Privacy Policy

1. Controller or processor — which applies to you

This Privacy Policy covers two different situations, and it matters which one applies to you:

A. If you are visiting the KaydPOS website or messaging us to ask about the product

KaydPOS is the controller of your personal data — we decide why and how it's processed (for example, replying to your enquiry, or maintaining your login session while you browse this site).

B. If you work for a business that subscribes to KaydPOS

Once a business signs up and starts entering its own data — staff accounts, customers, sales, inventory — that business is normally the controller of that data, and KaydPOS acts as a processor, processing it only on that business's behalf and instructions. The terms that govern this processor relationship are set out in the Data Processing Agreement, not in this Policy. KaydPOS does not own, sell, or use a subscribed business's customer or transaction data for its own purposes.

2. Data we collect

3. Purposes and legal basis for processing

KaydPOS does not currently run analytics or advertising tracking, so consent-based cookie processing does not apply — see the Cookie Policy for the exact, verified list of cookies in use.

4. Who receives data

We do not sell personal data. Data is shared only with the service providers that keep KaydPOS running (subprocessors), listed in full — with their purpose and what they can access — on the Subprocessors page. As of this document's last update, that list is short: our hosting provider and our email delivery provider, both Hostinger. We do not currently use any analytics, advertising, or payment-processing subprocessor, because none of those services are active on the platform.

5. International transfers

KaydPOS operates from Somalia. Our hosting provider's infrastructure that serves the KaydPOS platform is located in Frankfurt, Germany (EU) — verified directly by network geolocation of the production server, not assumed. This means data you or a subscribed business enters into KaydPOS is transferred to and stored in Germany/the EU for processing. We have not independently confirmed a specific formal transfer mechanism (such as Standard Contractual Clauses) with our hosting provider beyond its own published policies; if you need more detail for your own compliance purposes, contact us using the details in Section 12.

6. Retention

We keep personal data only as long as it's needed for the purposes described above:

• Account and business data — for as long as a business's subscription is active, plus a limited period afterward to allow data export and to meet any legal obligations.
• Backups — KaydPOS takes periodic backups of the platform database for disaster-recovery purposes. Backups are retained on a rolling schedule and are not a substitute for a business exporting its own records; backup contents are not searchable or editable on demand and are only restored in the event of a genuine incident.
• Support and contact-form messages — kept only as long as needed to handle and resolve the enquiry.
• Security and error logs — kept for a limited operational period sufficient to investigate incidents, then rotated out.

We do not currently commit to a fixed day-count retention period beyond the criteria above — retention is tied to how long a subscription stays active and to the operational needs described above, rather than a flat calendar countdown. If a fixed retention schedule is adopted in future, it will be published here.

7. Security measures

Without disclosing details that would undermine our own security, the platform is built around: encrypted transport (HTTPS enforced site-wide with HSTS), hashed passwords (never stored in plain text), role-based permissions so staff only see what their role allows, per-business data isolation so one business cannot see another's records, login rate-limiting to slow down credential-guessing attempts, and production error pages that never expose stack traces or internal details to visitors. See the Security page for the full, plain-language list and how to report a vulnerability. No system is perfectly secure, and we do not claim otherwise.

8. Your rights

Depending on your location and which situation in Section 1 applies to you, you may have the right to request access to, correction of, deletion of, restriction of, or objection to the processing of your personal data, and to receive a copy of it in a portable format. Use the Privacy Request page to make a request. Because personal data can affect real people, we may need to verify your identity before acting on a request — we will explain exactly what's needed and will not ask for more than is reasonably necessary.

If your data was entered into KaydPOS by a business you're a customer of (Section 1B), we may need to route your request to that business, since they are normally the controller of that data.

You also have the right to lodge a complaint with your local data protection supervisory authority.

9. Children's data

KaydPOS is a business tool and is not directed at children. We do not knowingly collect personal data from children.

10. Automated decision-making

KaydPOS does not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

11. Changes to this policy

We may update this Policy as the product, our providers, or applicable law changes. The version number and "last updated" date at the top of this page will always reflect the current version.

12. Contact

Privacy questions or requests: privacy@kaydpos.com. General contact: see the Contact page.