Privacy Policy

[LEGAL ENTITY NAME] ("SmartPOS", "we") provides point-of-sale, inventory, customer credit (Khata) and reporting software to retail merchants in India. This policy explains what personal data we process, why, and the choices available to you.

1. Our role

• Merchant account data (owner and staff names, email, login activity, business profile, subscription and billing records): SmartPOS is the Data Fiduciary.
• Data a merchant enters about its own customers (customer names, mobile numbers, Khata balances, purchase history): the merchant is the Data Fiduciary and SmartPOS processes it only on the merchant's instructions as its Data Processor. Each merchant's customer data is isolated and never shared with other merchants.
• Referral agents: we process agent identity, referral attribution and commission records to administer the referral programme.

2. Personal data we collect

• Account: name, email, password (stored only as a salted hash), role and store memberships.
• Usage and security: sign-in events, IP address, device/browser information, audit logs of sensitive actions.
• Billing: plan, payment status and payment references from our payment processor (we do not store card numbers or UPI PINs).
• Merchant-entered customer data: name, mobile number (normalised to international format), optional notes, credit limit, Khata ledger and purchase history; marketing-consent status and the time it was recorded.
• SmartScan: barcode values scanned by a paired phone. Camera images are processed on the phone and are not uploaded or stored.

3. Purposes and legal basis

• Providing the service you signed up for (billing, inventory, Khata, reports) — performance of our contract and your consent at signup.
• Security, fraud prevention, audit trails and legal compliance (including tax and accounting record retention).
• Service communications (account, security, billing). Marketing messages only with separate, withdrawable consent.

4. Consent and withdrawal

You give consent when you create a store and accept this policy (we record the version and time). You may withdraw consent at any time by writing to [SUPPORT EMAIL]; withdrawal does not affect processing already carried out, and we may need to close the account where data is necessary to provide the service. Merchants must obtain and record their own customers' consent before entering their data or sending them messages; SmartPOS records a customer's marketing-consent flag when the merchant sets it.

5. Retention

• Sales, invoices, tax, Khata and stock records are retained for at least eight years after the relevant financial year to meet Indian tax and accounting obligations, then deleted or anonymised. [CONFIRM PERIOD WITH COUNSEL]
• Account data is retained while the account is active and for [N] months after closure; exports remain available to owners after expiry.
• Security logs: [N] months. Backups are rotated (7 daily, 4 weekly, 12 monthly) and expire automatically.

6. Your rights

Subject to the DPDP Act, 2023 you may request access to a summary of your personal data, correction, completion, updating or erasure, and you may nominate another person to exercise your rights. Customers of a merchant should first contact that merchant; we will assist merchants in responding. Contact our Grievance Officer (see Grievance redressal).

7. Children

SmartPOS is a business tool for adults. We do not knowingly create accounts for persons under 18. Merchants must not enter data of children without verifiable parental consent where the law requires it.

8. Sharing and processors

We use carefully selected service providers for hosting (India region), payment processing (Razorpay) and email. They process data only for the purposes above under written terms. We do not sell personal data and we do not show advertising inside the checkout.

9. Storage location and transfers

Production data is hosted in India ([HOSTING PROVIDER, REGION]). Any transfer outside India will comply with restrictions notified under the DPDP Act.

10. Security

Encrypted connections (HTTPS), hashed passwords, per-store access isolation, role-based permissions, append-only audit and financial ledgers, rate limiting, encrypted off-server backups and restore drills. In the event of a personal data breach we will notify affected users and the Data Protection Board of India as required.

11. Changes

We will notify account owners of material changes and ask for renewed acceptance where required. The version number above identifies the text you accepted.

12. Contact

[LEGAL ENTITY NAME], [REGISTERED OFFICE ADDRESS]. Email: [SUPPORT EMAIL].