Privacy policy

1. Who this policy covers

This policy applies to the Business POS website at pos.business, the owner dashboard, the web app at app.pos.business and the Business POS Android app.

For the information about you that we collect when you create an account and use the Service, we act as the party responsible for that information.

For the information that a shop records about its own customers, suppliers and staff, the shop decides why and how that information is collected and used. We store and process that information on the shop's behalf, and we follow its instructions. The shop must tell those people how it uses their information.

2. What we collect when you create an account

Your full name, email address, and, if you choose to give them, a phone number and an address.

Your password. We store it only in a one-way protected form, which means we cannot read it, and we cannot send it back to you.

The date and version of these terms, the Privacy policy and the Policies that you agreed to when you signed up.

Your sign-in sessions, including the name of the device you signed in on, the time, and whether you chose to be remembered on that device.

3. What you record in the Service

Shop information: the name, currency, time zone, address, phone, email, tax settings and receipt header and footer of each shop.

Products: names, SKUs, barcodes, prices, categories, stock levels, stock adjustments with reasons, and photographs you upload.

Sales: invoices, items, quantities, prices, discounts, tax, payment methods, cash received, change given, refunds, voids, and the person who recorded each one.

Customers and suppliers: names, phone numbers, addresses and purchase or delivery history.

Expenses: amounts, dates, categories and notes.

Team members: names, email addresses, phone numbers, roles, the shop they work in, and their status.

4. What we collect when you buy a licence

The licence term you choose, the amount, and the date of your payment.

The screenshot of the payment that you upload to show us that you have paid. The screenshot may show your name and account details, so please crop it to show only the payment information.

We do not receive your KBZPay PIN, your mobile banking password, or your bank password. Please never send us these details.

5. What we collect when you contact us

Messages you send through Support chat, and our replies, which are kept so that we can help you and keep a record of what was agreed.

6. What we collect automatically

Technical information needed to run and protect the Service, such as your IP address, the time of each request, request identifiers, browser or app version, and error information.

Security records of sign-in attempts, password resets, and other account events, which we use to detect misuse and to limit repeated attempts.

Usage of the Service that helps us keep it working, for example which screens fail to load.

7. What the phone handles on its own

Fingerprint and face lock: the check is done by your phone's own system. Business POS only receives a yes or a no. We never receive, store or see your fingerprint or face.

Camera: used only to scan barcodes when you choose the camera scanner. Images from the camera are not sent to us.

Bluetooth and local network: used to connect the receipt printers and Bluetooth scanners that you choose to pair.

Offline storage: a copy of your products and customers, and sales waiting to be sent, are kept on the phone until they reach the Service. The phone also keeps your sign-in in protected storage.

Notifications: the app may show notifications on your phone, which you can switch off in your phone settings.

8. Why we use the information

To create and run your account, shops, team and licence, and to show your records to the people you allow.

To send you the notifications and messages that the Service needs, such as low stock alerts, licence reminders, password reset emails and support replies.

To check payments and activate licences.

To keep the Service secure, prevent fraud and misuse, limit repeated sign-in attempts, and investigate problems.

To keep records that show what each person agreed to, and when.

To improve the Service, using information that does not identify you wherever possible.

To comply with the law, and to respond to lawful requests from authorities.

9. What we do not do

We do not sell your personal information.

We do not use the customer information that a shop records for our own marketing.

We do not show advertising based on your information.

We do not ask for, or store, your fingerprint, face data, PIN or bank password.

10. Who we share information with

Hosting: DigitalOcean, which runs our servers in its data centre in Singapore.

Website delivery and security: Cloudflare, which sits in front of our website and may see technical information such as IP addresses.

Email: Zoho Mail, which sends account, password reset and service emails on our behalf.

Backups: copies of our backups are stored with Google Drive.

Card payments, when they are switched on: Dinger, which processes card payments on its own payment page. Card details are entered on Dinger's page, not on ours.

Authorities: where the law requires us to disclose information, or where it is needed to protect people from serious harm.

Our providers may use the information only to provide their services to us, and they must protect it.

If the Service were transferred to another provider, the information would transfer under the same protections, and we would tell you.

11. How long we keep information

Account and business records: while your account is active, and for two years after it is closed, unless the law requires a longer period.

Payment screenshots and licence records: five years, to meet accounting and record-keeping needs.

Support messages: two years after the conversation ends.

Notifications: 15 days, after which they are removed automatically.

Security and sign-in records: 90 days, unless they are needed to investigate an incident, in which case they are kept until the investigation is closed.

Backups: 30 days, after which older copies are deleted.

Agreement records (the date and version you agreed to): for as long as your account exists, and for two years after it is closed.

12. How we keep it safe

We use encrypted connections (HTTPS) for the website, the app and the server.

Passwords are stored in a protected, one-way form. Login tokens and other secrets are stored in protected form on our servers and on your device.

Access to our servers and records is limited to people who need it to run the Service, and is logged.

No system is completely secure. You can help by keeping your password and device secure, and by telling us at once about anything unusual.

13. Security incidents

If we discover a security incident that affects your personal information, we will act quickly to contain it, investigate it, and inform the people affected as soon as we reasonably can. We will tell you what happened, what information was involved, and what steps you should take.

14. Cookies and similar storage

The website and the app use a small number of cookies and local storage. They keep you signed in, protect forms against misuse, and remember your language choice and, if you ask us to, your email address.

We do not use advertising cookies, and we do not track you across other websites.

You can clear cookies and local storage in your browser or app settings, but you may then need to sign in again.

15. Your choices and rights

You may ask to see the personal information we hold about you, to correct it, to export it, or to have it deleted, through Support chat, which you can open from pos.business or from the Business POS app.

Owners can export many reports from the app. Please ask for help if you need your records in another form.

If you are a team member, the owner of your shop is usually the first point of contact for your records in that shop. We will help the owner respond to your request.

We may need to check your identity before we act on a request, to protect your information.

If we cannot delete something because the law requires us to keep it, or because it is needed to protect our legal rights, we will tell you why.

You can ask us to stop using your information for a purpose that is not essential to running the Service. Where this would stop the Service from working, we will explain the effect.

16. Customers of a shop

If you are a customer of a shop that uses Business POS, the shop is the first point of contact for questions about your information. You may also ask us, and we will pass your request to the shop and help it respond.

17. Children

Business POS is for businesses and their staff. It is not designed for children, and we do not knowingly collect information about children for the Service.

18. Changes to this policy

We may update this policy. The current version is always on this page, with the date of the last change. For significant changes, we will tell owners in the app or on the website before the change applies.

19. Contact

For questions about this policy, or to make a request about your information, use Support chat, which you can open from pos.business or from the Business POS app.