1. About 6Seveen and this policy
6Seveen is a point-of-sale application for food and beverage businesses, developed under the 21Kent brand. The product remains in internal/pilot use and has not been announced as generally available to customers. This interim information is not a final privacy policy.
Before the service is offered to customers, the final version must identify the legal service operator, explain each party’s role in relation to data, and state an effective date. 21Kent is a developer brand, not a statement of a legal entity name.
2. Data that may be processed
Depending on the features used, 6Seveen may process information entered by users or created during outlet operations, including:
• Account and outlet data: account name or email, outlet identity, settings, roles, permissions, and devices used.
• Operations: menus, categories, variants, prices, orders, tables, recorded payments, discounts, shifts, cash, stock, recipes, expenses, receivables, reports, and change records.
• Staff data: names or labels, accounts, roles, permissions, assignments, attendance, and information needed to manage access.
• Customer data: information a business chooses to record, such as a name, contact number, order note, marketing consent, or receivable information.
• Device and diagnostic data: technical device identifiers or type, app version, connection state, and diagnostic messages used to support operations and troubleshooting.
• Attendance location: if a business enables the optional attendance-location setting, the app may use device location when a staff member performs an attendance action that requests it. This setting is not always on.
3. Processing on devices and in cloud services
Operational data is created and managed on the Android device designated as the outlet’s Main Device. Other paired devices may keep operational data needed for their tasks. Device data can include orders, menus, staff, transactions, reports, and other information chosen by the outlet.
If cloud services and synchronization are available to an outlet and enabled, selected data may be sent to 6Seveen cloud services. The 6Seveen cloud VM reviewed for this interim information is in Batam, Indonesia. This identifies that VM only; processing locations for Cloudflare, Google, and other providers have not all been verified. Cloud features depend on the app version, configuration, and access granted; having the app or an account does not mean all data is always synchronized. Device and cloud copies may differ when a connection is interrupted or processing has not finished.
4. How data is used
Data is used to operate accounts and outlet workflows, connect devices, keep operational records selected by the business, display reports, support service security and stability, troubleshoot issues, and respond to questions sent to support.
A business that enters staff or customer data is responsible for giving those people relevant information and ensuring it has authority to use the data. The parties’ legal roles will be described in the final version after review.
5. Payments and customer communications
The app may record a payment method and amount entered by an operator. A recorded entry does not itself process a payment or confirm that funds were received.
Dynamic or provider-verified QRIS, SMS or email receipt delivery, and feedback services are not currently available to customers. Do not enter card numbers, bank passwords, payment PINs, or other payment secrets in free-text notes.
6. Device permissions and location data
The app may request Android permissions needed for features in use, such as camera, device/printer connections, notifications, or location for the optional attendance feature. Permission availability depends on the device and Android version. Users can manage permissions in device settings; denying a permission may limit the related feature.
Attendance location is an option controlled by the business. This interim notice does not state that 6Seveen tracks location in the background.
7. PINs, security, and device protection
PINs help manage staff access and authorize selected actions. A cloud review found legacy PIN material in some configuration records and manager PIN verifiers in some records. The current server rejects new writes through the reviewed cloud-configuration path, but removal of all historical records has not been verified. This interim notice therefore does not say that legacy PINs or verifiers have been removed or that all PINs use a particular storage format. Users should protect their PINs, passwords, and devices, assign access only as needed, and promptly change or revoke access that has been shared or is no longer required.
6Seveen uses HTTPS for app-to-cloud communication. Protection differs by data type and storage location; this policy does not promise end-to-end encryption or risk-free security. Outlets should also limit physical access and protect their devices and local network.
8. Service providers and other parties
The reviewed 6Seveen cloud service and database run on an Oracle Cloud VM in Batam, Indonesia. Cloudflare is also involved in 6Seveen domain DNS/edge and email routing. Processing locations, log retention, and the complete Oracle and Cloudflare subprocessor details have not all been verified. These providers’ involvement does not mean that all data is processed or stored only in Indonesia; transfer arrangements and the provider list must be reviewed before this policy takes effect.
Google Drive Backup is not currently available to customers. If the feature is later offered, the app and applicable policy must explain the data sent to the user’s Google account before the user chooses to connect it.
Payment, SMS, transactional email, advertising, and third-party analytics providers are not identified here as active 6Seveen customer services. The final provider list will reflect services actually used.
9. Google Drive Backup
Google Drive Backup is not currently available to customers. The app and documentation contain a design for optional backup, but real Google account use and backup transfers have not become an approved customer service. Do not rely on it as an outlet data copy.
If this service is prepared for a future release, 6Seveen will update the policy and explain the data, Google account permissions, file protection, recovery steps, and deletion choices before offering the feature.
10. Retention and deletion
Data on a device may remain until removed through an app feature or device management. The customer-data review setting in the app helps a business identify records for review; it does not automatically delete them.
Cloud sessions have a seven-day validity period. An expired session row is removed when its token is accessed or when access is revoked, so expiry is not a physical-deletion deadline. Client diagnostic logs have a best-effort cleanup threshold of 14 days triggered by a later log append; this does not guarantee deletion exactly on day 14. Infrastructure-log retention is unknown. No general expiry for cloud operational records has been verified. Scheduled server database backups are operational copies; deleting primary data does not remove backups already created, and this interim notice does not promise how long deleted data remains in them. The customer-record review setting does not automatically delete records. The tested tenant-erasure utility is not customer self-service and has not been shown to run in production. Copies on other devices or external services are not automatically removed.
A deletion request to a primary service does not automatically remove copies already stored on other devices or external media. This interim notice sets no confirmation or completion deadline.
11. Choices and data requests
Users may request information about data relating to them, request correction or deletion, withdraw consent where relevant, or raise an objection under applicable law. Outlet Owners manage staff accounts and operational data entered into their outlet.
To send a question or request, email [email protected] with the subject “6Seveen Privacy Request”. The domain has an inbound email route, but a workflow for logging, identity checks, export, correction, deletion, case ownership, and request completion has not been verified as an operating service process. Sending an email does not prove that a request has been accepted for processing or completed. Do not email passwords, PINs, recovery codes, or payment information. This interim notice promises no deadline.
12. Children’s data
6Seveen is intended for business operations, not as a service specifically designed for children. A business should avoid entering children’s data unless it has the required basis and authority. Any specific notices and protections will be completed in legal review before this policy takes effect.
13. Policy changes
If this policy is approved and takes effect, its version and effective date will appear on this page. The method for notifying users about changes must be established before general availability.
14. Privacy contact
For privacy questions or requests, email [email protected]. An inbound email route exists, but receipt does not establish a process for following up on or completing a request. This interim notice promises no response time. The service operator and request-handling process must be established before the final policy is published.