Privacy policy
Last updated: 29 September 2026
CCK8 POS is a point-of-sale system for cafés and restaurants: a staff app (orders, kitchen, menu, reports) and a QR ordering page for the shop's customers. This policy explains what information we keep, why, and the choices you have. It follows Malaysia's Personal Data Protection Act 2010 (PDPA).
[email protected]
Who is responsible
We run the service. Each shop (our customer) decides what it records about its own customers and staff, and is responsible for that information; we store and process it for the shop.
What we collect
- Owner and staff accounts: name, email, role, password (stored only as a secure hash) and screen-lock PIN (also hashed).
- Sign-in and activity: when someone signs in or out, what they changed in the shop, the device type and the internet (IP) address. The shop's owner can see this log. It is kept for 6 months.
- Business records: the shop's name, logo, menu, tables, orders, payments, discounts, cash drawer, reports and settings.
- The shop's customers: what they order, their table, and, only if they choose to give it, their name and phone number (for loyalty points, reservations or order updates).
- Licence: the licence key and plan, checked with our licence server.
We do not collect location, contacts, photos or files from your phone, other than a picture you choose to upload (for example a menu photo or logo). We do not use advertising or tracking cookies.
Payments
Online payments are handled by a licensed 3rd party payment gateway. Card and bank details are entered on the gateway's page and never reach or stay on our servers; we only keep the payment result (amount, status and reference).
Why we use it
- To run the service: take and prepare orders, take payments, print receipts and show reports.
- To keep accounts safe: sign-in, screen lock and the activity log.
- To send service emails: account verification, password reset and staff invitations.
- To support the shop when it asks for help, and to fix problems.
We never sell personal information and never use it for advertising.
Who we share it with
- Our hosting provider, which stores the data for us.
- The 3rd party payment gateway, only for online payments.
- Our email provider, to send service emails.
- Telegram, only if the shop turns on Telegram order alerts.
- Authorities, only when the law requires it.
Cookies and storage on your device
We use a few small cookies and local storage that the app needs: keeping you signed in, your language, the outlet you are working at, and whether you are using the Android app. They are not used to track you.
How long we keep it
- Business records and accounts: while the shop's account is active.
- The activity log: 6 months.
- After an account is deleted: removed within 30 days, except records the law requires us to keep (for example tax and payment records), which are kept only as long as required.
Security
All traffic is encrypted (HTTPS). Passwords and PINs are stored as hashes, and every shop can only see its own data.
Your rights
You can ask to see, correct or delete your personal information. Owners and staff can change their name and password in My Account. A shop's customer should first ask the shop; you can also contact us.
Delete your account
Signed in: open My Account and tap Delete my account. Not able to sign in: use the Delete my account page (link below). The owner's request deletes the whole business account with its outlets, staff logins, menu and orders. A staff member's request deletes only their own login. We confirm by email and finish within 30 days.
Children
CCK8 POS is a business tool and is not meant for children under 13.
Changes to this policy
If we change this policy we will update this page and the date at the top. Important changes are also announced in the app.
Contact us
For any question about your information, contact us:
[email protected]