Privacy Policy

1. Who is responsible for what

There are two different kinds of personal information in Kessel and we hold them in two different capacities. Getting this the wrong way round is the most common mistake in a policy like this, so it is the first section.

Data	Whose	Our role
Your account: the people at your business who sign in, your business details, your billing records	Yours, and your staff’s	We are the controller. This policy describes what we do with it.
Your customers: names, contact details, order history, house accounts, loyalty records	Your customers’	You are the controller and we are your processor. We act on your instructions and we do not use it for our own purposes.

If you are a customer of a business that uses Kessel and you want your data corrected or deleted, contact that business. We will help them act on it, but we cannot act on their data without them.

2. What we collect and why

Category	Examples	Why	Kept for
Account	Name, work email, phone, password hash, role, business name and address	To create and secure your account and to support you	Life of the account, then 90 days
Billing	Subscription state, invoices, payment method token, hardware plan balances	To charge the $49, to run hardware plans, and to meet tax and accounting law	7 years, as tax law requires
Transaction	Orders, line items, tenders, refunds, tips, ledger entries, receipts	To run your business and produce your books	Life of the account, then 90 days, except records we must retain
Your customers’ records	Whatever you choose to record: name, email, phone, order history, house-account balance	Only to provide the service to you	Until you delete it or close the account
Technical	IP address, device and browser, timestamps, error reports, API request logs	Security, fraud prevention, debugging and abuse investigation	90 days for logs, 12 months for security events
Support	Emails you send us and our replies	To answer you and to keep a record of what was agreed	3 years

We do not collect biometric data, precise geolocation, or special categories of data such as health or political opinions, and we ask you not to store them in free-text fields either.

3. Card data never reaches us

A card number never touches a Kessel server. On a reader the card data goes from the certified Stripe Terminal hardware to Stripe. On the web it goes from Stripe’s own fields in your browser to Stripe. What we store is what Stripe gives back: a token, the last four digits, the brand, the expiry, the entry method and the approval result.

This is why Kessel has no PCI fee. Keeping card data out of a system entirely is cheaper and safer than protecting it inside one, and it is the only reason we can say what this section says.

In the card industry’s own language, that arrangement is SAQ-A: all card handling outsourced to a validated third party, with our own systems neither storing, processing nor transmitting a card number. SAQ-A is a self-assessment rather than a certificate somebody issued us, and it is described in full, along with what we do NOT hold, on usekessel.com/subprocessors/.

4. How we use it

To provide the service you signed up for.
To bill you, and to collect hardware plan amounts out of volume.
To detect and prevent fraud, abuse and unauthorised access.
To support you when you ask, and to tell you about outages, security issues, billing and material changes to these documents. Those are service messages and you cannot unsubscribe from them while you have an account.
To meet legal, tax, accounting and card-network obligations.
To produce aggregated, de-identified statistics that cannot identify you or your customers.

Marketing email is opt-in and every message has a working unsubscribe link. Unsubscribing never affects the service.

5. Legal bases

Where the UK or EU GDPR applies, we rely on: performance of a contract, for running the service and billing you; legitimate interests, for security, fraud prevention and improving the product, balanced against your rights; legal obligation, for tax and accounting records; and consent, for marketing email, which you can withdraw at any time.

6. Who else sees it

Our sub-processors, in full. There are six, and the same list with a paragraph on each is at usekessel.com/subprocessors/ for a privacy review that needs one.

Sub-processor	What they do	What they get	Where
Stripe, Inc. and Stripe Payments Canada, Ltd.	Payment processing, card acceptance, payouts, identity and risk	Cardholder data, transaction records, payout and bank details, business verification records	United States, with regional processing
Twilio Inc.	Text messages: signup verification codes, receipts a customer asked for, booking confirmations, pay links, dispute alerts	The destination mobile number and the words of the message. No card number, no password, and no order detail beyond what the message itself says.	United States
Amazon Web Services, Inc.	Hosting, database, object storage, logging, and email delivery through SES	All application data at rest and in transit. For email, the destination address and the message.	United States (us-east-1)
Mapbox, Inc.	Address autocomplete on the signup form and on a store’s address	The partial address being typed, sent from our servers rather than from your browser, so Mapbox never sees your IP address	United States
Anthropic, PBC	The AI features: Catalog Studio, add-on suggestions, dispute drafting	Only the specific records needed for the request you triggered. Sent through the commercial API, which is not used to train models.	United States
Google LLC	Google Analytics 4 on our website, our documentation site and the signed-in console	Page views, IP address and user agent of people browsing those pages. No merchant record, order, customer or amount is ever sent to it, and no page a customer of yours sees loads it at all.	United States

Beyond those, we disclose personal information only:

To you, and to people you have authorised on your account.
Where the law requires it, or to respond to a valid legal process. We will tell you first unless we are legally prohibited.
To protect the rights, property or safety of Kessel, our merchants or the public, including fraud investigations.
To a buyer, in a merger, acquisition or sale of assets, subject to this policy. We will tell you before your data moves to a new controller.

Version 1.0 of this policy listed three. Twilio, Mapbox and Google Analytics were already in use when it said so — sending verification codes, answering the address box on the signup form, and counting page views. Adding them in version 1.1 corrects this document; it does not change who sees your data, and none of the three is new.

We will post changes to the sub-processor list here at least 30 days before a new one starts processing your data. We do not use advertising networks or data brokers, and no analytics vendor receives merchant or customer data. Google Analytics measures traffic to our own websites and console only, and is described in section 10.

7. International transfers

Our infrastructure is in the United States. If you are in Canada, the EEA or the UK, your data will be transferred there. For EEA and UK transfers we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum with each sub-processor. For Canadian merchants, PIPEDA permits transfers to a service provider abroad with comparable protection, and this section is your notice that it happens.

8. Security

Encryption in transit everywhere, and at rest with managed keys.
Card data is out of scope entirely, as described in section 3.
Passwords are hashed with Argon2. We cannot read yours and neither can anyone who steals the database.
Access to production data is restricted, logged, and granted only for a support task you have asked for.
Every tenant is scoped in the query, not in the interface, so one merchant cannot read another’s data even through the API.

No system is perfectly secure. If a breach affects your personal information we will notify you and the relevant regulator within the timeframes the law requires. Report a vulnerability to security@usekessel.com; we will not pursue anyone who reports in good faith and does not access other people’s data.

9. Your rights

Wherever you are, you can ask us to do all of the following, and we will not charge you or treat you differently for asking. Email privacy@usekessel.com and we will answer within 30 days.

Access: get a copy of the personal information we hold about you.
Correct: fix anything inaccurate.
Delete: have it erased, subject to records we must keep by law.
Port: receive it in a machine-readable format, or have it sent elsewhere.
Object or restrict: stop or limit a use based on legitimate interests.
Withdraw consent: for anything you consented to, at any time.
Complain: to your data protection authority. In Canada that is the Office of the Privacy Commissioner; in the UK the ICO; in the EEA your national authority.

For California residents: we do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You have the rights to know, delete, correct and to non-discrimination, listed above. We have not disclosed personal information for a business purpose beyond the sub-processors in section 6.

10. Cookies and tracking

This website, our documentation site and the Kessel console run Google Analytics 4 (measurement ID G-8C763ENZYN), which sets first-party cookies named _ga and _ga_* to count visits and see which pages are read. Google receives your IP address, user agent and the pages you view. We have not enabled Google Signals or advertising features, so this data is not used to build an advertising profile of you and is not shared with advertisers. Beyond that we carry no advertising or social pixels and do not fingerprint your device. In the app it loads on signed-in console pages only: a pay link, a guest check, a booking page and a receipt load no analytics at all, because a page carrying an embedded payment form has to account for every script on it. You can opt out for every site at once with Google’s browser add-on at tools.google.com/dlpage/gaoptout, or by blocking the script.

One third-party request does happen: the web fonts load from Google Fonts, which means Google receives your IP address and user agent in order to serve the font file. It sets no cookie. We are working on self-hosting the fonts to remove that request entirely.

The Kessel application sets no session cookie at all. It keeps your session token and your chosen location in localStorage, and a guest check or a pay link keeps a token in sessionStorage for the life of the tab. That is a deliberate security choice rather than an accident of implementation, and the reason is in the cookie notice. None of it is advertising, and apart from the session token, which goes to our API on the request it authenticates, none of it leaves your device. Your customers’ records and your sale data are never sent to Google.

Every cookie and every storage key is named, with what is in it and how long it lasts, at usekessel.com/cookies/. An earlier version of this section described a session cookie the app has never set, which is the kind of thing a generic paragraph gets wrong and a named list cannot. The tablet register’s offline sale queue is named there too: it is a database inside the app on the device rather than browser storage, it holds cash sales taken with no connection, and it is the one piece of Kessel storage that holds order detail.

11. Children

Kessel is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe we have, tell us at privacy@usekessel.com and we will delete it.

12. Data processing agreement

If you need a signed DPA, including the Standard Contractual Clauses, email privacy@usekessel.com and we will send one. We do not charge for it and we do not restrict it to a plan.

13. Changes to this policy

We will post a new version here with a new version number and effective date. For a material change, or a new sub-processor, we will email you at least 30 days beforehand.

14. Contact

Privacy questions and rights requests: privacy@usekessel.com. Security: security@usekessel.com. The contracting entity and its registered address depend on where your business is; both are listed in section 1 of the Terms of Service.

Also: Terms of Service. Pricing is $49 a month and interchange + 0.90% + 30¢, described in full on the pricing page.