Last updated 12 November 2026
Privacy
agentPickup is run by Tokenise Pty Ltd (ABN 56 691 028 038), Queensland, Australia. This page covers
agentpickup.app: the shops hosted on it, the hosted MCP servers at /mcp and /mcp/cards, the shop directory and
the partner form. Businesses that run the agentPickup software on their own servers look after their own
customers' information; ask them directly.
Questions or requests: hello@agentpickup.app.
What we collect, and why
| When | What | Why |
|---|---|---|
| You order from a shop here | Your email, your name if you give one, what you ordered, and when it was paid, made ready and collected | To send your receipt and pickup QR, so staff know whose order it is, and so the shop can answer questions about it |
| You pay | The payment reference. For USDC, the paying wallet address and the public transaction. Card details go to Square, or to Stripe at shops that take cards on their own Stripe account, never to us | To match the payment to your order and handle refunds |
| You or your AI agent use the MCP server | What the tools are asked to do: the shop, items and the email to send the QR to. Separately, for 30 days, a count of what was asked with nothing personal in it (search words, suburb, shop, items, and any error), to see what people look for and where it fails | To place and track the order, and to improve the service |
| You fill in the partner form | Your email, the kind of business and your note | To reply to you |
| An assistant searches for shops, reads a shop's menu, or tries to order | For 30 days, counts for each shop: the words searched, menu reads, and orders the shop turned away (closed, or an item it doesn't sell). Nothing about who searched | So each shop can see what people ask for near it |
| Our long-term statistics | The same counts across all shops, with each search's words and its suburb or an area of about 2 km: kept day by day for up to two months, then as monthly totals in which a word or place used fewer than 3 times that month is dropped. And for each order: the shop, what was ordered, the total, when it was paid, made ready and collected, how it was paid, and which assistant or app placed it. Never your email, your name, your payment details or a dietary note | To see what people look for and where, which assistants bring orders, and how reliably orders are made and collected |
| An assistant asks agentPickup a question about a shop | The question is answered and not kept. We count only its topic (dietary needs, allergies, reviews, hours, parking, wait times, prices) and any dietary need or allergen it names, for 30 days | To answer it from what the shop has said, and so each shop can see what people want to know |
| A shop with no POS signs up | The email it signs in with; the shop's name, address, phone, opening hours and menu, with any photos it uploads | To sign the shop in with a one-time link (no password), to email it each new order, and to show the shop and its menu to assistants |
| A shop uses its seller dashboard | Counts from that shop's own orders: what sold, when, how fast orders were ready and collected, and how many customers ordered more than once | So each shop can see how it's doing |
| Staff use the scanner page | A cookie that keeps that device signed in | So staff don't sign in on every scan |
| You visit the site | Page counts from Cloudflare Web Analytics on the home page. It sets no cookies and doesn't follow you to other sites. Your IP address is held in memory for a minute to limit abuse | To see how many people visit, and to keep the service up |
The shop you order from sees your name, what you ordered and your pickup code, on its staff scanner and its seller dashboard. It also sees counts from its own orders, such as how many customers came back. To count those we match orders by email, and the shop never sees your email. No shop sees another shop's orders or customers. A shop with no POS also gets an email for each paid order, with what was ordered, the name you gave and your pickup code. It doesn't get your email. A shop also sees the words people searched for near it, once a word has been searched at least 3 times. It never sees who searched. We don't sell your information or use it for advertising.
Social links on pickup passes and order emails go through agentpickup.app, which counts the click for the shop and sends you on. We don't record who clicked.
Who else handles it
- The shop you ordered from, which is responsible for your order.
- Square, when a shop is connected to it: the order with your name, so it shows on the shop's own screens. If you pay by card, Square also processes the payment, with your card details and your email, to check the payment. Apple Pay and Google Pay, if you use them, pass your card to Square under Apple's or Google's own terms.
- Stripe, when a shop takes cards on its own Stripe account: Stripe processes the payment for that shop. The card details and email you give on Stripe's checkout page go to Stripe and the shop, not to us. When a shop connects Stripe, we send Stripe the shop's name and sign-in email to start its account, and Stripe asks the shop for everything else itself.
- Railway hosts the site and stores orders.
- Supabase stores our long-term statistics: anonymous counts, and order details without your email, name or payment details.
- Cloudflare runs the domain, sends our emails, counts page visits and stores the menu photos shops upload.
- OpenStreetMap: a shop's street address, when a shop with no POS gives it, to put the shop on the map. Nothing about customers.
- PayAI settles USDC payments. It sees the payment, not your email.
Some of these services store information outside Australia, including in the United States.
USDC payments are recorded on the Base blockchain, which is public. A blockchain record can't be changed or deleted by us or anyone else.
How long we keep it
Orders are kept while the shop runs on agentPickup, so the shop can answer questions and keep its records. The emails we send you, your receipt and pickup pass, are kept for 90 days in case you need help, then deleted. Our long-term statistics keep nothing that names you: daily counts for up to two months, then monthly totals. Partner form entries are kept until you ask us to remove them. Payment records may need to be kept longer for tax and accounting.
Your choices
Email hello@agentpickup.app to see what we hold about you, correct it, or have your email and name removed from your orders. If you're not happy with how we've handled your information, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
If this page changes, the date at the top changes with it.