1. Introduction
Welcome to RetailCore ("we," "our," or "us"). We operate the RetailCore Multi-Store Sales Management System (the "Service"), a cloud-based point-of-sale and inventory management platform designed for retail businesses. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service, including our website, web application, and any related services.
By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access the Service.
2. Information We Collect
2.1 Account Information
When you create an account, we collect information that identifies you as a user of the Service, including:
- Full name (first name and last name)
- Email address
- Phone number (optional)
- Password (stored securely using bcrypt hashing — we never store plaintext passwords)
- Profile photograph (optional, uploaded by the user)
- Role within the organization (Admin or Employee)
2.2 Business Data
As part of using the Service, you and your organization create and manage business data, including:
- Shop/store names, addresses, and contact information
- Product information (names, descriptions, SKUs, prices, categories, images)
- Inventory levels, stock movements, and warehouse data
- Sales transactions (items sold, prices, discounts, payment methods, customer names)
- Employee records (names, positions, hire dates, salary information)
- System settings (currency, date format, timezone)
- Uploaded images (product photos, profile pictures)
2.3 Authentication and Security Data
For security and audit purposes, we automatically collect:
- Login timestamps and IP addresses
- Browser/device user agent strings
- Password reset request records
- Audit log entries (who performed what action and when)
- Session refresh tokens (for maintaining secure sessions)
2.4 Automatically Collected Information
When you access the Service, we may automatically collect certain technical information, including:
- IP address
- Browser type and version
- Operating system
- Pages visited and time spent on pages
- Error logs and performance data
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service
- Process your transactions and manage your inventory
- Authenticate users and maintain account security
- Send administrative notifications (e.g., password reset emails, deactivation notices)
- Generate analytics and reports for your business
- Prevent fraud, abuse, and security incidents
- Comply with legal obligations
- Improve and optimize the Service
- Communicate with you about updates, features, or support
4. How We Share Your Information
We do not sell your personal information. We may share your information only in the following circumstances:
- Within your organization: Admin users can view and manage employee data, sales records, and business metrics for their assigned shops. Employees can only access data within their assigned shop.
- Service providers: We use third-party services to operate the Service, including Vercel (hosting), Supabase (database and file storage), and Resend (transactional emails). These providers have access only to the information necessary to perform their services and are bound by confidentiality obligations.
- Legal compliance: We may disclose information if required by law, regulation, or valid legal process.
- Security: We may share information if we believe it is necessary to prevent harm, fraud, or violations of our Terms of Service.
5. Data Storage and Security
Your data is stored on secure cloud infrastructure provided by Supabase, hosted on Amazon Web Services (AWS). We implement industry-standard security measures, including:
- Encryption of data in transit (TLS/HTTPS)
- Passwords hashed with bcrypt (12 rounds) — we never store plaintext passwords
- JWT-based authentication with secure session tokens
- Role-based access control (Admin vs. Employee permissions)
- Row-level security on the database
- Regular security audits and dependency updates
- Input sanitization to prevent injection attacks
- Rate limiting on authentication endpoints
While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.
6. Data Retention
We retain your information for as long as your account is active or as needed to provide the Service. Specifically:
- Account data: Retained while your account is active. When an admin deletes an employee, all associated data (sales, inventory records, auth logs) is permanently deleted.
- Sales records: Retained as long as your organization maintains the account. You may export your data at any time.
- Audit logs: Retained for security and compliance purposes for up to 12 months.
- Session tokens: Automatically expire after 8 hours. Refresh tokens are invalidated on logout or account deactivation.
- Password reset tokens: Expire after 1 hour and are marked as used upon completion.
7. Your Rights
Depending on your location, you may have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your personal data (subject to legal retention requirements).
- Export: Admin users can export all business data (sales, inventory, audit logs) in CSV format from the application.
- Restriction: Request restriction of processing of your personal data.
- Objection: Object to processing of your personal data for certain purposes.
To exercise any of these rights, please contact your organization administrator or reach out to our support team.
8. Cookies and Tracking
We use essential cookies and session tokens to maintain your authentication session. These are strictly necessary for the Service to function. We do not use advertising cookies or third-party tracking technologies. Session cookies are stored as HTTP-only secure cookies and are automatically deleted when you sign out or your session expires.
9. Children's Privacy
The Service is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete that information promptly.
10. International Data Transfers
Your data may be transferred to and processed in countries other than your country of residence. Our infrastructure providers (Vercel, Supabase, AWS) operate globally. We ensure that appropriate safeguards are in place to protect your personal data in accordance with this Privacy Policy, including the use of standard contractual clauses where required.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top. Your continued use of the Service after any changes constitutes acceptance of the updated policy.
12. Contact Us
If you have any questions about this Privacy Policy, please contact us:
- Email: support@retailcore.app
- Through the application: Admin Settings page