Privacy Policy

About stores and their staff: the store's name, address, GST number, contact details and logo; each person's name, email address and role; a record of who did what in the account; and, for the account owner, billing details (Stripe holds the card or bank account details themselves). Also, if they use them:

• a staff photo, shown only to people at their store;
• a 4-digit PIN for switching user, which we only ever store scrambled (hashed);
• sign-in details: when they signed in, and the IP address and browser used;
• support tickets and live chats with Tilo, with any files attached, and the page, browser and device they were on when they raised a ticket;
• feature requests, votes and comments (other stores never see who made them).

About stores' customers, as recorded by the store:

• name, phone number, email and address, and whether they're happy to receive marketing emails;
• what they've bought and returned, with dates, and any notes the store writes;
• loyalty membership, store credit and gift card balances;
• for charge accounts, the business or club's contact details and who can buy on the account;
• for card payments, the card type and the masked card number the terminal gives us (never the full number);
• for firearms sold, their serial numbers and any permit number, which dealers must record.

Tilo doesn't keep firearms licence details. When a store has connected Gunwise, anything Gunwise still needs from a sale is held encrypted only until it's sent, then deleted. The store enters its customers' details, and is responsible for telling its customers that it keeps them in Tilo.

• to provide Tilo to stores, so they can sell, keep stock and look after their customers;
• to run accounts, sign people in, and send emails (such as receipts, statements and password resets) for stores;
• to bill the store's subscription;
• to give support when a store asks for it;
• to keep Tilo secure, and to investigate misuse;
• to meet our own legal obligations.

We don't sell personal information, use it for advertising, or use customers' information for any purpose of our own.

• Each store sees only its own information. A store's sales, products, customers and staff are never visible to another store.
• Within a store, the owner and managers decide what each person can do, by their role.
• Our staff see what a store sends us in support tickets and chats, and look at a store's records only when needed to support it, keep Tilo running, or meet a legal requirement. When we open a store's support ticket or file, it's recorded in that store's history.
• Services a store connects (its WooCommerce website, Gunwise, its Windcave card terminal) receive what they need for the store, as it has set them up.

We give personal information to the Police or another authority only when the law requires it, such as under a search warrant or production order, or where the Privacy Act allows it to prevent a serious threat to someone's life or safety. Where we're allowed to, we'll tell the store about the request.

Tilo's database is hosted in Sydney, Australia. We use these providers, who handle information only to provide their service to us:

• Supabase: database and file storage (Sydney, Australia).
• Vercel: runs the Tilo website and app (global, United States based).
• Resend: sends Tilo's emails, including stores' receipts and statements (United States based).
• Stripe: subscription payments, for account owners only (global).
• Google: address suggestions as an address is typed, and signing in with Google for people who choose to (global, United States based).
• Windcave: card payments, for stores using a Windcave terminal; card details stay with Windcave (New Zealand).

Some of these providers are outside New Zealand. We use providers that protect information in ways comparable to the Privacy Act, as that Act requires.

• Encryption: every connection to Tilo is over HTTPS, and information is encrypted at rest by our database provider.
• Each store kept apart: every store's information is separated by rules in the database itself, not only in the app, so one store can't reach another's.
• Passwords and PINs: stored only as one-way hashes, so nobody, including us, can read them back. Five wrong PINs in a row lock that person's PIN for a few minutes.
• A record of changes: changes to a store's records are kept with who made them and when.
• Private files: staff photos and support attachments are kept in private storage, checked when they're uploaded, and only shown to people allowed to see them.
• Payments: card details are handled by the card terminal and Windcave, and subscription payment details by Stripe, never by Tilo.

• We keep a store's information while its subscription is active.
• When a subscription ends, we keep it for 7 years, then permanently delete it. The account owner can ask us to delete it sooner.
• Backups are overwritten on a rolling basis after deletion.

You can ask to see the personal information we hold about you, and ask for it to be corrected.

• Store owners and staff: you can update your own details in Tilo, or email support@tilo.co.nz.
• Customers of a store: please ask the store first, as it recorded your details and can correct them. You can also email support@tilo.co.nz; we'll check who you are and work with the store to respond.

We'll respond within 20 working days, as the Privacy Act requires.

If a privacy breach happens that has caused, or is likely to cause, serious harm, we'll notify the Privacy Commissioner and the affected stores and people as soon as practicable, as the Privacy Act requires, and work with the stores involved.

Our Privacy Officer can be reached at support@tilo.co.nz. If you're not happy with how we've handled a privacy concern, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

We may update this policy. We'll change the date at the top, and email account owners about significant changes.