Privacy Policy

ePOS Soft is a digital point-of-sale and business-management platform used by businesses to run their own operations. Different processing roles therefore apply:

When a business enters an end customer's information into the Platform, that business determines what is collected, why it is used and how long it should be kept. ePOS Soft processes that information on the business's instructions to provide the service.

If you are an end customer of a business using ePOS Soft and wish to access, correct or delete information that business entered about you, your request should normally be directed to that business first.

The contractual operator responsible for ePOS Soft is the legal entity or commercial organization identified in the checkout, proposal, invoice, billing document or other commercial instrument associated with the subscription. That identification forms part of this Policy and the Terms of Use.

Privacy requests may be submitted through the official channels available at epossoft.com, through the authenticated Platform or through the channel identified in the applicable commercial document. Additional information may be requested where reasonably necessary to verify identity and protect third-party data.

Depending on how the Platform is used, we may process account and business details, authorized-user data, end-customer and supplier details entered by the business, operational point-of-sale records, subscription and billing metadata, support messages, IP address, user-agent, audit events, session data, language preference and analytics information when analytics tools are enabled.

Passwords are stored using one-way hashing rather than as plain text. ePOS Soft is not designed for indiscriminate storage of sensitive personal data, and free-text fields should not be used for such information unless the Customer has a lawful and necessary reason to do so.

Data is processed to create and maintain accounts, authenticate users, provide the contracted service, administer plans and billing, support Customers, improve reliability, prevent fraud and abuse, maintain security and audit trails, comply with legal obligations and exercise legal rights.

Depending on the context, processing may rely on contract performance, steps taken before entering into a contract, legal obligations, legitimate interests, exercise of legal rights, consent or another lawful basis recognized by applicable law. Where ePOS Soft acts as Processor, the Customer remains responsible for establishing the legal basis for its end-customer data.

End-customer, supplier and contact data entered by a business is processed to support functions such as customer records, orders, sales, operational payment records, history, reports and support.

ePOS Soft does not acquire ownership of this data and does not use it to create an independent marketing database, sell customer lists or market directly to the business's end customers.

We do not sell personal data. Information may be shared only as needed to operate the Platform, perform the contract, comply with legal obligations or protect rights.

• Asaas: paid-plan billing may use recurring checkout links hosted by Asaas.
• Hosting, database and infrastructure providers: may process data required to keep the service available, secure and recoverable.
• Email/SMTP providers: may receive the minimum information required to deliver transactional messages.
• Google: when Google Tag, Google Analytics 4 or Google Tag Manager is configured, browsing and technical identifiers may be transmitted for measurement and analysis.
• unpkg (technical phone library): on the account-creation page and in the customer registration area, the browser may load an international phone-formatting library from the unpkg CDN. The provider may receive technical data inherent to the HTTP request, such as IP address and user-agent. The phone number entered in the form is formatted locally in the browser and is not sent to the CDN by ePOS Soft.
• Authorities and legally entitled third parties: information may be disclosed where required by law, court order, competent authority or to prevent fraud and exercise legal rights.

ePOS Soft uses a session cookie (epossoft_session) to maintain authentication and a language-preference cookie (epossoft_locale) to preserve the selected language across pages.

When analytics tools are enabled, the website and Platform may load Google Tag, Google Analytics 4 or Google Tag Manager and process page, browser, device, referrer and similar technical information. Non-essential technologies must be used in accordance with the lawful basis and privacy choices required by applicable law.

Some cloud, analytics, security or communication providers may process data outside the country where the user or Customer is located. International transfers are subject to the safeguards and transfer mechanisms required by applicable data-protection law.

ePOS Soft applies technical and organizational controls designed to reduce unauthorized access, alteration, loss, leakage and abuse. Product controls include password hashing, session-id regeneration after authentication, secure cookie attributes, role-based permissions, logical tenant separation, rate limiting for sensitive flows, audit trails and redaction of sensitive fields from technical logs.

No internet-connected system can be guaranteed completely immune from security incidents. Where a personal-data incident creates a legal notification duty, appropriate notices and mitigation measures will be handled under applicable law.

Data is retained only for as long as needed to provide the service, fulfil the purpose for which it was collected, comply with law, maintain security records and exercise legal rights. After termination, retention or export periods may apply under the Terms of Use, commercial configuration and mandatory legal requirements.

Where deletion is requested and no legal or legitimate basis requires continued retention, information may be deleted or anonymized in a manner compatible with technical capabilities and backup cycles.

Subject to applicable law, data subjects may request confirmation and access, correction, anonymization or deletion where appropriate, portability where legally available, information about relevant sharing, consent withdrawal, objection to unlawful processing and review of solely automated decisions where applicable.

Requests concerning data entered by a business about its own end customers should normally be addressed to that business as Controller. ePOS Soft will provide technical assistance where required.

ePOS Soft may use Asaas as a hosted checkout and recurring-billing provider for paid subscriptions, including monthly or yearly cycles where offered.

When payment is completed on a checkout hosted by Asaas, sensitive payment-method details are provided directly to that provider and are not intended to be stored in the ePOS Soft database. ePOS Soft may retain subscription metadata such as plan, cycle, amount, checkout identifiers, billing links and status.

To protect accounts and Platform integrity, ePOS Soft may record authentication and audit events, automatically rate-limit repeated attempts and identify technical patterns consistent with abuse, fraud or compromised credentials.

These safeguards are used for security rather than to create consumer profiles about a business's end customers. Where a significant measure can legally and technically be reviewed, the user may request review through official support or privacy channels.

Administrative and operational ePOS Soft accounts are intended for persons authorized to act on behalf of a business. The Platform is not designed to intentionally collect children's or teenagers' data as an ePOS Soft audience.

If a Customer enters minors' data as part of its own business activity, that Customer is responsible for assessing necessity, lawful basis and any heightened protections required by applicable law.

The Platform may direct users to pages, checkouts or services operated by third parties. Those environments have their own terms and privacy policies and may perform independent processing. Users should review the relevant policy before providing personal information directly to a third party.

This Policy may be updated to reflect changes to the product, integrations, internal processes or law. The version and last-updated date are shown at the top of this page.

Material changes may be communicated through the Platform, registered email address or another reasonable channel. Where renewed consent or another specific legal step is required, that step will be taken before the relevant processing begins.

For privacy questions, requests or rights exercises, use the official channels available at epossoft.com, within the authenticated Platform or in the commercial document applicable to your subscription.

Data subjects may also contact the competent data-protection authority where applicable. In Brazil, this is the Autoridade Nacional de Proteção de Dados (ANPD).

This Policy forms part of the ePOS Soft contractual framework together with the Terms of Use and any specific commercial terms accepted by the Customer.