Privacy Policy

What we collect, why we have it, who it passes through, and how to get it deleted. Covers both the restaurants that use Cobblestone POS and their customers.

Last updated: October 20, 2026

Who this covers

Cobblestone POS LLC ("Cobblestone POS", "we", "us") provides point-of-sale and restaurant management software. This policy explains how we handle personal information, and it covers two different groups of people.

Merchants — the restaurants and businesses that sign up for Cobblestone POS, and the owners and staff who use it. For this information we are the controller, and this policy governs.
Merchant customers — the people who order from a restaurant that runs on Cobblestone POS. We process their information on the restaurant's behalf, as its processor, under that restaurant's instructions.

If you ordered from a restaurant and have a question about your information, the restaurant decides what happens to it — contact them first. If you cannot reach them, write to us and we will route your request to them and help them act on it.

This policy also covers visitors to this website, cobblestonepos.com.

What we collect from merchants

Business details: legal and trading name, address, phone number, business type, hours, menu and pricing.
Contact and account details for owners and staff: name, email address, phone number, role, password or register PIN (stored hashed, never in readable form).
Information you provide when applying for payment processing. Where this includes sensitive identifiers such as a tax ID or bank account details, it is collected for and passed to the gateway and the sponsoring bank; we do not use it for anything else.
Operational data you enter: sales, orders, inventory, vendor invoices, shifts, time-clock records and labor reports.
Support correspondence — email, texts and notes from calls with us.
Technical data: IP address, device and browser type, app version, pages and screens used, error and diagnostic logs, and timestamps of actions taken in the Platform.

What we process about merchant customers

On behalf of the restaurant, the Platform may hold:

Name, phone number and email address.
Delivery address, and the distance and route used to quote delivery.
Order history, items ordered, modifiers, notes and order timestamps.
Loyalty account activity and points balance.
SMS and email consent status, with the date, time and source of the opt-in, kept as a consent record.
The brand, expiry and last four digits of a payment card, plus a gateway token. Never the full card number.
Reservation, catering or office-party booking details where the restaurant uses those features.
Recordings or transcripts of calls handled by the AI phone receptionist, where a restaurant enables it.

We do not build a profile of a restaurant's customers for our own purposes, we do not combine one restaurant's customer list with another's, and we do not market to a restaurant's customers.

Card data

Full card numbers, security codes and magnetic-stripe data never reach our servers. Cards are entered into card fields hosted by our payment gateway or read by an encrypting EMV reader, and the gateway returns only a token and the last four digits. The Platform refuses a payment request that contains raw card data rather than processing it.

Card payments are processed by NMI (Network Merchants, LLC), and by Square where a merchant uses it. Card data is handled under their PCI DSS compliance programs. We do not store it, and we cannot retrieve a card number from a token.

This website

Two features on cobblestonepos.com collect information directly from you:

The demo request form. Your name, restaurant name, email address, phone number and any notes you add are sent to us and stored so we can contact you about a demo. We use it to respond to your enquiry and to follow up about Cobblestone POS. We do not sell it or pass it to a third party for their own marketing.
The chat widget. Your messages are sent to our servers and to our AI provider, Anthropic, to generate a reply, and we keep the conversation to improve our answers and follow up on questions. If you enter your email address, we use it to get back to you. Do not type anything confidential into the chat widget.

Why we process information

To provide, operate and support the Platform, and to set up a merchant's account and hardware.
To process payments, and to produce receipts, reports and reconciliation records.
To send transactional messages — order confirmations, status updates, booking reminders, account and security notices.
To send marketing messages where the recipient has opted in, and only of the kind they opted in to.
To run loyalty programs, and to apply rewards at checkout.
To provide AI features, including the assistant, AI-drafted marketing and the AI phone receptionist.
To secure the Platform: detect fraud and abuse, enforce rate limits, investigate incidents and keep audit logs.
To debug problems, measure performance and improve the Platform.
To meet legal, tax and accounting obligations, and to resolve disputes and chargebacks.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We share information with vendors that perform part of the service for us — hosting, payments, messaging, email, mapping and AI among them. Each one receives only what it needs, and is bound to use it only to provide its service to us. The full list, with what each one does and where it sits, is in our Data Processing Terms.

We may also disclose information:

To a merchant, about their own business and their own customers.
To the payment gateway, processor and sponsoring bank, to process a transaction or handle a dispute.
To a professional adviser — an accountant, lawyer or auditor — under a duty of confidentiality.
Where required by law, subpoena, court order or a lawful government request, or to establish or defend a legal claim.
To protect the rights, property or safety of Cobblestone POS, our merchants, or the public, including to prevent fraud.
To an acquirer, in connection with a merger, acquisition, financing or sale of assets. We will give notice before your information becomes subject to a different privacy policy.

SMS and text messaging

Program name:: Cobblestone POS Alerts

Where you have opted in, we send recurring automated text messages about your account, your demo request or your onboarding. Message frequency varies. Standard message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. Consent to receive marketing text messages is not a condition of any purchase.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Full program details are in our SMS and Messaging Terms. Where a restaurant messages its own customers through the Platform, the restaurant is the sender and its own policy and consent records govern.

Cookies and tracking

This website runs no analytics, advertising or social tracking. There is no Google Analytics tag, no Meta Pixel and no third-party advertising cookie on cobblestonepos.com.

The Platform itself uses strictly necessary browser storage: a session cookie or token to keep you signed in, and local storage to remember things like your selected register, an open cart or an unsent draft. These are required for the Platform to work and are not used to track you across other websites.

If we ever add analytics or an advertising pixel, we will name it in this section before turning it on, and add a consent mechanism if the law requires one. We do not currently respond to Do Not Track signals, because we do not track you across sites in the first place.

How long we keep it

Merchant account and business records — for as long as the account is open, then up to 7 years where tax, accounting or dispute-resolution rules require it.
Transaction and sales records — up to 7 years, for tax, chargeback and audit purposes.
Merchant customer records — for as long as the merchant keeps them. A merchant can delete an individual customer record at any time, and we act on a merchant's deletion instruction.
SMS and email consent records — for at least 4 years after the last message, because that is the evidence that proves consent if a complaint is made.
Technical and security logs — typically 30 to 90 days, longer if a log is part of an open security or fraud investigation.
Demo requests and chat conversations on this site — up to 2 years, unless you ask us to delete them sooner.
Call recordings and transcripts — as configured by the merchant, and no longer than needed for the purpose the merchant set.

Closed merchant accounts: see termination in the Terms of Service for the export window and what happens after it.

Security

We use access controls, per-merchant data isolation, encryption in transit, encryption at rest by our cloud provider, hashed credentials, role-based permissions, rate limiting and audit logging. Our Security page describes the measures in more detail.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any required authority as the law demands, without undue delay.

Children

The Platform is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 13, and merchants should not enter a child's personal information into it. If we learn that we hold information from a child under 13, we will delete it promptly. A parent or guardian who believes we have such information should write to us at the address below.

Your choices and rights

Whatever your location, you may ask us to:

Confirm what personal information we hold about you, and give you a copy.
Correct information that is wrong or out of date.
Delete your information, subject to records we must keep by law.
Stop sending you marketing — reply STOP to a text, use the unsubscribe link in an email, or email us.

To make a request, email hello@cobblestonepos.com and tell us what you want done. We will verify your identity before acting, respond within 45 days, and tell you if we need more time. We will not charge you, and we will not treat you worse for asking.

Depending on where you live, state law may give you additional rights — including the right to opt out of the sale of personal information or of targeted advertising, and the right to appeal a refused request. We do not sell personal information or run targeted advertising. If we deny a request, our response will explain why and how to appeal it; email us with "Appeal" in the subject line.

If you ordered from a restaurant that uses Cobblestone POS, send your request to that restaurant. If you send it to us, we will forward it and help them carry it out.

Where information is held

We are based in the United States and the Platform is hosted in the United States. Our vendors are listed, with their locations, in the Data Processing Terms. The Platform is intended for businesses operating in the United States, and we do not market it in the European Union or the United Kingdom. If you use it from outside the United States, you understand that your information will be processed in the United States.

Changes to this policy

We may update this policy. When a change is material, we will update the "Last updated" date above and give notice by email or in the admin panel. If a change expands how we use information you have already given us, we will ask for consent where the law requires it.

Contact us

Questions, requests or complaints about privacy: hello@cobblestonepos.com.

Entity:: Cobblestone POS LLC
Mailing address:: 2900 Sweetser Ave, Evansville, IN 47714
Email:: hello@cobblestonepos.com