Privacy policy

Register is a till (point-of-sale) product for shops, run by Vereon Ltd ("we", "us"). This page says what Register holds, why, who else handles it, how long we keep it, and what you can ask us to do. Write to us about any of it at info@vereon.tech. Last updated 23 October 2026.

Who is responsible

For your account and your subscription, we decide how the information is used (we are the "controller"). For what a business puts into Register — its products and prices, its sales, and the names, contact details and purchases of the customers who give them — the business decides, and we handle it on their behalf (we are their "processor"). If you bought something from a shop that uses Register, that shop is responsible for your details; send requests about a purchase to them first, and we help them answer. A business that needs a data processing agreement can ask us for one.

What we hold

• Your account: your name, email address and time zone, and your password (stored only as a one-way scrypt hash; Register runs its own sign-in). If you sign in with Google, Google's id for you; with Microsoft, Microsoft's id for your account (and its organisation's). Whether your email is confirmed, and which businesses you belong to with what role.
• What your business puts in: products and services, prices, photos, stock, suppliers and purchase orders, discount codes, the till's settings (the name of your card machine, the QR code you show customers, your returns policy), and who on the team did what and when.
• Sales: what was sold and at what price, how it was paid (cash, card or QR code, the change given, and any reference typed in, such as the last four digits your card machine shows), who served, and any returns, voids and refunds. Every sale keeps a copy of what was sold and at what price, so the record stays true even after you edit your products.
• Customers who give their details: most sales have no name at all. When a customer gives a name, email address or phone number at the till, to get their receipt or to be remembered, the business keeps it in its customer book with their visits and any notes the team writes. A trade customer's details are also on the invoices the business sends them.
• Receipts: each sale's receipt, with a private link (and a QR code) that opens it as a PDF. Anyone holding the link can open that one receipt, so it is long and unguessable, and it stops working if the customer's details are erased.
• Emails and messages we send for you: receipts, return confirmations, review requests, the other automations a business switches on, and invoices — each recorded against the sale so nothing sends twice. The same goes for WhatsApp messages when a business has turned WhatsApp on, along with what each one cost. Customers' replies, and the emails a business forwards in, are kept in its Inbox.
• A business's sending mailbox: if a business sends its emails from its own address, the sign-in that lets Register send as it (Google or Microsoft access tokens, or SMTP details), encrypted.
• Reggie and connected AI assistants: what you ask Reggie, his answers and the changes you approve, kept for a short while so a conversation can carry on; and which AI assistants (Claude, ChatGPT, Gemini) you have connected to Register. Changes made through them are recorded under your name.
• Running the service: technical logs (time, address, errors) kept to keep Register working and secure. We don't track the pages you visit, and there is no advertising or analytics — on the till, the dashboard or the receipts.

Why we use it, and on what basis

• To provide the service you signed up for — ringing up sales, keeping the stock count, making receipts, sending the emails and WhatsApp messages a business switches on, billing the subscription: because it is needed to perform our contract with you or your business.
• To keep Register secure, prevent misuse and fix faults: because we have a legitimate interest in a safe, working product, which doesn't override your rights.
• To keep financial records: because the law requires it.

We do not sell your information, use it to advertise to you, or use it to train AI models. A shop's customers' details are never used by us to market to them.

Google user data

Register asks Google for as little as it can, and only when you choose to use Google:

• Signing in with Google (openid, email, profile): we read your name, email address, whether Google has confirmed that address, and Google's id for you, to sign you in or create your account. We keep no Google token afterwards.
• Sending a business's emails from its Gmail (gmail.send): we send that business's receipts and other emails to its own customers from its address, so they appear in its Sent folder. Register can only send: it never reads, searches, changes or deletes anything in the mailbox. The access it needs is stored encrypted, and is deleted when the business disconnects the mailbox or is closed. You can also remove Register's access at any time from your Google Account's security settings.

We don't share Google user data with anyone, use it for advertising, sell it, or use it to train AI models, and no person at Vereon reads it unless you ask us to help with a problem or the law requires it. Register's use and transfer of information received from Google APIs adheres to the Google API Products User Data Policy, including the Limited Use requirements.

Microsoft user data

• Signing in with Microsoft (openid, email, profile): we read your name, email address, whether Microsoft has confirmed that address, and Microsoft's id for your account, to sign you in or create your account. Signing in gives Register no access to your mailbox or files, and we keep no Microsoft token afterwards.
• Sending a business's emails from its Microsoft 365 or Outlook.com mailbox (Mail.Send): Register only sends that business's receipts and other emails, and never reads the mailbox. The access it needs is stored encrypted, and is deleted when the business disconnects the mailbox or is closed.

Reggie and AI

Reggie, Register's assistant, runs on Amazon Bedrock in London: your questions and the parts of your business he needs to answer them stay in the UK under AWS, are not kept by the model provider, and are not used to train any model. AI assistants you connect yourself (Claude, ChatGPT, Gemini) see what you ask them to fetch from Register, under their own privacy terms. Neither can ring up a sale, take a payment or give a refund, and neither can reach billing, payment settings, passwords, sign-in settings or customers' contact details.

Payments at the till

Money for a sale moves directly between the customer and the business: cash into the drawer, a card through the business's own card machine, or a payment into the business's own account through the QR code it shows. Register records what the business tells it (the amount, the way it was paid and any reference typed in) and never holds the money. A card is only ever put into the business's card machine, under its provider's own terms: Register never sees a card number, a PIN or anyone's bank balance.

Who else handles it

The people in your business see it according to their role. These providers handle it for us, each only as far as their job needs:

Nobody else, unless the law requires it. A business's card machine provider, and the bank or wallet behind its QR code, are its own, under its own agreement with them: Register sends them nothing.

Sending data outside the UK

Register runs in the UK (AWS London, eu-west-2), so your data mostly stays here. Stripe handles subscription billing in the EU and US, and the optional providers in the table above (Google, Microsoft, Telnyx and Meta) work where it says, only when you or a business choose them. When data leaves the UK it is protected the way UK law requires, by the UK's adequacy regulations (including the UK–US data bridge) or by the International Data Transfer Agreement or Addendum in our contract with the provider. Ask us for details.

How long we keep it

Your rights

• See and take your data: your products, sales and customers are visible in the dashboard, and the owner and admins can export sales and customers as CSV. For a copy of everything we hold about you, write to us.
• Correct it: your own details are editable in Your profile, and the owner and admins edit the business's under Settings. A shop's customer asks the shop, which corrects them on their customer record.
• Delete it: you can delete your account from Your profile, and a business owner can close the business from Settings, which deletes it and its records straight away. A business's owner or admins can erase one customer's personal details from that customer's page; the money records stay, without a name, because tax law requires it. A shop's customer can ask the shop to do that.
• Object, or ask us to restrict how we use it: write to us.

We answer within a month. You can also complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, your own data protection authority. If you are a shop's customer, point your request at the shop first — the sale is theirs — and we will help them answer it.

Cookies and storage in your browser

Register sets no advertising or analytics cookies, so there is nothing to opt into. The till and the dashboard keep what they need to work in your browser: your sign-in, which of your businesses you last had open, and the till's own working state on that device. A receipt's link sets nothing at all.

Security

Everything travels encrypted. Passwords are stored only as one-way hashes, receipt links are long and unguessable, and every record carries the business it belongs to, checked on every request. If something ever went wrong with your data, we would tell the Information Commissioner's Office within 72 hours and tell you without delay if it put you at risk.

Children

Register accounts are for businesses, and you must be 18 or over to run one. A shop's customers don't have accounts; a shop that takes the details of under-18s is responsible for doing so lawfully.

Changes

If this page changes in a way that matters, we tell business owners by email first.