Privacy notice

Last updated: 10 November 2026

TuttoPos is point-of-sale software for shops. Tutto Print Ltd (company number 12506789), 49 Palace Gardens, Enfield, England, EN2 6SN, operates the service. Contact info@tuttoprint.co.uk about support, privacy or account deletion.

Shop information and our responsibilities

A shop decides what customer and staff information it enters and how it uses its business records. Contact that shop about those records. We process hosted shop records to provide the services the shop requests. We separately use service-account, security and support information to operate TuttoPos and handle requests.

Information used

• Accounts: account email and password provided for authentication (the stored password is hashed), shop and device identifiers, device name, approval status and activity times. Authentication and abuse controls use session records and network information.
• Shop records: staff names and roles, customer names, email addresses, phone numbers, addresses and notes; products, artwork, sales, refunds, receipts and invoices. Staff PINs protect access to the local till; the till keeps each one hashed, never as typed.
• Payments: amounts, status and provider references, and limited card information such as brand and last four digits where supplied. Dojo handles card entry and processing under the shop's own payment arrangement. The separate refund-authorisation PIN is sent to our server when authorising a refund. Dojo secret keys are held on the server. Bank details entered for your invoices can also be included in backups or printed invoice documents.
• Files and printing: pictures, logos, backups and receipt or ticket content sent to configured services and printers.
• Support and service operation: messages you send us, request and network metadata and authentication/security records. Hosting services can derive an approximate country or city from a network IP address for service delivery and security.

Why information is used

We use information to provide the requested till, account, backup, printing and payment-integration functions; maintain security and prevent misuse; diagnose technical failures and improve service reliability; handle support and privacy requests; and meet applicable legal obligations. For our own processing, we rely on providing the agreed service, our legitimate interests in running and protecting it, and applicable legal obligations, as appropriate to the activity. Shops are responsible for an appropriate basis for the customer and staff information they control.

Device and cloud storage

In a web browser, local sales and artwork are kept in the supporting browser on the till. Clearing its site data can remove these records. In the iOS app, and in the Android app from version 0.3.0, they are kept in the app's own storage on the device, separate from the browser; deleting the app removes them from that device. Earlier Android versions opened the hosted web service in the supporting browser: records made with them stay in that browser until its site data is cleared, and uninstalling the app alone does not remove them. Installing an app does not synchronise sales between devices.

Cloud backup, when configured, sends shop records and artwork to private storage. Cloud snapshots exclude the till token and local staff PINs, but can include customer, staff and transaction records. Account access uses a protected device-session cookie. Downloaded backups and exports are separate copies controlled by their holder. Downloaded backup files include local staff PINs in hashed form and must be kept confidential: a four-digit PIN can still be worked out from its hash. They are not encrypted by the backup format; cloud snapshots leave those PINs out entirely.

Owner back office, where switched on

Where the owner back office is switched on for a shop, its till also sends a copy of each sale to our hosted database, so the shop owner can read reports on the TuttoPos website. The copy holds amounts, item names, payment methods, refund status and staff names as entered on the till. It leaves out customer records, sale notes, refund reasons and card details, though an item name typed by hand is kept as typed. Owner sign-in sessions are kept for up to eight hours. Only the shop’s owner can read the copy, after signing in with a password and an authenticator code.

Where the shared catalogue is also switched on for a shop, its till sends a copy of the shop’s records: products, categories, prices, VAT rates, the shop’s details and receipt text, and staff names, roles and colours. Staff PINs, card-terminal keys, till keys and bank details are never sent. Earlier versions of each record are kept so the owner can see what changed and when. Only the shop’s owner can read these records, after the same sign-in; the back office also shows the products’ photos and the shop’s logo, read from the shop’s own cloud backup.

Service providers and recipients

• Vercel hosts the app and APIs and provides private backup/artwork storage.
• Neon provides the account, printing and owner back office database service.
• Dojo processes configured payments. In the UK its privacy notice identifies Paymentsense Limited as controller for its payment services.
• Configured printers receive ticket or receipt content. Our email provider processes messages you send to support.

Providers can process information outside the UK. Their service arrangements govern their processing and applicable transfer safeguards. Contact us for information about the arrangements relevant to your service. This notice does not promise that all processing takes place in the UK.

TuttoPos serves its font from the TuttoPos website. It includes no native advertising SDK, advertising ID, contact-book reader, location tracker, microphone recorder or NFC payment reader. Information a shop types into its records is distinct from permission to read contacts or track location on the device.

Retention

We retain active account and hosted shop information while needed to provide the configured services. Local records and downloaded copies remain with the shop until it removes them. We do not use device removal as a substitute for account deletion.

Normal backup rotation keeps all snapshots for 48 hours, then the latest daily snapshots within 90 days. The newest snapshot for each device is kept even if older, and failed cleanup can leave older copies. This is not a guarantee that all data is deleted after 90 days. Turning off automatic backup does not erase existing copies. Account closure addresses snapshots and artwork explicitly.

Following a verified deletion request we identify and delete the account's associated data, including hosted backups, artwork and print content, except specific information needed for a legitimate legal, security or fraud-prevention reason. We explain any retained category, its reason and disposal period or criteria. Provider-held backups and logs may require separate provider handling; retained copies must remain restricted and must not restore deleted information into ordinary use.

Sales copies and owner sign-in sessions are erased when a shop account is closed, except for anything we must keep by law.

Your choices and rights

Depending on the circumstances, you may have rights to access, correct, delete or restrict information, object to processing, receive portable information, or withdraw consent where used. Send requests to info@tuttoprint.co.uk. For shop-controlled records, identify the shop concerned so the request reaches the responsible business. You may complain to the Information Commissioner's Office.

Use the account-deletion request page to request closure of a TuttoPos account without reinstalling or signing into the app. We may verify authority before acting and will explain what is deleted, retained or still awaiting action.

Security and changes

Controls include encrypted network connections, password hashing, protected account cookies, authenticated services, restricted payment routes and private cloud storage. Local records are protected by the device and till access controls; we do not claim that every local record is encrypted or that the service provides end-to-end encryption.

We will update this notice when the service or its handling changes and show the updated date above. Material changes will be communicated through the service or the registered account contact where appropriate.

Direct printing from installed apps

When you enable direct printing in a supported installed app, receipt or ticket content is sent from the device to the printer you select over USB or the shop’s local network. Native printer profiles, connection details, printer model and, for supported network printers, a printer serial used to check its identity are kept in the app’s private storage. A local job record keeps a request identifier, content fingerprint and result to prevent an uncertain job from being sent again automatically. These direct-print records are not an uploaded receipt archive and are not included in an exported shop backup.

Android asks for permission before using a selected USB printer. iPhone and iPad use the shop’s local network. Local printer connections may use unencrypted printer protocols, so use a trusted shop network. Direct printing does not add a printer-maker SDK or automatic diagnostic upload to the printer manufacturer. Existing configured cloud-printing and hosted service requests are separate and continue to use the services described above.

Installed iPhone and iPad application

The installed iPhone/iPad app keeps its local till records in its own protected app storage, separately from Safari or a Home Screen web app. Connected account, backup, print and payment requests use the configured TuttoPos HTTPS service. The approved-device sign-in pass is kept in the installation’s Keychain storage and is not exposed to the till’s page scripts or included in an exported shop backup. Deleting or reinstalling the app is different from requesting closure of the hosted shop account.

When you export a backup or report, the app uses the system file picker so you choose where to keep it. Files you export can contain shop, customer and staff information. Native account-deletion requests are recorded with a shop/request identifier, date and processing status so we can receive, track and complete them. The account-deletion information explains the scope and completion process.