Before you start
What you need
| Item | Provided by | Notes |
|---|---|---|
| POS device | Store owner | A tablet or counter computer with a modern browser (Chrome, Edge or Safari). One active POS device per store. |
| Store POS address | Your implementation contact | e.g. pos.magicmassage.com.au — bookmark it on the POS device |
| Device activation code | Store owner / implementation contact | A 6-digit, time-limited code that binds this device to your store. Used once per device; afterwards the device signs in each day with a separate device PIN, which locks for 15 minutes after 3 wrong attempts. |
| Your operator PIN | Store manager | Your personal 4–6 digit code. Managers create and reset PINs in Admin. |
| Your work email | Store manager | Used for your one-time Staff Portal sign-in link. It must match your active employee profile. |
| Staff Portal address | Your manager | e.g. staff.magicmassage.com.au — the sign-in link in your email opens here. |
| Admin account (managers/owners) | Implementation contact or tenant admin | Email + password login at admin.magicmassage.com.au; MFA if your store requires it |
| Network | Store | Stable internet. POS is a web app — if the network drops, finish the action again once it's back; duplicate submissions are blocked automatically. |
Security principles
These rules protect you personally — POS records each action under the selected operator, or under the PIN-verified operator when verification is required.
- Never share your PIN. Not with colleagues covering your break, not with managers. When POS asks for PIN verification, the verification and resulting action are recorded under your name.
- Three wrong PIN attempts locks the PIN for 15 minutes. This is brute-force protection, not a bug. If you genuinely forgot your PIN, ask your manager to reset it in Admin instead of guessing.
- Sensitive or elevated actions ask for a PIN — for example, adjusting a price, refunding or completing Final Settlement. Routine lower-risk actions can continue under the selected operator without another PIN entry.
- Don't photograph or screenshot customer details. Customer phone numbers, emails and health information are protected under the Privacy Act. The system encrypts them at rest; keep them off your camera roll.
- Walk away = log presence away. On shared devices, return to the operator screen when leaving the counter.
Roles at a glance
Employees can review their own roster, clock records, provisional pay and Store roles in Staff Portal. There they can also submit or cancel their own future time-off requests and mark a future shift as seen. The portal never changes the roster, pay or a clock record; the operational permissions below still apply on POS or in Admin.
This table is store policy, not a system block: apart from settlement management (listing reopen requests, requesting a reopen, amending a draft settlement — manager or owner only), POS gates by PIN verification and an active shift, not by role. Role restrictions on POS are enforced in the interface and by your store's rules (see Permissions matrix for the full table).
| Action | Receptionist | Therapist | Store manager | Owner / tenant admin |
|---|---|---|---|---|
| Create visits | ✓ | ✓ | ✓ | ✓ |
| Take payments | ✓ (PIN for elevated methods) | ✓ (PIN for elevated methods) | ✓ (PIN for elevated methods) | ✓ (PIN for elevated methods) |
| Adjust / transfer a running service | ✓ (PIN) | ✓ (PIN) | ✓ (PIN) | ✓ (PIN) |
| Refund a payment | ✓ (PIN + reason) | ✓ (PIN + reason) | ✓ (PIN + reason) | ✓ (PIN + reason) |
| Run Pre-Settlement | ✓ | — | ✓ | ✓ |
| Complete Final Settlement | ✓ (PIN) | — | ✓ (PIN) | ✓ (PIN) |
| Approve settlement correction / cash variance | — | — | ✓ (in Admin, not self) | ✓ |
| Edit services, prices, staff, rosters | — | — | ✓ (Admin) | ✓ |
| See reports across stores | — | — | — | ✓ |
Why can't I approve my own correction request? Separation of duties: the person who completed Final Settlement can't also approve a correction to it. A second set of eyes is required for a new version of a settled period.