name.psse.me or the venue's domain) — strictly necessary: the cart and "my order at the table" in tab storage (resta:cart…, resta:table-order…, resta:table-pay…), the banner answer (resta:consent), the guest's favourites (resta:favs…, four hours). Venue statistics without trackers: the device identifier resta:did (local storage, until cleared) and the tab identifier resta:sid — see section 5. None of these keys is a cookie, and none is shared with third parties.
Guest menu — with consent: if the venue has switched on Meta Pixel or Google Analytics 4, you see the "Cookies and analytics" banner. Until you answer, the scripts are not loaded. "Accept all" loads Meta Pixel (cookies _fbp, _fbc, 90 days) and/or Google Analytics (_ga, _ga_…, up to two years), and our server starts mirroring events to Meta (section 5). "Reject all" — they never run. The choice is stored separately for each venue, because each has its own menu and its own banner. If the venue has no trackers, no banner is shown.
The Google map on the venue page loads with the page, without a banner: it is an embedded map, and when it loads Google receives your IP address and may set cookies under its own policy. If you do not want that, do not scroll to the map block — the map loads as you scroll towards it — or block third-party cookies in your browser.
Changing your choice in a guest menu: clear the venue site's data (cookies and storage) in your browser settings — the banner appears again on the next visit. There is no separate button yet; we plan one.
12. Complaints and supervisory authorities
Write to us first — most questions are settled with one reply. If you believe that we or a venue violate your rights, you may complain to the data protection authority of your country: in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in EU countries, the national data protection authority (the list is on the website of the European Data Protection Board); in Kazakhstan, the Information Security Committee of the Ministry of Digital Development; in Uzbekistan, the State Personalization Center under the Cabinet of Ministers; in Kyrgyzstan, the State Agency for Personal Data Protection. The supervisory authority at the operator's place of registration: the Ukrainian Parliament Commissioner for Human Rights.
13. For venues and guests in Ukraine
The Law of Ukraine "On Personal Data Protection" applies. The venue is the owner of guests' personal data; POSse is the manager (processor) under contract. Processing rests on contract and legitimate interest; a venue's commercial electronic messages are permitted as long as each message offers a way to refuse further messages (Law "On Electronic Commerce"). Requests from data subjects are answered within 30 days. Cross-border transfer to the United Kingdom and EU countries is permitted: they provide adequate protection as parties to Convention 108.
14. For venues and guests in Kazakhstan
The Law of the Republic of Kazakhstan "On Personal Data and Their Protection" applies. The venue owns its guests' data; POSse is the person entrusted with processing. Personal data of guests of venues in Kazakhstan is collected and stored in a database on the territory of the Republic of Kazakhstan; to run the platform (menus, booking, orders, campaigns) it is also processed in our main infrastructure in the United Kingdom. By connecting POSse the venue entrusts such cross-border processing and obtains the guest's consent to transfer data abroad in electronic form — as text under the booking and order forms. In case of a breach the venue, as the owner, notifies the authorised body within the statutory period; we notify the venue within 48 hours. Data requests are handled within the periods set by Kazakhstan's legislation on appeals.
15. For venues and guests in Uzbekistan
The Law of the Republic of Uzbekistan "On Personal Data" applies. Personal data of Uzbek citizens is collected, systematised and stored in a database on the territory of the Republic of Uzbekistan; to run the platform it is also processed in our main infrastructure in the United Kingdom. The venue, as owner of the personal data database, entrusts such processing, obtains the guest's consent to cross-border transfer as text under the booking and order forms, and registers the database in the State Register where the law requires it. POSse does not replace the venue in these duties. Marketing emails to guests in Uzbekistan should be sent only with the guest's explicit consent.
16. For venues and guests in Kyrgyzstan
The Law of the Kyrgyz Republic "On Personal Information" applies. The venue is the holder of the guests' data array; POSse is the processor under contract. Cross-border transfer to the United Kingdom and EU countries is permitted as transfer to states providing adequate protection; as an additional safeguard the venue obtains the guest's consent as text under the form. Registration of the holder of a personal data array is the venue's duty.
17. Changes to this policy
The revision date is at the top of the page. We announce material changes to venue administrators by email at least 14 days in advance; guests are informed by the updated date and, when the set of trackers changes, by the consent banner being shown again.