Privacy Policy

This policy explains what ExpoKDS collects, why, and how it is handled. It is written to be read, not skimmed. If anything is unclear, email hello@expokds.com.

What we collect

• Account data: business name, login email, and a hashed password for the business login; kitchen PINs are stored hashed.
• Square data: with your authorization, orders, line items, catalog names and categories, and locations from your Square account, accessed read-only. Square access tokens are stored encrypted.
• Usage data: when tickets were shown and bumped, which stations exist, and technical logs needed to run the service.
• Website forms: what you type into the trial, contact, and newsletter forms.

What we do with it

We use this data to display orders in your kitchen, to support you, to improve reliability, and to contact you about your account. We do not sell it, and we do not use your order data to train machine-learning models.

Retention

Webhook events are kept for 30 days and order records for 90 days by default, after which they are deleted automatically. Account data is kept while your account is active and deleted on request after closure.

Disconnecting

You can revoke ExpoKDS’s access to your Square account at any time from your admin page or from Square’s dashboard. Revocation takes effect immediately.

Security

All traffic is encrypted in transit. Square tokens are encrypted at rest. Kitchen screens authenticate with a store ID and PIN and can be signed out remotely.

Contact

ExpoKDS, hello@expokds.com.

This document is a starting point and should be reviewed by counsel before relying on it for regulatory compliance.