What we ask the POS for, and what we refuse

When a business owner approves a Numal connection, they're handing an unfamiliar company access to the record of everything their shop sold. That deserves a straight answer about what we take.

What we read

• The amount of each settled transaction, and its timestamp.
• Whether the sale was a first visit or a repeat, where the POS already tracks that.
• Opening hours and location, so a report knows which shop it describes.

What we don't

• Customer names, emails, phone numbers, loyalty identities.
• Card numbers or any cardholder data — those never reach us at all.
• Itemized baskets. We know a sale was $14.20 at 3:42pm. We don't know it was two flat whites and a croissant.

This isn't restraint we're exercising voluntarily on data we hold. The access scope we request from each provider doesn't include those fields, so there's no setting on our side that could turn them on.

Why an agency should care

Because the first question a nervous owner asks is whether their agency will see their customer list. The answer is no — not because you promised, but because the data doesn't exist in the product. That's a much easier sentence to say on a call.

The full detail is in the Privacy Policy, and the business owner can revoke access at any moment without going through you.