Privacy policy

Who we are

PosMate is a point of sale and inventory system for businesses, made up of the web app at app.posmate.net and the PosMate mobile app. It is provided by Paradisecity, Maldives ("we").

A business that uses PosMate decides what it records about its own staff and customers, and we handle those records on its behalf. Questions about a business's records are best sent to that business. Anything else can be sent to support@posmate.net.

What we collect

• Staff accounts. Name, email address, password (stored only as a one-way hash), role, the till a person works, a generated avatar and when they were last active. Accounts are created by the business, not by the person signing in.
• Sign-ins. For each device signed in: its name (on a phone, the device name and model, which can include the owner's name), IP address, browser or app version and when it was last used.
• Business records. Products, stock, purchases, suppliers, sales, refunds, payments, cash counts, delivery orders and settings, with who recorded each one.
• Customer and delivery details. What a business records about its customers: name, phone, email, address, notes and account balance, and the recipient, address and instructions on a delivery order.
• Photos and files. Product images, logos, purchase paperwork, payment slips, photos of supplier bills and photos taken as proof of delivery. The mobile app uses the camera to scan barcodes on the device, and uploads a photo only when someone attaches one.
• Driver location. When a driver out on a delivery round has allowed location, the mobile app sends the phone's precise location, accuracy, heading and speed about every 15 seconds, including while the app is closed or not in use, until the round ends. It also records where each order was picked up, delivered or not delivered. Location is not collected at any other time, and never from someone who is not on a round.
• Notifications. A push token for each signed-in phone, and the notifications sent to each person.
• Audit log. Changes to records, with the values before and after, who made them, and the IP address and browser or app they came from.
• Bank transfers. If a business connects its Bank of Maldives account, the last four digits of the account number and the incoming transfers: amount, description, sender name and reference. The bank password is used once to sign in and is not stored.

PosMate has no advertising, no analytics or tracking services, and does not use the advertising ID.

How we use it

• To run PosMate for the business: recording sales and stock, keeping customer accounts, sending receipts and running delivery rounds.
• To show the business where its drivers are while orders are out, and where each order was delivered.
• To sign people in, keep accounts secure and let a business see who changed what.
• To send notifications a person has not turned off.
• To answer support requests and fix problems.

We do not sell personal information or use it for advertising.

Who can see it

• People in the same business, according to the permissions the business gives them. Only people who manage orders can see drivers' locations.
• Anyone with a receipt link. The link printed or sent with a sale shows the business's details, the items, payments and the customer's name, and on a delivery the recipient's name, phone and address.
• Service providers that handle data for us:
  • hosting and storage providers that run our servers, database, files and backups;
  • Google Firebase Cloud Messaging, which delivers notifications and receives the push token and the notification's text;
  • Google Gemini, which receives a photo of a supplier bill when someone asks PosMate to read it;
  • Bank of Maldives, which a business signs in to when it connects its account;
  • OpenFreeMap, which serves map images to the device showing a map and so receives its IP address and the area shown.
• Authorities, where the law requires it.

These providers may store and process data outside the Maldives.

How long we keep it

• Driver locations during a round: 30 days.
• Where an order was picked up and delivered: as long as the order.
• Notifications: 90 days.
• Photos of supplier bills that were not kept with a purchase: 1 day.
• Sign-ins and push tokens: until the device signs out, or 30 days after the sign-in expires.
• Database backups: 7 days.
• Everything else: as long as the business uses PosMate. When a staff account is deleted, its sign-ins, push tokens, locations and avatar are deleted with it, while the business keeps its sales, orders and audit log, including the name and email recorded when the account was deleted.

When a business closes its PosMate account, we delete its data within 30 days of its request, apart from anything we must keep by law. Backups holding it expire 7 days later.

Security

Data travels over HTTPS. Passwords are stored as one-way hashes, bank sign-in tokens are encrypted, and uploaded files are private and opened through links that expire. A signed-in session lasts 7 days without use, and a person can see and sign out each of their devices.

Your choices

• Location is only asked for on a delivery round, and can be turned off at any time in the phone's settings. Orders can still be delivered without it.
• Notifications can be turned off in PosMate or in the phone's settings.
• To see, correct or delete what a business holds about you, ask that business, or write to support@posmate.net and we will pass it on or help.
• To delete your account, see Delete account.

Children

PosMate is a tool for businesses and is not directed at children.

Changes

When this policy changes, the new version is posted here with a new effective date.

Contact

Paradisecity, Maldives. support@posmate.net