Privacy policy

This privacy notice describes how we handle enquiries sent through katypos.com.

Who we are

This website and the Katy POS services are operated by Parsa Khataee, trading as Katy POS ("Katy", "we", "us"). Katy POS is not currently presented as a limited company. For privacy or data-protection correspondence, contact privacy@katypos.com.

For anything about your personal data, email privacy@katypos.com.

Two different roles

• On this website and for our own customers, we decide how your data is used, so we are the controller.
• Inside Katy POS, the restaurant or shop using Katy decides what customer data it records. For Katy Local, that data stays on the business's own computer and we do not see it. Where a business uses Katy Cloud, online ordering, text messages or Katy AI, we process data on that business's behalf as its processor, under a data processing agreement.

What we collect on this website

• When you ask for a demo or quote: your name, business name, email address, phone number (optional), business type, number of tills, the product you are interested in and any message you write. We ask only for what we need to arrange a demo and a quote.
• To stop automated spam, our server counts recent requests from each connection. It stores a one-way keyed hash of your IP address for this, never the address itself, and deletes the count within two days. Your IP address is not saved with your request.
• This site does not use analytics, advertising cookies or tracking pixels. Fonts are served from our own website, so no third party receives your IP address when the pages load.

How we use it and our lawful basis

• To reply to your demo or quote request, arrange the demo and follow it up: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)). Where the person asking is not the one who would sign the contract, we rely on our legitimate interests in answering business enquiries (Article 6(1)(f)), and we have weighed those interests against yours.
• To provide and support Katy services you buy: performance of a contract.
• To keep accounts and meet legal duties: legal obligation.

We do not sell personal data, and we do not send marketing emails unless you have asked for them. Asking for a demo does not sign you up to marketing, and we do not use your request for unsolicited campaigns.

Who can see your demo request

Your request is stored in our own database on our web hosting account, protected by HTTPS while it travels. Only Katy staff with a personal administrator account can open it; those accounts use strong password hashing and lock after repeated failed sign-ins. The email we receive when you send a request contains only its reference number and the options you chose, not your contact details.

Katy AI

Katy AI is off until a business switches it on. Requests then go to Google's Gemini service, through Katy Cloud or straight from the business's till with its own key, and Google processes them under its paid Gemini API terms. Sales questions use Katy's figures without customer records, but what a person types or photographs is sent as it is. Reading a delivery ticket photo sends the customer's name, phone number and address on the ticket, and the phone receptionist sends what a caller says. Katy keeps neither the photo nor a recording; Katy Cloud records only the feature, model and amount of usage. What each AI feature sends and keeps.

Delivery drivers

The driver page shows addresses and map links for the driver's deliveries. We do not store drivers' location.

Who we share data with

• Our website hosting provider, which stores this website and demo requests on our behalf.
• Cloud hosting providers in the UK for Katy Cloud.
• Google, for Gemini AI requests and, if a business turns it on, Google Drive backups to that business's own account.
• Text and WhatsApp message providers, for order updates a business chooses to send.
• Professional advisers and authorities where the law requires it.

Where a provider processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

How long we keep it

Demo requests marked as closed have their personal details removed 12 months after our last activity on them. Any other demo request has its personal details removed after 24 months without activity. After that we keep only the reference number, the options chosen and dates, which no longer identify you. You can ask us to delete your request sooner at any time. Customer account records are kept for as long as you use Katy and then for up to 6 years for tax and legal purposes.

Your rights

You can ask to see, correct, delete or move your data, and object to or restrict how we use it. Email privacy@katypos.com and we will reply within one month. If you are a customer of a business that uses Katy, contact that business first, and we will help them respond.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

We will update this page when our practices change and show the date at the top.