Privacy Policy
1. Who provides the service
M2POS is provided by William Scott, trading as Gemica Tech. Contact support@mymultipos.com for privacy enquiries. The service address and applicable jurisdiction remain to be confirmed before this draft is published.
2. Information we process
Depending on enabled features, the service processes account and contact details, user roles, sales and payment records, inventory, supplier information, customer and delivery details, staff attendance and payroll, and operational logs. Connected services may require access tokens and account identifiers. Only submit information you are authorised to use.
3. Purpose and responsibility
We process information to provide requested features, maintain account access, support users, investigate faults and security incidents, and meet applicable legal duties. We do not sell business data. Your business is responsible for its collection of customer and staff information, required notices and permissions. Our role depends on the processing activity; a separate data-processing agreement may be needed. Necessary processing is not treated as blanket consent for unrelated uses.
4. Providers, AI and international processing
The service uses infrastructure and service providers including Supabase, Vercel, Resend and Google Gemini, as relevant to the feature. AI requests may include information you submit, invoice images or extracted content, and business context needed for the requested analysis. Review files before sending and avoid unnecessary personal information. Providers may process data outside your country. Before publication, the provider list, processing locations, legal bases and applicable transfer safeguards must be verified and documented. We do not claim that all data stays in your country or that every AI feature excludes personal data.
5. Social connections and publishing
When you connect a supported platform, authorised tokens and account details enable requested publishing features. Check content, destination and any schedule before authorising it. Scheduled publishing may execute later under your instructions. Disconnect through available controls or request help; revocation at the platform may also be required. Disconnecting does not delete posts already published. Each platform applies its own privacy policy.
6. Retention, deletion and your requests
Keep your own required business records. The existing policy specifies a 30-day retention period for suspended accounts; actual deletion workflows and backup expiry need operational verification before publication. Request access, correction, export, deletion or other applicable privacy rights at support@mymultipos.com. We may verify identity and business authority before acting. Lawful retention and external-platform records can limit deletion. Cancellation of a subscription is separate from deleting an account. Exact response deadlines will follow applicable law; this draft does not promise an unverified automated deletion schedule.
7. Security, browser storage and updates
We use access controls and technical safeguards, but no service is risk-free. Report suspected data incidents promptly. Browser storage is used for settings such as the marketing language choice; authentication can use session mechanisms. A complete cookie and analytics inventory must be verified before publication rather than claiming no tracking without evidence. Material policy changes will be communicated through appropriate service notices. You may contact the relevant regulator where applicable. This draft does not assert certification or universal compliance.