1. Parties and definitions
This document is an offer to enter into a contract for the use of the POSse platform. It is addressed to a venue: a restaurant, café, bar, dark kitchen or other food-service business represented by a sole proprietor or a legal entity (the "Client"). The platform is intended for business use; consumer protection rules do not apply between the parties.
Provider: sole proprietor (FOP) Yehor Kupriienko, Ukraine, Kyiv, 30 Yerevanska St., tax ID 3588911091 ("POSse", "we").
The platform is the website getposse.app, the management panel getposse.app/admin and the venue's guest pages on a subdomain such as name.psse.me or on the Client's own domain. A Guest is a visitor of the guest pages: someone who views the menu, books a table, orders pickup, orders or pays at the table. An Administrator is a person the Client has given access to the panel. The Privacy Policy is the document at getposse.app/privacy and forms part of this contract.
2. Subject and acceptance
We give the Client access to the platform on a subscription basis: the Client creates a venue in the panel, fills in the menu and switches on the modules it needs; we publish the guest pages, receive guests' requests, send notifications and emails, and maintain the integrations.
The offer is accepted by registering in the panel and creating a venue, or by paying for a subscription, whichever comes first. From that moment the contract is concluded on the terms of this edition. By registering, the Administrator confirms that they are authorised to act for the Client.
The contract is concluded electronically and needs no paper copy or signatures. On request we will provide the Client with the current edition of these Terms as a file.
3. Plans, trial and payment
The plans and prices are published at getposse.app/pricing, which forms part of the contract. The plan determines which modules and limits the venue gets (number of dishes, languages, campaign emails per month, POS systems, acquiring, own domain). A free plan exists and requires no payment.
A new venue gets a 14-day trial on a paid plan, no card required. If the trial ends without payment, the guest pages show "temporarily unavailable" and are excluded from search indexing; the panel and the data are kept, and the subscription can be paid at any time.
Payment is by bank card through Stripe for a period of one month, three months, six months or one year. Card details are entered on Stripe's pages and are not passed to us. The subscription renews automatically for the same period until the Client turns off renewal in the Stripe portal (the "Manage subscription" button in the panel). Invoices and receipts are issued by Stripe.
A plan change takes effect immediately; on a downgrade, modules not included in the new plan are switched off and their settings are kept. Manual access (payment by invoice for a fixed term) is arranged separately and set up in the panel by us.
4. Renewal, cancellation and refunds
The Client may cancel the subscription at any time; access continues until the end of the paid period, after which the guest pages show "temporarily unavailable" until the Client resumes the subscription or moves the venue to the free plan in the panel — then modules, languages and the domain outside the free plan are switched off and the data is kept.
Fees for a paid period are not refunded, including when the subscription is cancelled before the period ends: cancellation stops the next charge. The only ground for a refund is unavailability of the platform through our fault: if the platform was unavailable through our fault for more than 24 consecutive hours during a paid period, the Client may request a pro-rata refund for the days of unavailability or an extension for the same length of time.
The Client reports disputed charges to us by email first; we reply within 5 business days.
5. Non-payment, suspension and termination
If a charge fails, Stripe retries it; access continues for 3 days and we email the Administrators about the arrears. After that the subscription is treated as cancelled: the guest pages show "temporarily unavailable", the panel and the data are kept. The subscription can be resumed in the panel at any time.
A venue whose trial ended without payment may be archived no sooner than 14 days later: its pages close, the subdomain stays with the Client, the data is kept. Restoration is available on request.
We may suspend access immediately for a breach of section 8 (unlawful content, spam to guests, infringement of third-party rights), notifying the Administrators by email with the reason. The Client may terminate the contract at any time by ceasing use and requesting deletion of the venue (section 13).
6. Account and Administrators
Panel sign-in is by one-time email link or with Google; there are no passwords. The Client is responsible for whom it grants access to and for the actions of its Administrators. The venue owner can invite and remove Administrators in the panel.
The Client undertakes not to pass access to third parties outside its organisation, not to use the platform for other venues without their knowledge, and to tell us about any suspected unauthorised access.
7. What the platform does
Guest pages: the venue's home page and menu with photos, prices, translations into the chosen languages, a gallery, banners and the Google rating. Requests: table booking, pickup with or without prepayment, ordering and the bill at the table via QR code, tips. Notifications to the venue: in the panel, in its Telegram chat, and an email to the guest about the request. The guest database and email campaigns on the venue's behalf. The venue's own domain. Integrations with POS systems and acquirers (section 9).
The address of the guest pages is the subdomain name.psse.me; it is also what gets printed in QR codes and email links, so that a printed QR keeps working. The Client's own domain is connected on top of the subdomain and answers by redirect from it while the domain is active and the plan allows it.
We may change the composition and appearance of modules as long as this does not materially reduce their functions; we warn the Administrators by email about material changes affecting guests or integrations.
8. Obligations of the Client
Content. The Client is responsible for everything it publishes: accuracy of prices and dish contents, allergen labelling where the law of its country requires it, lawfulness of sales (alcohol, tobacco), rights to photos, logo and texts. We do not review menus and are not liable to guests for their contents.
Guests and their data. The Client is the controller (owner) of its guests' personal data; we process it on the Client's behalf under Annex 1. The Client must inform guests about processing as required by the law of its country (we provide the privacy policy for this and, on request, a text for the request form), fulfil guests' requests for access, correction and deletion, and obtain guests' consent to cross-border transfer where the law of its country requires it (Kazakhstan, Uzbekistan, Kyrgyzstan — see the policy).
Campaigns. The platform does not ask the guest for a separate marketing consent. The Client may therefore email only guests who themselves left a contact when booking or ordering, only about the venue's own services, and with the unsubscribe link kept in every email; in countries where the law requires explicit consent to marketing email (including Uzbekistan, Kazakhstan for some channels, Germany and other EU countries for people who were not customers), the Client obtains such consent itself before sending. The Client does not use campaigns for third-party advertising, deception or content prohibited by law. We technically do not send emails to those who unsubscribed.
Advertising and analytics. By connecting Meta Pixel or Google Analytics the Client acts as the controller of that processing and is responsible for complying with the terms of Meta and Google and the cookie law of its country; we ensure these scripts run only after the guest's consent in the banner.
Telegram notifications. The Client itself chooses the chat or group that receives guests' requests with their name, phone and email, and is responsible for the members of that chat.
POS systems and acquirers. The Client connects them with its own credentials under its own contracts with those services and itself chooses the POS cloud (iiko — servers in Kazakhstan, Syrve — in the European Union), understanding where guest data goes as a result.
Registers and regulator notifications. Where the law of the Client's country requires registration of a personal data database or notification of the authority about processing (Uzbekistan, Kyrgyzstan), the Client does this as the owner of the database. The Client notifies its supervisory authority of a breach affecting its guests within the period set by its law; we provide it with the information under section A-8.
It is prohibited to use the platform to break the law, send spam, host malicious code, attempt to access other venues' data or run load attacks.
9. Third-party services
The POS systems Poster, iiko and Syrve, the acquirers monobank, Multicard and LiqPay, Meta, Google, Telegram and Stripe are independent services with their own terms. We are not liable for their availability, fees, account blocks or API changes; when their terms change we adapt the integration within a reasonable time or announce its discontinuation.
Guests' online payments run between the guest and the Client through the Client's acquirer; we are not a party to the payment, we do not receive guests' money and we do not make refunds — the Client does that in the acquirer's dashboard. We display the payment status based on the acquirer's notification.
10. Intellectual property
The platform, its code, design and the POSse trademark belong to us. The Client receives a non-exclusive right to use the platform for the term of the contract within its plan.
The venue's content (menu, texts, photos, logo, domain) belongs to the Client. The Client grants us the right to display it on the guest pages, in emails to guests and in notifications, to translate menu texts into the chosen languages, and to show the venue's name and logo in the client list on the website until the Client asks us to remove them. The Client may edit translations made by the platform; the rights to them belong to the Client.
The footer of the guest pages contains a "POSse" link to the platform website.
11. Availability and limitation of liability
We aim for uninterrupted operation but do not guarantee it: planned maintenance (announced, at night in the venue's local time where possible) and outages at our suppliers are possible. We are not liable for lost profit, lost orders and bookings, incorrect guest requests or indirect losses.
Our aggregate liability to the Client under the contract is limited to the amount the Client paid in the last 12 months and, on the free plan, does not arise, except in cases of intent or gross negligence and where the law prohibits such a limitation.
The Client indemnifies us against losses from third-party claims (guests, rights holders, regulators) caused by the Client's content, its campaigns, its advertising or its breach of personal data law.
12. Data and confidentiality
Processing of Administrators' personal data is described in the Privacy Policy. Processing of guest data on the Client's behalf is governed by Annex 1 (A-1 to A-11), which forms part of the contract and has the effect of a data processing agreement under Article 28 GDPR and the corresponding provisions of the laws of Ukraine, Kazakhstan, Uzbekistan and Kyrgyzstan.
The parties keep each other's unpublished information confidential: the Client — information about the platform not obtained from public sources; we — menus before publication, the venue's statistics and settings, and its integration keys.
13. Termination, export and deletion of data
The Client may at any time export the guest database as CSV from the panel ("Guests → Export") and download QR codes and table plates. Menus and photos remain available in the panel as long as the venue exists.
At the Client's request to the address in section 16 we delete the venue entirely — menus, photos, requests, orders, payments, guests, campaign recipients, integrations — within 30 days of the request; absent a request, the venue's data and its guests' data are kept without a time limit; records we need for accounting and defence against claims (subscription, payments) are kept for the periods set by law. We may delete a venue that has not paid for a subscription and does not use the platform on our own initiative, having warned the Administrators by email at least 30 days in advance.
We may terminate the contract with 30 days' notice, and immediately for a breach of section 8.
14. Changes to these Terms
We may change these Terms and the plans. We notify the Administrators of material changes (prices, plan composition, refund terms, Annex 1) by email at least 14 days before they take effect; new prices apply from the next paid period. Continued use after the changes take effect means acceptance; a Client who disagrees may terminate the contract before that date, and the previous edition applies to it until the end of the paid period.
15. Governing law and disputes
These Terms are governed by the law of Ukraine. The parties first settle disputes by negotiation by email; if no agreement is reached within 30 days, the dispute is referred to the court at the Provider's location in accordance with the legislation of Ukraine, unless mandatory rules of the Client's country provide otherwise.
Before going to court the parties try to settle the dispute by correspondence within 30 days.
16. Provider details and contacts
Provider: sole proprietor (FOP) Yehor Kupriienko, Ukraine, Kyiv, 30 Yerevanska St., tax ID 3588911091. Contract matters: hello@getposse.app. Personal data matters: privacy@getposse.app.
Annex 1. Processing of guests' personal data on the Client's behalf (DPA)
A-1. Roles and subject matter. The Client is the controller (owner) of guests' personal data; POSse is the processor acting on the Client's documented instructions. The instructions are the panel settings: enabled modules, integrations, campaigns, languages, texts. This Annex applies for the term of the contract and until deletion of data under A-10 is complete.
A-2. Nature, purposes, data and subjects. Purposes: publishing the menu, receiving bookings and orders, the bill and payment at the table, notifications to the venue and the guest, menu statistics, the guest database and campaigns. Subjects: the venue's guests and visitors of its pages. Categories of data: name, phone, email, language, comment, date and time of the visit, order contents and amount, payment status and technical payment details from the acquirer, a device identifier for statistics, advertising cookie identifiers with the guest's consent, and the facts of delivery, opening and unsubscribing from emails. The platform does not ask for special categories of data.
A-3. Instructions. We process data only for the purposes in A-2 and only as configured by the Client. If, in our view, a Client's instruction breaks the law, we tell the Client and may suspend carrying it out. We do not use guest data for our own marketing and do not pass it to third parties other than the sub-processors under A-6 and the recipients chosen by the Client.
A-4. Confidentiality. Within POSse, guest data is accessible only to people who need it to support and maintain the platform and who are bound by a confidentiality obligation.
A-5. Assistance with data subject rights. A guest's request that reaches us is forwarded to the Client within 3 business days and, on the Client's instruction, we provide, correct or delete the guest's data within 30 days. Unsubscribing from campaigns is carried out automatically without the Client's involvement. We assist the Client with data protection impact assessments and consultations with the supervisory authority using the information about processing in this Annex and the policy.
A-6. Sub-processors. We engage the sub-processors listed in section 6 of the Privacy Policy (hosting, database and files, email, subscription payments, website analytics, translation, notification channel) under written agreements with them that provide protection no lower than this Annex. We notify the Administrators by email at least 14 days before adding or replacing a sub-processor; the Client may object within that period and, if no solution is found, terminate the contract with a refund for the unused period. Services connected by the Client itself (POS systems, acquirers, Meta, Google, the Telegram chat) are not our sub-processors: they are recipients chosen by the Client, and the Client is responsible for them.
A-7. Security measures. HTTPS on every page; isolation of venues' data at the application level and through database access policies, verified by automated tests; encryption of integration keys (AES-256-GCM); signature verification of incoming notifications from Stripe, Resend, Telegram and the acquirers; password-less panel sign-in by one-time link or Google; data storage with providers holding security certifications (Vercel, Supabase). We maintain and improve these measures; the current description is in section 8 of the policy.
A-8. Incidents. We notify the Administrators by email of a security breach affecting the Client's guest data within 48 hours of learning about it, describing the nature of the breach, the categories and approximate number of affected subjects, the likely consequences and the measures taken, and we add information as it becomes available. Notifying the supervisory authority and the guests is the Client's duty as controller; we help it do so.
A-9. International transfer and localisation. Data is stored and processed in the United Kingdom (hosting and database) and by sub-processors in the countries named in the policy. For Clients from the EU, transfer to the United Kingdom is covered by the European Commission's adequacy decision; transfers to the United States by standard contractual clauses in our agreements with sub-processors. For Clients from Kazakhstan and Uzbekistan, guests' personal data is collected and stored in a database on the territory of the respective country; to run the platform it is also processed in the United Kingdom. A Client from Kazakhstan, Uzbekistan or Kyrgyzstan, by concluding the contract, entrusts such cross-border processing and obtains guests' consent to it where its law requires it; we provide information about storage locations on request.
A-10. Deletion and return. At the end of the contract the Client exports the guest database as CSV; at its request we delete guest data within the period in section 13, except information we are obliged to keep by law. On request we confirm deletion in writing.
A-11. Audit. On request, no more than once a year, we provide the Client with the information needed to confirm compliance with this Annex: a description of security measures, the list of sub-processors, and audit reports if any were carried out. An on-site audit is possible by agreement, at the Client's expense and without access to other venues' data.