Privacy

Who we are

Piña is run by Pina Digital Limited, a company registered in England and Wales, company number 17559261, registered office 12 Harrington Villas, Brighton, BN1 6RG. We give shops digital receipts at the till. Email privacy@mypina.co.uk about anything in this notice.

Piña never shares your personal data with shops, ever. A shop sees its own sales and an anonymous customer code, never your name, email address or how you signed in.

For your receipts, your Piña account and any offers we send you, we are the data controller, so we decide what is kept and why. For each shop’s own till data and the anonymous summary of its customers, we are a processor: we hold them for the shop under a written agreement, and the shop decides how to use them.

This notice covers mypina.co.uk, getpina.co.uk and the emails we send. Each shop that uses Piña is a separate business with its own privacy notice for what it does with its customers’ details.

When you tap

Each tap records the shop, which tag you tapped, the time, and your browser’s user agent (the name and version of your device’s browser). We use these to find your payment and to count how often people tap, which is how we and the shop know whether Piña is working.

The shop’s till sends us the payment: what you bought, the amount, the time, and your card’s brand and last four digits. We never receive the full card number or its expiry date, and we do not record your location.

Every Piña tag signs the link your device opens, so we can tell a real tap from a copied link and refuse a link used twice. The signature contains the tag’s own serial number and a count of taps, and nothing about you.

If we can’t find your payment, you can type the amount and, if needed, the last four digits of your card so we can look for it. We use what you type only for that search and do not keep the digits.

You can see a receipt without giving us anything. Its link is long and random, so only people you share it with can open it.

We do this to provide the receipt you tapped for, under our terms with you, and we count taps in our legitimate interest in knowing whether Piña works in each shop.

Receipts kept on this device

When you hold your device to a tag that says “Tap to keep receipt”, we set a cookie on your device called pina_d. The cookie holds a random number for this device and nothing about you. Receipts you tap for on the device are linked to that number, so mypina.co.uk/me can list them before you sign in. If you sign in later, they move into your account.

UK law (the Privacy and Electronic Communications Regulations) lets us set a cookie when you have agreed to it. Tapping a tag marked “Tap to keep receipt” is how you agree, and the tag says so. The cookie is ours alone (first-party), is never used for advertising, and does not follow you to other websites. A link typed or shared on its own never sets it.

To remove the cookie, choose “Forget this device” on your first receipt or from the menu at mypina.co.uk/me. That deletes the cookie and unlinks the receipts from the device; the receipts themselves stay at their links. The cookie lasts a year from your last tap, and we delete the record of a device we have not seen for 12 months.

When you keep all your receipts

“Keep all my receipts” with Google or Apple stores the ID that Google or Apple gives us for you, and the email address they share with us, which they have already verified. The first time you sign in we send one email to that address to say your account is set up. We do not email you your receipts.

Once you have an account, receipts you tap for while signed in on that device are added to it, as are the receipts already kept on the device. Opening a receipt link somebody sent you never adds it to your account, and never lets you keep a receipt that is someone else’s.

A cookie called pina_c keeps you signed in for 90 days. Piña accounts are for people aged 13 or over. We keep your account under our terms with you.

What the shop sees

Piña never shares your personal data with shops, ever. A shop sees the payments from its own till. If you keep a receipt from a shop, the shop sees an anonymous customer code (made from scrambled identifiers, different at every shop), when you visited and what you bought there, and can download that list, but never who you are: not your name, not your email address, not how you signed in. A shop never sees your receipts from other shops, and never sees your card details.

We keep the code so the shop can count how many customers come back, in our legitimate interest and the shop’s in knowing whether Piña works. The code cannot be turned back into you, and nobody outside Piña can link your codes at two shops.

Offers from shops, sent by Piña

A box that starts unticked, on your receipt and at mypina.co.uk/me, asks whether we may send you offers from shops you have bought from. If you tick it, a shop can write an offer and choose a group of its customers, at least ten at a time, and we send the offer: by email, as Piña, and on your receipts page. The shop never receives your address or learns which customers were in the group. We save your choice once Google or Apple has signed you in, so nobody can tick the box for someone else, and we send nothing until this part of Piña is running.

Offers are your consent, and you can stop them at any time: untick the box at mypina.co.uk/me, or stop offers from one shop from the link in its email or from that shop’s page at mypina.co.uk/me. Each offer email says who wrote it and carries both links.

If you claim an offer at the counter by pressing the button on your device, the shop can see you do that, as with a paper voucher. The shop learns only that an offer was claimed, never your details, and sees how many people claimed it, never who.

We keep a record of each time you turn offers on or off, or stop one shop, with the wording you agreed to, so we can show what happened. If you delete your data, the record stays but no longer says it was you.

Counting returning cards

So a shop can see how often the same card comes back, we keep a scrambled code with each card payment. We make the code from an identifier the shop’s till system gives us for the card, never from the card number, and the code can’t be turned back into the card number. The code is different at every shop, so nobody can use it to link your payments at two shops.

The shop only sees totals, such as how many cards were used on two or more days, and never which card or whose. We do this on the basis of legitimate interest: helping a shop understand its repeat trade with the least data possible. We clear the code after 24 months, and you can object to it by emailing us.

If you run a shop

When you set up a shop we keep your shop’s name and address and your email address, and send you a sign-in link that works once and lasts 30 minutes. A cookie called pina_m keeps you signed in for 90 days. If you use “Find your address”, what you type goes to Google’s address lookup to find your shop; the finder only appears when we have switched it on.

When you connect your till system we store the access it grants us, encrypted, and use it only to read completed payments and the list of your card readers. Piña never takes or refunds a payment or changes your prices, items or settings, and you can disconnect at any time.

Your shop’s name, address, logo, website, Instagram handle, VAT number, company name and receipt message appear on receipts and are public to whoever holds one. We email you when Piña approves your shop.

We keep your details to provide the dashboard under our terms with you, and we hold your till data and the anonymous summary of your customers for you as a processor under the shop terms at mypina.co.uk/terms/shops. We never pass a customer’s personal data to you.

Cookies

Every cookie we set is first-party and cannot be read by scripts on the page. None is for advertising, and we do not use any third-party cookies or tracking.

• pina_d: the receipts kept on this device, set by a verified tap, a year from your last tap.
• pina_c: keeps you signed in to your receipts for 90 days.
• pina_m: keeps a shop signed in to its dashboard for 90 days.
• pina_a: keeps Piña’s own staff signed in to the admin site for 30 days.
• Short-lived cookies for 10 minutes during a Google or Apple sign-in, or while a shop connects its till system, so we can check the reply came from the sign-in we started.

Vercel, which hosts the sites, counts page visits and page speed without cookies and without keeping anything that identifies you. Fonts are served from our own site, not from Google.

How long we keep it

We keep the least we can for as long as the purpose needs. In detail:

• Receipts in your account: until you delete your account, or remove the receipt from your receipts.
• Receipts nobody kept: they stay at their link as the shop’s record of the sale, with the card brand and last four digits on them, so the receipt still works for whoever has the link.
• Returning-card codes: 24 months.
• The record of a device: 12 months after we last saw it.
• Sign-in links: 30 minutes, and once used.
• The record of taps, receipt views, saves and your choices about offers: kept as the record of how Piña is used in each shop. When you delete your data, these records stop referring to you.
• A shop’s details: for as long as the shop uses Piña, then for as long as accounting law requires.

Deleting your data

Sign in and go to mypina.co.uk/me, then choose to delete your data. We delete your account, your email address, your Google or Apple sign-in, your choice about offers, and the link between your devices and your account, straight away. Your receipts stay with the shops as anonymous sales, without your email.

You can also remove a single receipt from your receipts, on the device that holds it or in your account, from the bin icon on the receipt. The receipt stays at its link for the shop, and no longer appears in your receipts.

Who else handles it

A few companies help us run Piña. Each handles your data only to provide its service to us, under a contract with us.

• Supabase keeps our database, in London.
• Vercel hosts the sites, in London, and counts page visits without cookies.
• Resend sends our emails, from the EU.
• Sentry reports errors so we can fix them. We send no customer details with an error report.
• Google or Apple, only if you choose to sign in with them. They tell us who signed in, and we tell them nothing about your receipts.
• Google, only if a shop uses “Find your address” when setting up.
• The shop’s till system (Square, SumUp, Lightspeed or Clover), which sends us the shop’s completed payments. The shop chose that system and has its own agreement with it.

Some of these companies are in the United States. Where data leaves the UK we rely on the UK’s adequacy regulations for the EU, on the UK extension to the EU-US Data Privacy Framework where the company is certified under it, or on the International Data Transfer Addendum in our contract with the company.

We do not sell your data, share it with advertisers or use it to build profiles. We make no decisions about you by automated means that have a legal or similarly significant effect on you.

How we protect it

Every page is served over HTTPS. Till access tokens are encrypted at rest. Receipt links are long and random, tap links are signed by the tag, and finding a payment, matching it and keeping a receipt only work within the few minutes after a verified tap. If a breach of our systems puts you at risk, we will tell you and the Information Commissioner’s Office as the law requires.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop using it, object to what we do in our legitimate interest, and ask for the data you gave us in a form you can take elsewhere. Where we rely on your consent, as for offers, you can withdraw it at any time and the easiest way is the box at mypina.co.uk/me.

If you have an account, the quickest way to a copy of your data is Download my data, under Account in the menu at mypina.co.uk/me, which gives you one file with everything we hold about you.

Email privacy@mypina.co.uk. We answer within one month and do not charge, unless the law lets us take longer or charge for a request that is clearly unfounded or excessive. We may ask you to sign in or to prove who you are first.

If you are not happy with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

The date at the top shows when this notice last changed. If a change matters to how we use your details, we will say so on this site and, if you have an account, email you before the change applies.