1. Introduction
ADPOS (“we”, “us” or “our”) is operated by AwakenDev. We respect your privacy and handle personal information responsibly.
This Privacy Policy explains how we collect, use, store, disclose and protect information when you visit our website at https://pos.awakendev.com, register for or use ADPOS, contact us, or use our related services.
ADPOS is point-of-sale and shop-management software that helps businesses manage sales, products, stock and related business operations.
This policy should be read alongside our Terms of Service, our Subscription & Cancellation Terms and our Cookie Policy.
2. Information we collect
2.1 Information you give us
- Registration: your name, mobile number, email address and password, and your shop's name, type and address. We send a code to your email address and another to your mobile number to confirm they are yours. Your password is stored only in a scrambled (hashed) form that cannot be turned back into the password.
- Your shop's profile: details you add later, such as a shop logo, contact numbers, a tax or VAT number, receipt settings and profile pictures.
- Subscription payments: the plan you choose and the proof of payment you upload (a photo or PDF of your bank transfer receipt), and our record of approving it.
- Support and communications: what you write in support requests, emails and contact forms.
- Sign in with Google: if you choose to sign in with Google, Google tells us the email address of your Google account so we can match it to your ADPOS account. We do not receive your Google password.
2.2 Business data entered into ADPOS
When your business uses ADPOS, the service stores what your business enters and does, which may include:
- Products, categories, prices, barcodes and stock records, including batches, costs and expiry dates.
- Sales, receipts, returns, quotations, cash register sessions and related records.
- Customer details your business chooses to record, such as names, phone numbers, email addresses, credit sales and instalment plans.
- Supplier details and purchase records.
- Your staff's accounts, roles and permissions, and a record of sensitive actions, such as who changed a price at the till or voided a sale.
- Reports and exports generated from that data.
Your business decides what it enters into ADPOS. If your business turns on instalment reminders, we send those reminder emails to your customers on your business's behalf.
2.3 Technical and usage information
- Server logs: your IP address, browser and device type, the pages or features you used and when, and error details, recorded by our servers to run the service, fix faults and protect it.
- Website analytics: our pages are measured with Cloudflare Web Analytics, which records the page visited, how fast it loaded and the type of browser. It uses no cookies and does not follow you to other websites.
- On your device: a small number of cookies and browser-storage items, described in our Cookie Policy.
3. How we use information
- To create and manage accounts and confirm your email address and mobile number.
- To provide ADPOS and the features your business uses.
- To process subscription payments and keep billing records.
- To answer enquiries and give support.
- To send service messages: verification codes, account and security notices, subscription information and important changes.
- To find and fix errors and keep the service fast and reliable.
- To protect accounts, detect misuse and investigate security incidents.
- To meet our legal obligations and respond to lawful requests.
We do not use your business data to advertise to you or anyone else.
4. How we share information
We do not sell personal information.
4.1 Service providers
We use these providers to run ADPOS. Each one handles information only to provide its service to us:
- Contabo hosts the servers that run ADPOS and store its data.
- Cloudflare delivers and protects our website and service, provides the website analytics described above, and stores our off-site backup copies.
- Brevo sends our emails, such as verification codes, account notices and instalment reminders.
- SMSlenz sends the verification codes we text to mobile numbers.
- Google provides Sign in with Google, if you use it, and the fonts used on the screens you see after signing in. Loading those fonts sends Google your IP address and browser details.
- YouTube (part of Google) plays the videos in our blog articles, and only when you press play on one. It then receives your IP address and browser details and may set its own cookies; until you press play, nothing is sent to it.
- Discord receives our internal alerts when something goes wrong on our servers. An alert can include technical details such as an account identifier or an email address involved in the error.
We do not take card payments. Subscription payments are made by bank transfer, and your bank handles that payment under its own terms.
4.2 Your business and its users
Information entered into ADPOS can be seen by the users your business authorises, according to the roles and permissions your business sets. Your business is responsible for giving and removing access appropriately.
4.3 Legal and safety requirements
We may disclose information when we reasonably believe the law, a valid legal process or a lawful request from a competent authority requires it, or when it is needed to protect rights, safety, property or the security of the service.
4.4 Business transfers
If our business, or part of it, is merged, acquired, restructured or transferred, information may be transferred as part of that, subject to confidentiality and data-protection requirements.
5. Business data and responsibilities
ADPOS lets businesses keep records about their own operations, and about their own customers, employees and suppliers.
Your business is responsible for the information it enters and for having the right to collect, use and share it. Where your business enters personal information about other people, it should give them any notice the law requires and handle their requests about it.
If a shop recorded your details in ADPOS, please contact that shop first. It decides why your information was collected and is best placed to answer requests about its records.
6. Where information is stored
ADPOS's servers are in Singapore. Our off-site backups are stored with Cloudflare, and our email and alert providers process the information they handle on their own systems, which may be in other countries. So your information is stored and processed outside Sri Lanka. We use these providers only to run the service, and we take the steps data-protection law requires when information leaves Sri Lanka.
7. Data retention
- Your account and your business data are kept while your account exists, including after a subscription ends: an account whose trial or subscription has ended stays read-only, with its records still there. You can delete your shop and its data yourself, or ask us to (see below).
- Closing your shop: the shop's owner can close the shop from Profile → Close shop in ADPOS. For 7 days after confirming, the shop is read-only and only the owner can sign in, so its records can still be downloaded, and the closure can be cancelled. After that, the shop's data is deleted, including its staff accounts. We keep the shop's name, its invoices and its payments to us, with the owner's name and email address, as our record of what was paid, for as long as we need to keep financial records. You can also ask us to close your shop (see section 10).
- A trial that is never paid for: if a trial ends and no plan is bought, we may delete the shop and all its data 3 months after the trial ended.
- Backups are kept for 30 days, so something deleted from ADPOS disappears from our backups within 30 days.
- The record of sensitive actions in your shop (such as price changes at the till) is kept for 2 years.
- Our application's server logs are kept for 30 days.
- Verification codes expire within minutes and are not kept.
We may keep information for longer where the law requires it or to resolve a dispute.
8. Data security
We take reasonable steps to protect information against unauthorised access, loss, misuse, alteration or disclosure, including:
- encrypted connections (HTTPS) to our website and service;
- passwords stored only in hashed form;
- signed-in sessions protected by Secure, HttpOnly session cookies, and protection against cross-site request forgery on forms;
- each shop's data kept separate from other shops', and access within a shop limited by the roles and permissions it sets;
- a second verification step for our own administrators when they sign in;
- regular backups, with copies kept off the main server.
No method of sending or storing information is completely secure, so we cannot promise absolute security. If you suspect someone has accessed your account without permission, contact us straight away using the details in section 15.
9. Cookies and similar technologies
Our website and service use a small number of cookies and browser-storage items to keep you signed in, protect forms and remember your settings. Our Cookie Policy lists each one and how long it lasts. You can manage cookies in your browser's settings, but blocking the ones used for signing in stops the service from working.
10. Your privacy rights and choices
Depending on the law that applies, including Sri Lanka's Personal Data Protection Act, No. 9 of 2022, you may have the right to:
- ask for access to the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- object to, or ask us to limit, some uses of it;
- withdraw consent where we rely on it;
- complain to the Data Protection Authority of Sri Lanka.
A shop's owner can delete the shop and its data themselves, from Profile → Close shop (see section 7).
To make any other request, or if you cannot sign in, contact us using the details in section 15. Tell us clearly what you are asking for, and give enough detail for us to find the records. We may need to confirm your identity before we act on it. If your information was entered by a shop, see section 5.
11. Service communications
We send the messages needed to run your account and the service, such as verification codes, account and security notices, subscription information and important changes. We do not currently send promotional messages. If we start to, we will give you a way to stop them, and stopping them will not stop the service messages.
12. Third-party websites
Our website may link to other websites. They run independently and have their own privacy policies, and we are not responsible for how they handle information.
13. Children's privacy
ADPOS is software for businesses and is not meant for children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will deal with it.
14. Changes to this policy
We may update this policy when our service, our providers or the law changes. The latest version is always on this page, with its date at the top. If a change materially affects how we handle your personal information, we will tell you before it takes effect, for example by email or in ADPOS.
15. Contact us
For questions, concerns or requests about this policy or your personal information, contact:
Please put “Privacy Request” in the subject line so your message reaches the right person.