Your data is yours. Here is exactly what we do with it.

The short version

• Your operating data lives on your own Noosh server. Sales, stock, staff, guests, invoices — they are kept on a Noosh box in your restaurant, or on a private server we host for your restaurant alone in South Africa, separate from every other restaurant.
• The AI runs on Noosh's own hardware in South Africa. Your documents are never sent to a third-party AI company and are never used to train anyone's models.
• We collect what we need to run your account — to set you up, bill you and support you — plus a few usage figures that tell us your tills are working.
• We never sell anything that identifies you, your restaurant, your guests or your staff. Through our market-data programme we sell anonymous market reports, each figure combined from at least 10 restaurants. Taking part is part of the free trial and optional afterwards (with 15% off).

The rest of this page is the detail. Our Terms and Conditions are the agreement these promises sit in.

1. Who we are

Noosh is a restaurant software service operated as a sole proprietorship based in South Africa ("Noosh", "we", "us").

For the purposes of POPIA, our Information Officer can be reached at [email protected]. POPIA protects the information of businesses as well as people, so this policy covers your restaurant's information too.

Two different relationships are worth separating up front:

• For your Noosh account, subscription, this website and the market-data programme, we are the responsible party (data controller).
• For the personal information of your own guests and staff that you keep in Noosh (for example a loyalty member's phone number, or an employee's payroll record), you are the responsible party and Noosh acts only as your operator (processor) — handling it on your instruction, on your server, and never for our own purposes.

2. What we collect, and why

Account & billing information

When you register, subscribe or contact us, we collect the details you give us — your name, restaurant name and location, email address, phone and WhatsApp number, and optional business details such as type of business, number of tills, company name, registration and VAT numbers, and how you heard about us. We record which version of our Terms you agreed to, when, and your market-data choice. We use this to run your account, bill you, support you and send service messages.

When you pay, we record each bank transfer (amount, date, reference and the months it covers). If a representative introduced you, we record who, so we can pay their commission.

What your server sends us

To keep your licence working, your server regularly sends our account system (the Meta Office): your licence code, restaurant name, contact details, app version, the number of tills in use, and basic usage figures — the number of orders and the sales total over the last 30 days. Support questions you send from the app arrive there too.

Your restaurant's operating data

Sales, menu, stock, supplier invoices, staff and payroll records, bookings, loyalty members, messages and reports are stored on your own Noosh server. If we host that server for you, we operate it (backups, updates, security) but we do not look inside it except to give you support you ask for, or where the law requires it.

Benchmarking (optional, reciprocal)

If you switch on benchmarking in the app, your server sends anonymous ratios (such as average bill, sales per day, cost and margin percentages) together with your city and type of venue, so you can compare yourself with similar restaurants. You appear to other restaurants only as a random code, and nothing is shown from groups smaller than 5.

The market-data programme

Restaurants taking part (all restaurants during the free trial; afterwards only those who keep it switched on) also send anonymous market figures: prices paid for ingredients and supplies, quantities bought by category, supplier names and spend, order frequency and size, menu prices, sales split by category, time and day, new-item performance, brands, payment and channel mix, and ingredient usage. These are combined across restaurants into market reports that we sell or license to suppliers, distributors, brands and industry bodies. Every figure in a report comes from at least 10 restaurants, is rounded and shown as a range, average or share, and never includes your restaurant's name, address or licence code, or any personal information about your guests or staff. Full terms are in section 11 of our Terms and Conditions.

Camera & photos

The app can use your device's camera or photo library so you can scan supplier invoices and menus. You always choose which document to scan. The images are read by Noosh's own AI on hardware we operate in South Africa and are not uploaded to any third-party service.

Website & enquiry information

If you fill in a form on this website, or message us on WhatsApp, we receive what you send us so we can reply. Our website uses only the cookies strictly necessary to function; we do not run third-party advertising or cross-site tracking.

Technical & device information

Our systems record basic technical data — such as IP address, device and browser type, and error logs — to keep the service secure and working. We keep this to the minimum needed.

3. How we share information

We never sell personal information, and we never sell anything that identifies your restaurant. We share information only in these situations:

• Anonymous market reports — through the market-data programme above: combined figures from at least 10 restaurants, never identifying anyone. Buyers are contractually prohibited from trying to identify a restaurant.
• Your representative — if a reseller introduced you, they can see your restaurant's name and contact details, plan and payment status, tills, basic usage figures (orders and sales total over 30 days) and, if we ask them to help with support, your support messages. Never your menu, receipts, guests, staff or payroll.
• Service providers who help us operate — for example the hosting provider that runs hosted restaurant servers and the Meta Office (in Johannesburg, South Africa), and the network that serves this website. They may use information only to provide that service to us, under contract.
• Legal requirements — if we are required by law, court order or a valid request from a competent authority.
• Business transfer — if Noosh is ever sold or merged, information may transfer as part of that transaction, subject to this policy.

4. How we protect information

We use reasonable technical and organisational measures to protect information against loss and unauthorised access — including encryption in transit, access controls with separate permissions for our staff and representatives, and keeping each restaurant's operating data on its own server rather than in one shared store that could be breached at scale. No system is perfectly secure; if a breach affects your information, we will tell you and the Information Regulator as POPIA requires.

5. How long we keep it

We keep account and billing information while you have an account, and afterwards for as long as the law requires (for example tax and accounting records). If we host your server, your operating data remains available for export for 30 days after your account ends and is then deleted. Market reports contain only anonymous, combined figures and may be kept after you leave.

6. Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you and request a copy;
• ask us to correct information that is wrong or out of date;
• ask us to delete information we no longer have a lawful reason to keep;
• object to certain processing, and withdraw consent — after your free trial you can switch the market-data programme off at any time in the app (Benchmark → Sharing & privacy);
• lodge a complaint with the Information Regulator of South Africa.

To exercise any of these, email [email protected] and we will respond within a reasonable time. If your request concerns your own guests' or staff's data kept in Noosh, you control that directly in the app as the responsible party; we will help where you need us to.

7. Children

Noosh is a business tool and is not directed at children. We do not knowingly collect personal information from children.

8. Where your data is processed

Your restaurant's operating data is processed in South Africa — on a Noosh box at your premises, or on a hosted server in Johannesburg. The Meta Office and our account records are hosted in Johannesburg. This website is delivered through a global content network. We do not transfer personal information outside South Africa except as needed to provide the service, and then only with appropriate safeguards.

9. Changes to this policy

We may update this policy. When we make a material change we will update the date at the top and tell you in the app or by email at least 30 days before it applies. A change that widens how your information is used will apply to you only if you agree to it.

10. Contact us

Questions about this policy, or about your information? We would genuinely rather hear from you than not.

Noosh — Information Officer
Email: [email protected]