These terms are the agreement between Plink and the organisation that uses it to run a till. Throughout, "you" means that organisation and "we" means Plink. If you are setting Plink up for a club, a camp, a festival or a company, you are agreeing to these terms on its behalf and you are confirming that you may do so.
Guests whose tags are tapped are not party to this agreement. Their relationship is with you.
Who we are
Plink is in development and is not yet sold. Reach us at hello@plinkapp.co.uk, which is the address to use for anything in these terms, including anything about your guests' data.
What Plink is
Plink is till software. A tag, which may be a wristband, a card or a sticker, is tapped to record what a guest has taken, and the record accrues against that guest as a tab. Plink keeps that record, shows it to your staff, and reports it back to you.
Plink does not take payments, hold money, issue any payment instrument, or move funds between anybody. It records what is owed. Everything after that, including collecting the money, is yours to do. Nothing in the software is a payment service and nothing in it is credit provided by us.
Your account
You need an account to run an event, and the person who creates it owns the organisation it belongs to. Ownership can be transferred from within the app and should be, if that person leaves. Keep sign-in details to the people who need them, and tell us promptly if you think an account has been compromised. You are responsible for what is done on your accounts, including by your staff and by any till device you have provisioned.
Till devices sign in with credentials the app issues. Those credentials rotate whenever a till is re-provisioned, and a device you no longer control should be suspended from the app rather than left signed in.
What you are responsible for
Plink is a tool. Running the event lawfully is your job, not ours, and specifically:
- Licensing. If alcohol is served, you hold the premises licence, the club premises certificate or the temporary event notice, and you have a designated premises supervisor where one is required. We do not check any of this and cannot.
- Age. You verify the age of anyone served an age-restricted product, at the point of service, by a person. Plink does not verify age. Do not leave a self-service screen unattended with age-restricted items on the menu.
- Prices. You are responsible for displaying prices to your guests as the law requires. The option to hide prices on a till screen is a display preference for the queue and is not a substitute for a price list your guests can see.
- Tax. All tax arising from what you sell, including VAT where you are registered, is yours to account for. We do not calculate or report tax, and the figures the app produces are a record of what your tills did, not a tax return.
- Your guests' data. You decide what is collected about your guests and why. See the data protection section and Schedule 1.
- Your staff. You decide who gets a till, what each till may do, and who is on the operator roster.
Tabs and settling up
A tab is a record of what a guest has taken and has not yet paid for. When you settle up, the arrangement is between you and that guest.
You must not charge interest, a late fee, an administration charge or any other fee on an unsettled tab. This is not a preference. A tab settled in one payment, without charges, sits within a narrow exemption from consumer credit regulation; adding a fee takes it outside that exemption, which makes it credit you are not authorised to provide and leaves the amount unenforceable without a court order. Plink deliberately provides no field for such a charge, and adding one outside the app is a breach of these terms.
You may set a cap on how much any one tab can reach. The cap is enforced when a till can reach our servers, and a till that has lost its connection checks against the last figure it saw. A tab can therefore exceed its cap by a small amount during a loss of signal. If that matters to you, set a lower cap.
Working without a connection
Plink is built to keep selling when the network does not. Sales taken offline are held on the device and sent when it reconnects, and they are recorded once however many times they are retried.
Two consequences follow and you should plan for both. Figures shown anywhere are provisional until every till has reconnected, so do not treat a total as final while a device is still out. And a device kept offline holds whatever it last knew: a member of staff removed from a till that never reconnects keeps the access it had until it does.
Tags
Plink reads the identifier a tag broadcasts and nothing else. It never writes to a tag and nothing is stored on one. Any tag you already own that broadcasts a readable identifier will work, and we do not supply tags.
An identifier is not a secret. It can be read by any ordinary phone held near the tag and it can be copied onto another tag with cheap equipment. Treat a tap as identification, not as authorisation. Do not rely on a tag alone to authorise anything that matters, and set a tab cap so that a copied tag has a bounded cost. Staff authority in the app comes from the signed-in device, not from a tag.
Data protection
For the personal data of your guests and your staff that Plink processes in running your events, you are the controller and we are your processor. Schedule 1 below sets out the terms on which we process it, and forms part of this agreement.
We are separately a controller of your own account data, meaning the details of the people who sign in, and of billing and support correspondence. Our privacy notice explains that.
If your guests include children, or if the events you run make consumption records particularly sensitive, the assessment of that is yours to make as controller. We will help with the information we hold.
What you must not use Plink for
- Providing payment services, issuing electronic money, or providing credit as a regulated activity.
- Any balance or debt that a guest can carry between different organisations, which is a regulatory boundary rather than a missing feature.
- Profiling individuals for health, employment, insurance or wellbeing purposes on the basis of what they consumed.
- Anything unlawful, and anything that would put us in breach of an obligation we owe to someone else.
Fees
Plink is currently provided free of charge. If that changes we will tell you before it applies to you, and you may stop using the service rather than pay. Nothing here obliges you to pay anything you have not agreed to.
Availability and support
We do not promise that the service will be uninterrupted or error-free, and we do not offer a service level. It runs on Google Firebase and on Netlify, and it is affected by their availability as well as ours. Support is by email at hello@plinkapp.co.uk, on a reasonable-endeavours basis.
Plink is a young product run by one person. Where an event matters, run it as you would run any event whose till might fail: know what you would do with a paper list, and export your data afterwards rather than leaving it as the only copy.
Suspension and ending the agreement
You may stop using Plink at any time, and you can delete your events and your account from within the app. We may suspend an account that is being used in breach of these terms, or where we are required to, and we will tell you why unless we are prevented from doing so.
Export anything you want to keep before you delete it. Deletion from within the app is immediate and is not reversible by us.
Liability
Neither of us limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for anything else that cannot lawfully be limited. That includes any liability either of us owes directly to an individual or to a regulator under data protection law, which nothing in this agreement affects.
Subject to that, we are not liable for loss of profit, loss of revenue, loss of anticipated savings, loss of goodwill, or for any loss that was not reasonably foreseeable when you started using Plink. In particular we are not liable for takings you do not collect, for a tab a guest disputes or does not pay, for a tag that has been copied, or for anything arising from your obligations in the "What you are responsible for" section above.
Subject to the same, our total liability to you for everything arising in any twelve-month period is limited to the greater of the fees you paid us for the service in that period and five hundred pounds.
We have set a cap rather than excluding liability altogether, because a cap is what the law asks us to justify and this one is proportionate to a service supplied for nothing or for a small fee. If you need a higher cap, ask, and we will discuss it before your event rather than after it.
Changes to these terms
We may change these terms. If a change materially affects you we will tell you by email at the address on your account, at least thirty days before it takes effect, unless the change is required by law sooner. Continuing to use Plink after that is acceptance. The date at the top of this page always says when it last changed.
General
These terms, with Schedule 1 and the privacy notice, are the whole agreement between us. If a part of them is unenforceable the rest continues. Neither of us may transfer the agreement without the other's consent, except that we may transfer it to whoever takes over the Plink business. Nobody other than you and us has any right to enforce it.
The agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Schedule 1
Data processing terms
Forms part of the terms of service above
This schedule is the agreement required by Article 28(3) of the UK GDPR. It applies wherever we process personal data on your behalf.
What is processed
- Subject matter
- Providing Plink's till, tag and reporting software to you.
- Duration
- For as long as you hold an account with us, plus any retention period you have set on an event.
- Nature and purpose
- Storing, organising, retrieving and deleting records so that a tap on a tag can be matched to a guest and a tab can be kept, reported and settled.
- Types of personal data
- Guests: name, and an email address or telephone number where you collect one; the identifier of the tag assigned to them; and the items, times, prices and refunds recorded against that tag. Your people: name, email address, role, the salted hash of an operator PIN, and which device recorded which sale.
- Categories of data subject
- Your guests, your staff and your volunteers. Where you register children, children.
- Special category data
- None is required by the service. Do not put any into a name field or a menu item.
Our obligations
- Instructions. We process personal data only on your documented instructions, which are these terms and your use of the app, and to comply with a legal obligation. If we think an instruction breaches data protection law we will tell you.
- Confidentiality. Everyone we authorise to process your data is bound by a duty of confidence.
- Security. We keep appropriate technical and organisational measures, described below.
- Sub-processors. We use the sub-processors listed below. You authorise them generally, and we will give you at least thirty days' notice by email before adding or replacing one, during which you may object and, if we cannot resolve it, terminate. Each is bound by terms no less protective than these.
- Data subject rights. We help you meet requests from individuals. The app itself lets you find, correct, export and erase a guest's record without asking us. If a request reaches us directly we pass it to you rather than answering it, unless you have asked us to help.
- Breaches. We tell you without undue delay, and in any event within seventy-two hours, of becoming aware of a personal data breach affecting your data, with what we know and what we are doing. Notifying the Information Commissioner is yours to do as controller, and we will give you what you need to do it.
- Assessments. We help you with data protection impact assessments and with prior consultation, taking into account what we know and what is available to us.
- Deletion and return. On the ending of the agreement we delete your data, or return it, at your choice. Say which within thirty days; after that we delete. Backups age out on their own cycle and are not accessed in the meantime.
- Audit. We make available what you need to show compliance and will answer a reasonable security questionnaire once a year. Where an inspection is genuinely required, we will agree a scope and timing with you.
Sub-processors
- Google Ireland Limited (Firebase). Hosting, database, file storage and sign-in. Event data is held in the European Union. Sign-in accounts, which are your people rather than your guests, are handled by Google's identity service and may be processed outside the United Kingdom.
- Zoho Corporation. Sends account emails to the people who sign in, and therefore sees a name and an email address. Your guests' details never reach it.
- Netlify, Inc. Serves this website and the web dashboard.
Transfers out of the United Kingdom
Event data stays in the European Union. Where a sub-processor processes personal data outside the United Kingdom, that transfer is made under the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or under the UK International Data Transfer Agreement, in each case with a transfer risk assessment. The transfer that arises in practice is the handling of sign-in accounts by Google's identity service.
Security measures
- Data in transit is encrypted with TLS. Data at rest is encrypted by the hosting provider.
- Access is controlled per organisation and per event, and enforced on the server rather than in the app. An account can only ever reach its own organisation's data.
- Prices, totals and refund limits are calculated and enforced on the server, so a device cannot write a figure of its own choosing into the ledger.
- The record of sales is append-only. Corrections are recorded as further entries rather than by editing history.
- Administrative actions are written to an audit log that names who did what and when.
- Till device credentials are never stored by us in a readable form and are rotated whenever a device is re-provisioned. A lost device can be suspended, which cuts it off at its next request.
- Operator PINs are stored only as a salted hash. A PIN attributes an action to a person on a device you control; it is not a credential and it protects nothing on the server.
- Guest records can be erased individually, and an event can be deleted in full, from within the app.
Retention
We keep your data for as long as you keep your account, or for the retention period you set on an event, whichever is shorter. You can delete an event, a guest or your whole account from within the app at any time, and deletion is immediate. Where you ask us to delete something instead, we act within thirty days.