Privacy Policy

This Privacy Policy explains how Pointbunny ("Pointbunny", "we", "us") collects, uses, and protects information when you use our point-of-sale application and website (the "Service"). By using the Service, you agree to this policy.

Information we collect

We collect the following types of information:

• Account & business details - your name, email address, business name, phone number, and business address, provided when you sign up or during onboarding.
• Data you enter into the Service - your menu, categories, prices, sales and transaction records, expenses, inventory, suppliers, staff members and their roles, time-clock entries, pay rates, leave requests, and similar business data you create while using Pointbunny.
• Your customers' details - if you use the loyalty program, the customer names, phone numbers, and birthdays (month and day) you enter. See "Data you hold about your customers" below.
• Authentication data - your password (stored only as a secure hash by our authentication provider), and, if you choose them, optional Google sign-in and two-factor authentication.
• Subscription details - your plan and subscription status. Billing is handled by Lemon Squeezy (see below); we never see or store your full card number.
• Technical & usage data - basic information such as device type, browser, and how you interact with the Service, used to keep it working, secure, and improving.

How we use your information

• To provide, operate, and maintain the Service.
• To process your transactions and keep your business records.
• To communicate with you about your account, support requests, and important changes.
• To secure the Service and prevent fraud and abuse.
• To improve and develop new features.
• To comply with legal and tax obligations.

Service providers we use

We rely on a small set of trusted providers to run Pointbunny. They process data only to provide their service to us:

• Supabase - database, authentication, and file storage (where your business data is securely held).
• Netlify - hosting for our website and application.
• Resend - sending account and notification emails.
• Google - optional "Sign in with Google"; web fonts (Google Fonts), which means your browser connects to Google to load them; and, only if you accept analytics cookies, Google Analytics on our website (see "Cookies & analytics" below).
• Cloudflare Turnstile - bot protection on our sign-in forms.

Paid subscriptions are sold through Lemon Squeezy, which acts as the merchant of record: it collects your payment and billing details and handles sales tax under its own privacy policy, and tells us only your subscription status.

Google sign-in

If you choose "Sign in with Google", we receive your name and email address from Google and use them only to create and sign in to your account. We do not access any other Google data, and we do not sell it or use it for advertising.

Data you hold about your customers

When you enter details about your own customers (for example, loyalty members) or your staff, we store and process that data on your behalf and only to provide the Service to you. You are responsible for having a lawful basis to collect it and for telling those people how you use it. If one of your customers asks us about their data, we will refer them to you.

Data storage & security

Your data is encrypted in transit, and each business's data is isolated so that one business can never access another's. We support two-factor authentication and follow industry-standard security practices. No system is perfectly secure, but we work hard to protect your information.

Your data is stored in the United States (our database is hosted in Northern Virginia). If you use the Service from outside the US, including from the EU or UK, your information will be transferred to and processed in the US. Where the law requires it, we rely on safeguards such as the Standard Contractual Clauses included in our providers' data processing agreements.

Cookies & analytics

We use essential cookies and local storage to keep you signed in and remember your preferences (such as your theme and device settings). These are needed for the Service to work.

On our website (pointbunny.com) we use Google Analytics to understand how visitors find and use the site, such as which pages are visited and where visitors come from. Analytics cookies are only set if you choose "Accept" in our cookie banner. If you decline, no analytics cookies are stored on your device; Google may still receive basic, cookieless signals (such as a page view, without identifying you) that it uses to estimate overall visitor numbers. You can change your choice at any time using the "Cookie settings" link at the bottom of every page. Google Analytics is not used inside the Pointbunny app itself.

We do not use advertising cookies, and we do not sell your personal information.

Data retention

We keep your information for as long as your account is active and as needed to provide the Service and meet legal obligations. You can request deletion of your account and associated data at any time.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. To exercise any of these rights, contact us at support@pointbunny.com.

Children

The Service is intended for businesses and is not directed to children under 16.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, notify you.

Contact

Questions about this policy? Email us at support@pointbunny.com or visit our contact page.