Synorra POS
Privacy Policy
Last updated October 19, 2026
This document describes the current Synorra POS app behavior. It is provided for product information and should be reviewed by qualified counsel against your business operations and applicable requirements before publication.
Customer data collected by the current POS
The current POS does not provide customer-profile fields for customer name, phone, email, physical address, loyalty accounts, or digital invoices, and it does not send digital receipts. Do not enter such information into free-text fields unless the Merchant has a lawful purpose and has given the required notice. If a future feature collects customer details, this policy and the customer-facing notice must be updated before use.
Transaction and payment information
The POS stores order items, totals, discounts or promotion labels, payment-method labels (Cash, GCash, or Maya), amounts paid and change, ticket numbers, timestamps, and void details. GCash and Maya are recorded as payment-method choices only; the current POS does not connect to a payment gateway or collect card numbers, CVV codes, or bank credentials. No PayMongo, Stripe, or other payment processor integration is configured in the current code. The POS does not record cash-drawer opening, closing, or cash-release events.
Staff, audit, and technical information
Staff and Admin records may include name, username, email, role, permissions, and password credentials. The system records login/logout and shift activity, orders and void requests, inventory and restock changes, timestamps, and related staff identifiers. New or changed web passwords use bcrypt; legacy records may remain in the older format until they are upgraded. Mobile offline credentials use the device secure-storage facility. The app does not request a staff PIN or phone number. The app itself does not maintain an IP-address or browser-fingerprint profile; hosting providers may collect network, device, and access logs under their own notices.
Purposes of processing
Information is used to authenticate users and apply role permissions; record sales, print receipts and labels, apply discounts, manage inventory and restocks, generate operational reports, attribute voids and staff activity, synchronize offline changes, secure accounts, and troubleshoot the service. The current system does not provide customer loyalty or marketing features.
Sharing and service providers
Store records are synchronized with the Supabase project configured for Synorra POS. The website is hosted through Vercel. Gmail SMTP is used to send Owner password-reset emails. The app can connect to Bluetooth printers to print selected order information. No payment-gateway or customer SMS/email-receipt provider is integrated in the current code. Information may also be disclosed when required by a valid legal request. Confirm the providers and their data-processing terms for your deployment.
Storage and security
Network requests use HTTPS when the deployed service supports it. New or changed web passwords use bcrypt and web sessions are signed, HttpOnly cookies with a 12-hour expiry. Role-based permissions restrict available features. Mobile offline credentials use platform secure storage, but other operational data and pending queues are cached in local app preferences and are not encrypted by the app; secure the POS device with a screen lock and limit physical access. The app does not currently enforce automatic idle logout. Activity records are not guaranteed to be immutable, and the current system includes record-deletion controls; do not rely on them as a tamper-proof legal audit log. Cloud-at-rest encryption and backup frequency/retention depend on the configured Supabase/Vercel plans and settings and have not been verified by this app; do not assume a daily encrypted backup is enabled.
Retention and deletion
The current code does not set an automatic retention or archival schedule. Store and audit records remain in local or cloud storage until deleted through available account or record-management functions, subject to provider backup cycles. Merchants must preserve records for any applicable legal and tax period. In the Philippines, RA 11976 amended the general preservation period for books of accounts and other accounting records to five years, subject to its terms and exceptions; obtain tax advice for your business and keep any required records before deleting an account. The POS does not automatically enforce that retention period.
Data subject rights and requests
Staff and other individuals may contact the responsible business to request information about, access to, or correction of personal data, or to ask about deletion/blocking. The account owner can manage staff accounts and request Owner-account deletion in Support > Account. Deletion may be limited where records must be retained by law or are needed for legal claims. The current POS does not store customer profiles; customer requests about information collected outside the POS should be directed to the business that collected it.
Privacy contact
Service name: Synorra POS. For privacy inquiries or data requests, email help.synorra@gmail.com or call +63 981 772 6937. The legal operating entity and appointed Data Protection Officer/Privacy Lead are not identified in the system configuration; the operator must confirm and publish those details before treating this draft as the official privacy notice.