Last updated: DRAFT
Xeroz POS (“the App”) is a point-of-sale app for cafés and shops, and its planned back office at pos.xeroz.ai (“the Back Office”). Together they are “the Service”. The Service is a business tool: it is used by shop owners and their staff, not by the general public. This policy explains what data the Service collects, why, who sees it, and how you can have it removed.
Who we are
The Service is run by [TODO: legal company name], [TODO: registered address] (“we”, “us”). Contact: [TODO: contact email].
Two roles matter. For a shop’s own business data — its staff, menu, sales and the customers named on its orders — the shop is the controller and we are its processor: we store and process it on the shop’s behalf and on its instructions. For the shop owner’s account and for the technical data needed to run and secure the Service, we are the controller.
What we collect
- Shop and owner account. Shop and legal name, address, phone, country, currency, VAT and commercial-registration numbers, payment methods in use; the owner’s name and email; a password (stored only as a one-way hash); two-factor authentication secrets if enabled; language choice.
- Staff. Display name, role and permissions, branches they work at, and a PIN stored only as a one-way hash. An optional profile photo if the owner uploads one. Clock-in and clock-out times. A history of sensitive actions (who approved a discount, void or refund, and when). We do not collect staff location.
- Customers named on orders. For pickup orders the till can take a customer’s name and phone number. They are stored with that sale. Customers do not use the App and have no account.
- Sales and stock. Items, quantities, prices, taxes, discounts, tips, payment method and amount, refunds and voids with the reason and any note typed in, cash-drawer movements, shifts, stock counts, recipes, and supplier deliveries. For card payments, the card type, the last four digits and the approval code recorded with the sale. We never receive a full card number: the App does not take card payments itself.
- Evidence photos. When staff record a void, refund, pay-out or waste, the till can attach photos taken with the camera (or chosen from the gallery). They are uploaded to our server and shown to authorised managers with that record. Please do not photograph customers’ faces or card details.
- Shop images. The shop logo and menu item pictures that the shop chooses. If the owner uses “enhance photo”, that menu picture is sent to a photo-processing service (see Sharing).
- Device and technical data. When a till is paired: a device label chosen by the shop, platform (Android or iOS), app version, a random device code, the time it was last seen, and a secret access token. IP addresses appear in web-server and security logs and in rate-limiting. Application logs record errors and requests so we can fix problems and investigate abuse. We do not collect advertising identifiers, contacts, precise or approximate location, or analytics for advertising, and the App contains no advertising or third-party tracking SDKs.
- Back Office cookies. A session cookie to keep you signed in and a cookie remembering your language. No advertising cookies.
Permissions the App asks for
- Camera — to scan the pairing QR code and to take evidence photos. Scanned QR codes are not stored.
- Photos / gallery — only when you pick a logo or an evidence photo.
- Bluetooth and local network — to reach receipt printers and the cash drawer. This stays between the device and the printer.
- Internet — to sync with the Back Office. The till keeps working offline and syncs when it reconnects.
How we use it
To run the Service: sign people in, sync tills with the Back Office, produce receipts and reports, manage stock, send the owner’s invitations and daily summary emails, keep the Service secure, prevent abuse, give support, and meet legal duties. We do not sell personal data, use it for advertising, or build profiles for others.
Who we share it with
- Hosting. Data is stored on servers hosted by [TODO: hosting provider and country] .
- Email. Invitations and daily reports are sent from our own mail server, not a third-party email provider.
- Photo enhancement (only if the owner uses it): the menu picture is sent to an image-processing service [TODO: name the provider, or remove this line if it is our own server] , which returns an improved picture.
- The shop’s accounting system. If a shop connects its own FrontAccounting system, its sales summaries are sent there at the shop’s request.
- Company registry lookup. If enabled at signup, the commercial-registration number you type is sent to a registry lookup service to pre-fill the form.
- WhatsApp. If staff choose to send a receipt by WhatsApp, the App opens WhatsApp on the device with the customer’s number; the message is then sent by WhatsApp, not by us.
- Authorities, where the law requires it.
We do not sell data and do not share it with anyone for their own marketing.
Security
Passwords and PINs are stored only as hashes. The till keeps its access token in the device’s secure storage. Each shop sees only its own data, and staff see only what their role permits. Photos are kept in private storage, not on public URLs. HTTPS (TLS) protection between the App and the Back Office remains a publication blocker [TODO — do not claim encrypted-in-transit until verified: the alpha build still uses plain http to an IP address. Complete DNS and TLS for https://pos.xeroz.ai first.] . No system is perfectly secure; if we learn of a breach affecting you we will tell the affected shop owners.
How long we keep it
- Shop data is kept while the shop’s account is active.
- Sales, refund and stock records are kept as long as the shop needs them for its accounts and the law requires [TODO: confirm retention period, e.g. 5 years for tax records] .
- When an account is closed or a deletion request is accepted, we delete or anonymise the shop’s data [TODO: number of days] , except records the law requires us to keep. Backups age out on their normal cycle.
- Application logs are kept for 30 days by default. Evidence photos are kept with the record they belong to.
- Signing out of a till or retiring it in the Back Office removes its access; the sales it already sent remain part of the shop’s records.
Your choices and deletion
- Shop owners can, in the Back Office, deactivate a staff member (they can no longer sign in), remove a staff photo or the shop logo, delete saved deliveries, and retire a till.
- To delete a shop’s account or any personal data — including a staff member’s own data or a customer’s name and phone on an order — email [TODO: contact email]. We answer within 30 days. Customers and staff should first ask the shop they dealt with, as it controls that data; we will help the shop act on the request.
- You can revoke the camera and photo permissions in your device settings at any time; the related features then stop working.
- You may also ask for a copy of your data or ask us to correct it, and you may complain to your data-protection authority.
Children
The Service is a business tool and is not directed to children.
Changes
We will post changes on this page and update the date above. For material changes we will tell shop owners.
Contact
[TODO: legal company name] · [TODO: registered address] · [TODO: contact email]