Privacy policy
Last updated 7 September 2026.
Controller
TillProof is operated by SNOW MONSTER, S.L. (NIF/CIF B44654275), Carrer Nou de la Rambla 30, 1º 2ª, 08001 Barcelona, Spain. Privacy contact: seb@snowmonster.es.
Data we process
We process account identity and contact details, venue and team configuration, till-close records and revisions, invitations, support and privacy requests, subscription identifiers, security records and essential product events. Passwords are salted hashes; session tokens are stored as hashes. Payment-card details are handled by Stripe and are not stored by TillProof.
Purposes and legal bases
We process account, workspace, closing, support and billing data to perform the TillProof contract and provide requested features. We process security, abuse-prevention, service-reliability and minimal product events where necessary for our legitimate interests in operating and protecting the service, balanced against user rights. We retain billing and other records where required by law. Optional communications or features that require consent are processed on that basis where applicable.
Customer workspace data
For personal data that a business customer enters into TillProof on behalf of its staff or other people, the customer normally acts as controller and SNOW MONSTER, S.L. acts as processor. The Data processing terms form part of the service terms for that processing. Customers must have a lawful basis for the personal data they enter and should avoid unnecessary sensitive information in close notes.
Recipients and processors
We use service providers as needed to operate TillProof, including Vercel for application hosting, Neon for database hosting, Resend for transactional email and Stripe for subscription billing. They receive only the data needed for their role and operate under their applicable contractual and data-protection terms. We may also disclose data where required by law or to protect legal rights.
International transfers
Some service providers are international organisations. Where personal data is transferred outside the EEA, the transfer must use an applicable GDPR Chapter V mechanism, such as an adequacy decision or appropriate contractual safeguards used by the relevant provider.
Retention
Account and workspace data is kept while the service is active and afterwards only for periods needed for contractual, security, dispute or legal obligations. Financial close revisions are intentionally durable because auditability is a core feature; customers can export records and request deletion, subject to legal retention requirements. Security, rate-limit and operational records are retained only for the operational or legal period for which they are needed.
Your rights
Where GDPR applies, you may request access, rectification, deletion, restriction, portability or objection as applicable by contacting seb@snowmonster.es. Where processing is based on consent, you may withdraw it without affecting earlier lawful processing. You may also complain to the Agencia Española de Protección de Datos (AEPD) or another competent supervisory authority.
Required data and automated decisions
Account and core workspace data is necessary to create and operate the service; without it, TillProof cannot provide the requested account or closing workflow. TillProof does not make decisions producing legal or similarly significant effects about people through automated profiling. Reconciliation and likely payment-method explanations are operational inferences about entered totals, not decisions about individuals.
Cookies
TillProof uses an essential secure session cookie and a language-preference cookie. It does not require advertising cookies to operate.