Privacy Policy
What we collect, why, and what we do not do with it.
01 The short version
XPos holds the records a shop needs to trade: its products, its customers, its sales, its staff logins. It does not sell them, mine them, or share them with advertisers. There is no analytics script, no advertising pixel and no third-party tracker on any page of this site or in the application.
The shop that runs this software is the one holding the data — not us. It runs on hosting they chose and control, and we hold no copy of it.
02 Who is responsible for what
Two different relationships, and it matters which one you are in.
- If you are a shop using XPos, you decide what customer data you collect and how long you keep it. You are the data controller for it. The software is the tool you use.
- If you are a customer of a shop that uses XPos, your details are held by that shop. Your request to see, correct or delete them goes to them, not to us — we have no access to their installation and cannot act on their records.
03 What the software stores
Only what the features need in order to work:
- Account — name, username, email, a hashed password, role, and the branch a cashier is pinned to.
- Shop — business name, address, contact details, country, currency, tax settings, logo.
- Customers — whatever the shop chooses to record: name, phone, email, address, credit balance, loyalty points.
- Trading records — sales, refunds, invoices, purchase orders, expenses, stock movements and the double-entry journal behind them.
- Security — an activity log of significant actions, and failed sign-in attempts by IP address so a password can be rate-limited.
Passwords are stored as bcrypt hashes and are never recoverable — not by us, not by an administrator, not by anyone reading the database. A password reset issues a new one; it cannot reveal the old.
04 Where it is held
On the hosting the shop chose. This software is installed and run by the shop itself, on a server and a database it controls. There is no central service holding a copy, no cross-shop reporting, and no mechanism by which the software's authors can read a running installation.
That is a genuine difference from a hosted product, and it cuts both ways. Nobody else can reach the data — and equally, nobody else is backing it up, patching the server, or watching for a breach. Those are the shop's responsibility.
Each shop's records are separated at the database level: every query for shop-scoped data carries that shop's identifier, so one shop on a shared installation cannot read another's. That separation is enforced structurally and verified automatically before every release.
05 What leaves the server
Very little, and only where a feature requires it. In full:
- Email. Verification, password-reset, invoice and notification mail is handed to the SMTP server the shop configured. The message content and the recipient's address reach that provider. Nothing else does.
- Payments. When subscription billing is enabled, the customer is sent to the payment provider's own pages to pay. Card details never touch this software — it stores a transaction reference and an amount, and never a card number.
- Approximate location. The public pricing page can look up a visitor's country from their IP address to show prices in a sensible currency. It sends the IP address to a geolocation provider and stores only the resulting two-letter country code, for the browsing session. It is a setting an operator can switch off, and it is enabled on this installation.
There is nothing else. No analytics, no advertising network, no session recording, no embedded fonts or scripts from other origins — the content security policy on every page actively forbids them.
07 How long it is kept
For as long as the shop keeps its account, because trading records are the point of the software. A few things are pruned automatically:
- Failed sign-in attempts, after a short window — they exist only to rate-limit an attack in progress.
- Signup accounts that are never verified, after a configurable period.
Deleting a company from the settings page is permanent. Products, sales, customers, invoices, uploaded files and staff accounts are removed outright — it is not a soft delete, and there is no recovery from it. Export anything you need first.
08 Your rights
Depending on where you live you may have the right to see the personal data held about you, correct it, have it deleted, or take a copy elsewhere.
Ask the shop, not us. If a shop holds your details as its customer, that shop is the one that can act — we have no access to their installation. If you are a shop and need help fulfilling such a request, no-reply@example.com and we will explain where in the software the data lives.
09 If something goes wrong
If you find a security problem in the software, please report it privately first: no-reply@example.com. We would much rather hear it from you than read about it. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable opportunity to fix it.
If a shop's own installation is breached, notifying the people affected is that shop's duty — the same reasoning as the section above. We cannot detect it and will not know.
10 Changes to this policy
The date at the top of this page changes whenever the text does. For anything that materially changes what is collected or where it goes, shops are emailed before it takes effect.