Privacy policy

Data we collect

Account data: name, email, phone, password hash, role, and login activity.

Business data you enter: outlets, products, customers (name, phone, address, GSTIN if given), orders, payments and stock.

Device and usage data: device identifiers for linked desktops and phones, IP address and browser information in server logs, and error reports.

Customer ordering: when a customer orders from a table QR code we store the name and phone they enter, their order, and a hashed IP address for abuse prevention.

Why we process it

To provide the point-of-sale service you signed up for, to issue invoices, to keep the service secure, to send transactional email (invitations, receipts, billing), and to comply with law such as GST record-keeping.

We do not sell personal data and we do not use it for third-party advertising.

Who we share it with

Processors that help us run the service: our own server hosting, Cloudflare (network security), Razorpay (subscription payments), Resend (email), and error monitoring. Each processes data only on our instructions.

Your own payment gateway (Razorpay) receives your customers' payment details directly; we never see card numbers.

Retention

Business records are kept while your account is active and, for invoices, for the period required by GST law (currently eight years) in anonymised form after you delete your account.

Server logs are kept for 30 days. Backups are kept for 30 days.

Your rights

You can access and correct your data in the app, export all business data from Settings, and ask us to delete your account.

To exercise a right or raise a grievance, write to support@codecano.com (attention: Grievance Officer). We respond within 30 days.

Customers who ordered through a QR code can ask the business, or us, to delete their name and phone number.

Security

Data is encrypted in transit and at rest, tenants are isolated at the database level, payment keys are encrypted with keys we rotate, staff access is logged, and platform administrators must use two-factor authentication.

Children

POS is a business tool and is not intended for use by children under 18.

Changes

We will post changes here and update the date. Last updated 14 October 2026.