small-kds: Privacy Policy

Effective date: 4 July 2026

Photo: Dan Burton

This Privacy Policy explains how we handle information in connection with the small-kds application (the "App") and the small-kds website and licensing service at smallkds.com (together, the "Service").

The Service is operated by Cann River Hospitality Pty Ltd (ABN 43 667 030 051), a company incorporated in Australia ("we", "us", "our"). Cann River Hospitality is the entity responsible for the Service and for the handling of the personal information described in this policy. The App is distributed via Google Play under Cann River Hospitality Pty Ltd's own developer account.

small-kds is a business tool that turns an Android tablet into a live kitchen display ("KDS") for merchants who use Square. It is intended for use by businesses and their staff, not by consumers in a personal capacity.

Not affiliated with Square. small-kds is an independent product. It is not affiliated with, endorsed by, or sponsored by Square or Block, Inc. "Square" is a trademark of Block, Inc.

1. Summary (the short version)

• The App reads your own Square order data to display it on your kitchen screen(s). We do not store your order specific content on our servers. (section 2.1).
• Your authentication credentials and chosen Square location are stored securely on your device, not by us.
• Our licensing service stores only what is needed to run your subscription and manage our relationship with you (your Square location, subscription status and dates, and limited account and subscription information).
• Payments are processed by a third-party payment processor. We never receive or store your full card details.
• No advertising. We do not sell your personal information.
• Information is encrypted in transit using industry-standard measures.

The rest of this policy sets out the detail.

2. Information we handle

We keep the personal information we hold to the minimum needed to run the Service. Grouped by class:

2.1 Information we store on our servers

For each Square location connected to the App, our licensing service stores a small record containing the Square location identifier, subscription status and period dates (including any complimentary or prepaid grant), related timestamps, and limited account and subscription reference information received from our payment processor once the location has subscribed.

We also store business contact and profile details. We use these to operate and support the Service and to contact you about it.

We may also hold aggregate activity data for statistical and customer segmentation purposes.

2.2 Information stored only on your device

Your Square authentication credentials and chosen location are stored on the device, and your Square order data is read from your account and held only transiently on the device to display the board. None of this is transmitted to, or stored on, our servers. On-device data is cleared when you log out or uninstall the App.

2.3 Payment information

Subscriptions are billed by a third-party payment processor through its own checkout and customer portal, under its own privacy policy and terms. We never receive or store your full card details; only the limited subscription-reference information in section 2.1.

2.4 Technical data

Because the Service runs over the internet, our providers process limited technical data incidental to delivering it (for example IP address, request metadata, and standard security and reliability logs). We do not use it to build advertising or marketing profiles.

2.5 Communications

If you contact us (for example at [email protected]), we receive your email address and your message, and use them to respond.

2.6 Information we do not collect, and no selling

The App does not access your device location, contacts, camera, microphone, photos, or SMS, and contains no advertising and no third-party analytics or tracking SDKs. We do not sell your personal information or share it for cross-context behavioural advertising.

3. How we use information

We use the information above to:

• authenticate the App to your Square account and display your orders;
• provide, maintain, secure, and improve the Service;
• operate your subscription (verify entitlement and process billing through our payment processor);
• respond to your support requests and communicate with you about the Service;
• detect, prevent, and address fraud, abuse, security, and technical issues; and
• comply with our legal, tax, and accounting obligations.

4. Legal bases (for EU/UK customers)

Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on the following legal bases:

• Performance of a contract: to provide the Service and administer your subscription;
• Legitimate interests: to secure the Service, prevent fraud and abuse, and operate our business (balanced against your rights);
• Legal obligation: to keep records we are required by law to retain; and
• where we act on your instructions in respect of your own Square data, we process that data on your behalf (see section 6).

5. Who we share information with

We share information only with the following categories of recipients, and only as needed to run the Service:

• Square / Block, Inc.: the App communicates with Square using your credentials to read your order data. Your use of Square is governed by your own agreement with Square.
• Our payment processor: handles subscription billing and payment data.
• Our service providers: host our licensing service and website and provide supporting infrastructure.
• Professional advisers, and authorities where legally required; for example if we are compelled by law, or need to establish, exercise, or defend legal claims.

We do not otherwise disclose your information to third parties for their own purposes.

6. Controller and processor roles

• Your Square order data: You (the merchant) are the controller of your Square account and its order data, including any personal information of your own customers. When the App reads and displays that data, it does so on your behalf and on your instruction, and does not retain it on our servers.
• If your customers have questions about how their information appears in your orders, those questions are for you as the merchant to address.
• Subscription and account data: For the subscription/licensing record and your communications with us, we are the controller.

7. International data transfers

We are based in Australia. Our service providers are global organisations and may process data in countries other than your own, including the United States. Where personal information is transferred across borders, we and our providers rely on appropriate safeguards where required (for example the applicable Standard Contractual Clauses and the providers' own transfer mechanisms). By using the Service you understand that your information may be processed in these locations.

8. Data retention

• On-device data (authentication credentials and location): retained on your device until you log out or uninstall the App, at which point it is cleared from the device.
• Square order data: order content is never stored on our servers. It is read from your own Square account and held only transiently on your device to render the board; it is not written to, or retained in, our systems at any time. Aggregated statistical data is held alongside your profile for provisioning the service.
• Subscription/licensing record: our licensing service keeps a record for a location only while that location has an active or complimentary subscription. When a subscription ends, the corresponding record is deleted from our licensing service.
• After that deletion, the only billing-related information that remains is (a) limited references held by our third-party payment processor under its own policies, and (b) entries in our own financial and accounting records that we are required by Australian tax law to keep, typically for up to around five years. Those records are kept for tax and accounting compliance, not to operate the App.
• Payment records held by our payment processor are retained under its own policies.

9. Security

• We use industry-standard measures to protect information in transit, including encryption.
• Your authentication credentials are stored securely on your device rather than on our servers, which reduces their exposure.
• We do not hold your full payment card details; those are handled by our payment processor.

No method of transmission or storage is completely secure. Because your credentials are stored on the device, you should protect the device itself (for example with a screen lock and standard device security) and use Log out on any device you no longer control.

If you believe your credentials or a device have been compromised, log out and, where relevant, rotate/revoke access from your Square account.

10. Children's privacy

The Service is a business tool and is not directed to children. It is not intended for use by anyone under 18, and in particular is not directed to children under 13 (as defined by the U.S. Children's Online Privacy Protection Act) or under 16 (the digital-consent age under the GDPR). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

11. Your privacy rights and how to exercise them

Depending on where you live, you may have rights to access, correct, delete, object to or restrict the processing of your personal information, to data portability, and to withdraw consent. To exercise these rights:

• On-device data: use Log out in the App (this clears the stored credentials, location, and cached entitlement) and/or uninstall the App.
• Subscription/billing data: manage or cancel your subscription anytime through the subscription management portal on the web at smallkds.com/account, or email us. (The App's Account screen displays your subscription status; it does not process billing.)
• Requests to us: contact [email protected]. We will verify and respond to your request as required by applicable law. Some information may be retained where we are legally required or permitted to keep it (see section 8).
• Your customers' data in your orders: because that data belongs to your Square account, please direct such requests to you as the merchant; we will assist you as processor where appropriate.

If you are in the EU/UK and are not satisfied with our response, you may lodge a complaint with your local data protection authority. If you are in Australia, you may contact the Office of the Australian Information Commissioner (OAIC).

12. Australian Privacy Act note

We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). This includes collecting only what we need, keeping it secure, being transparent about our handling, and giving you access and correction rights. Regardless of whether the small-business exemption under the Privacy Act would otherwise apply to us, we voluntarily commit to handling personal information in line with the APPs as described in this policy.

13. EU/UK GDPR note

If you are in the European Economic Area or the United Kingdom, the GDPR / UK GDPR applies to our processing of your personal information as described above. Our legal bases are set out in section 4, your rights in section 11, and our international-transfer approach in section 7.

For most of your Square order data we act as a processor on your behalf (section 6). You can reach us directly using the contact details in section 15. To the extent we are required under Article 27 GDPR to designate a representative in the EU or UK, we will provide that representative's details on request via [email protected].

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, provide additional notice (for example on smallkds.com or in the App). Your continued use of the Service after an update takes effect means you accept the revised policy.

15. Contact us

Cann River Hospitality Pty Ltd (ABN 43 667 030 051) Support and privacy requests: [email protected] Website: smallkds.com Registered office: 5/12 Rohs Road, East Bendigo VIC 3550, Australia