Privacy Policy

1. Who This Policy Covers

This Privacy Policy describes how BAR POS handles personal information collected through our software and services. It applies differently depending on your relationship to us:

• Business Owners and Locations are our direct customers. This policy describes how we collect and use their account and business information.
• Workers at a business using BAR POS have their employment-related data (e.g. name, PIN, scheduling, hours worked) controlled primarily by their employer, the Business Owner. BAR POS processes this data on the Business Owner's behalf to provide the service.
• Customers of a business using BAR POS (e.g. a name entered for a tab) have that information controlled primarily by the business they visited. BAR POS processes it on that business's behalf to facilitate the transaction.

Workers and Customers with questions about their data should generally start with the business they interact with directly; that business can reach us using the contact information in Section 11 below.

2. Information We Collect

We collect information you provide directly to us, such as:

• Account registration information (name, email, business details)
• Business data entered into our software (menu items, sales data, employee information)
• Customer information entered for a tab (e.g. name), where applicable
• Communication with our support team
• Usage data and analytics to improve our service
• Crash and error diagnostic data if the app encounters a problem

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices and support messages
• Respond to your comments and questions
• Monitor and analyze usage patterns to improve our service
• Diagnose and fix crashes or errors in the app

3a. Payment Processing

Card payments are processed directly by Stripe, including payments taken in-person through a Stripe Terminal card reader connected to the app via Bluetooth. Card numbers, expiration dates, and security codes are transmitted directly to Stripe and are never stored on your device or on our servers — we only retain the transaction result (e.g. amount, approval status, and a reference ID) needed to record the sale. See Stripe's own privacy policy for how it handles payment data.

3b. Mobile App Permissions

On our iOS and Android apps, we request:

• Bluetooth — to connect to a physical card reader for in-person payments.
• Location (when in use) — required by our payment processor for card-present fraud prevention during a transaction.
• Camera — to scan barcodes and capture product images.
• Biometric authentication (Face ID / Touch ID) — used only to unlock the app on your device; biometric data is processed by your device's operating system and is never transmitted to us or stored on our servers.

4. Information Sharing

We do not sell, trade, or otherwise transfer your personal information to third parties except:

• With your explicit consent
• To comply with legal obligations
• To protect our rights and safety
• With infrastructure and service providers who help us operate the platform (e.g. our database and hosting provider, Supabase; our payment processor, Stripe), under confidentiality obligations consistent with this policy

We do not sell your personal information, and we do not share it for cross-context behavioral or targeted advertising purposes.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Database-level tenant isolation (Row-Level Security), so one business's data cannot be accessed by another business on the platform
• Worker PIN authentication bound to a verified session token, rather than a bare client-supplied identifier
• Encryption of data in transit and at rest
• Regular security review and monitoring
• Access controls limiting who can view sensitive data

6. Analytics and Crash Reporting

We use third-party services to help us operate and improve the app and our marketing website:

• Mixpanel — product usage analytics, to understand how the app is used and improve it.
• Sentry — crash and error reporting, to diagnose and fix problems.
• Google Analytics — website usage analytics for our marketing site, to understand how visitors find and use our site.

These services may receive limited technical and usage data (e.g. device type, app version, feature usage, error details). We do not use these services for advertising, and payment card data is never sent to them.

Our marketing website uses cookies associated with Google Analytics to measure site traffic. You can control or disable cookies through your browser settings; doing so will not affect your ability to use the BAR POS application itself.

7. Your Rights

You have the right to:

• Access and update your personal information
• Delete your account and associated data
• Export your business data
• Opt-out of non-essential communications
• Request information about data we collect

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to know what personal information we have collected about you, request its deletion, and opt out of the sale or sharing of personal information — as noted in Section 4, we do not sell or share personal information for targeted advertising. To exercise these rights, contact us at privacy@barpos.co; we may need to verify your identity before fulfilling your request.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. After account termination, data is retained for 30 days before permanent deletion, except as required by law.

Transaction and financial records may be retained longer than 30 days where necessary to comply with tax reporting, audit, or other legal recordkeeping requirements applicable to your business.

9. Children's Privacy

Our service is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children under 18.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@barpos.co