ShopOS — Privacy Policy

1. Information We Collect

We collect only what is necessary to provide the service:

Account Information

• Email address (used for login and account-related communications)
• Full name (used to identify your account and personalise the app)
• Shop name and business details provided during onboarding

Business Data You Enter

• Products, stock levels, pricing, and categories
• Sales transactions and payment records
• Business expenses and cost records
• Service job records (if the services module is enabled)
• Cash reconciliation reports
• Staff accounts and roles you create

Technical Information

• App version and device type (for support and compatibility)
• Session authentication tokens (for keeping you logged in securely)
• Audit logs of actions taken within your shop (visible to you inside the app)

We do not collect personal information about your customers. The platform is for recording your business transactions — any customer names or details you choose to enter are your own responsibility.

2. How We Use Your Information

We use your information only to:

• Provide and operate the ShopOS service
• Sync your data between your devices (Android app and web dashboard)
• Send account-related emails such as email verification, password resets, and important service notices
• Provide customer support when you contact us
• Improve the platform based on general usage patterns (no personally identifiable information is used for this)

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties for their own purposes.

3. Where Your Data Is Stored

Your data is stored in Supabase, a cloud database platform. Supabase stores data on servers operated by Amazon Web Services (AWS) in the United States. By using ShopOS, you consent to your data being transferred to and stored in the United States.

On Android devices, a local copy of your data is stored in an encrypted SQLite database on your device. This allows the app to work without an internet connection. Local data is only accessible by the ShopOS app and is not readable by other apps on your device.

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. However, no system is completely secure, and we cannot guarantee absolute security.

4. Who Can Access Your Data

• You — the account owner has full access to all your shop's data
• Your staff — staff members you add to your shop can access data according to their assigned role
• ShopOS administrators — our team can access your data only when strictly necessary to investigate a support issue, fix a technical problem, or comply with a legal obligation. We do not browse customer data as a routine practice.
• Third-party infrastructure providers — Supabase and Vercel process data on our behalf as part of providing hosting and database services. They are bound by their own privacy and security policies and do not have permission to use your data for their own purposes.

We will never sell or share your data with advertisers, data brokers, or any third party for commercial purposes.

5. Data Retention

We keep your data for as long as your account is active and your subscription is maintained. If your account is closed or your subscription lapses:

• Your data is retained for 90 days after account closure to allow you to request an export
• After 90 days, your data will be permanently and irreversibly deleted from our servers
• Local data on your Android device remains on your device until you uninstall the app or clear its data

6. Your Rights

You have the following rights regarding your personal information:

• Right to access — all your business data is visible and downloadable within the app
• Right to correction — you can edit your account details, products, and records at any time within the app
• Right to deletion — you can request that we delete your account and all associated data. We will action this within 30 days.
• Right to object — you can object to any use of your data that goes beyond what is described in this policy

To exercise any of these rights, contact us at tendai@lenecreativestudio.com.

To request account deletion, email us with the subject line “Delete my account” and include your registered email address. We will confirm deletion within 30 days.

7. Cookies and Local Storage

The web version of ShopOS uses:

• Authentication cookies — to keep you securely logged in. These are session-based and expire when you log out.
• Local storage — to remember your preferences such as dark mode setting. This data stays on your device and is never sent to our servers.

We do not use tracking cookies, advertising cookies, or analytics cookies that send your behaviour to third parties.

8. Children's Privacy

ShopOS is a business tool intended for adults. We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has created an account, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or by email. Continued use of ShopOS after changes are posted means you accept the updated policy.

10. Governing Law

This Privacy Policy is governed by the laws of Zimbabwe, including the Cyber and Data Protection Act [Chapter 12:07]. If you have unresolved concerns about how we handle your data, you may contact the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), which oversees data protection matters in Zimbabwe.

11. Contact Us

For privacy questions, data requests, or concerns about how your information is handled, contact us at: tendai@lenecreativestudio.com.

We aim to respond to all privacy-related requests within 7 business days.