Privacy Policy — Nastrum POS

2.1 Information You Provide Directly

Account information:

• Full name and email address (used to create and identify your account)
• Password (stored as a secure hash — we never see your plain-text password)
• Business name, address, country, and currency

Business operational data:

• Products, categories, prices, stock levels, and barcodes you enter into the app
• Customers' names and phone numbers (if you choose to capture them at point of sale)
• Transaction records including items sold, amounts, payment methods, and dates
• Staff profiles including display names, email addresses, assigned roles, and PIN hashes (PINs are never stored in plain text)
• Purchase orders and supplier information

Subscription and billing information:

Plan selection (Starter, Pro, or Business). Billing is processed entirely by Stripe. We do not store credit card numbers, card expiry dates, or CVV codes at any time. See Section 5 for details.

2.2 Information Collected Automatically

• Device information: device model, operating system version, and app version (used for debugging and compatibility)
• Usage logs: feature usage patterns, crash reports, and error logs (used to improve the app)
• IP address: collected by our infrastructure providers as part of normal network operation

2.3 Information We Do Not Collect

• We do not collect precise GPS location
• We do not access your contacts, photos, or files outside of the app's own functions
• We do not collect biometric data
• We do not run advertising trackers or sell your data to any third party

4.1 Infrastructure and Technology Providers

All providers are contractually bound to handle data securely and are prohibited from using your data for their own marketing purposes.

4.2 Legal Disclosure

We may disclose information if required by law, court order, or government authority, or where we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation
• Protect the safety of any person
• Prevent fraud or illegal activity
• Protect our legal rights

4.3 Business Transfers

If Nastrum is acquired, merged, or sells substantially all of its assets, user data may transfer to the acquiring entity. We will notify you via email or in-app notice before your data is transferred and becomes subject to a different privacy policy.

4.4 What We Never Do

We never sell, rent, or trade your personal data or your customers’ data to any third party for commercial purposes.

All users

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data
• Portability: Request your transaction data in CSV format (available in-app via Reports > Export)

European Union and United Kingdom users (GDPR)

In addition to the above:

• Right to object: Object to processing based on legitimate interests
• Right to restrict: Request that we restrict processing of your data in certain circumstances
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time
• Lodge a complaint: You have the right to lodge a complaint with your local data protection authority

Indian users (IT Act 2000 / DPDP Act)

You have the right to access, correct, and request erasure of your personal data.

Saudi Arabian users (PDPL)

You have the right to be informed, access, correct, and request deletion of your personal data.