KPOSPrivacy Policy
Last updated: July 2026
Who we are
KPOS is point-of-sale software for Philippine sari-sari and small retail stores, made up of the KPOS App (installed on your own computer) and the KPOS Website (mykpos.xyz, for buying and managing your license).
Your store data stays on your computer
KPOS is local-first. The data you create by running your store — sales, inventory, credit/utang records, staff accounts, and audit logs — is stored locally on your own device. It is not uploaded to us by default, and we cannot see it. The only exception is opt-in remote backup: on each backup you choose whether to also send an encrypted copy of your store data to our cloud storage, private to your store, so it can be restored if you lose your device. It stays off by default and only sends when you say yes.
What we collect and store in the cloud
Name and email when you register or buy on the website. Purchase info from manual GCash checkout, to verify and approve payment. License activation records, to track which license is active on which device. Anonymous analytics events (counts of transactions/features used, no personal information or store financial figures). A one-way hashed device fingerprint, to prevent trial abuse — never your raw device identifier. Patch/update notification data, to let the App know when an update is available. If you opt in, an encrypted copy of your store backup.
What we do not do
We do not sell or rent your personal information to anyone. We do not share your data with third parties except the infrastructure providers strictly needed to run the service (Supabase for database/auth, Resend for email, Vercel for hosting), each acting only as our processor. Analytics never includes your store's financial figures or your customers'/debtors' personal data.
The utang (credit) feature
The App's credit/utang feature lets you record debts owed to your store, which may include personal information of your own customers. That data stays local to your device, under your control as the store owner. It is collected for credit-management purposes only, is not shared with third parties, and is handled in line with the Data Privacy Act of 2012 (RA 10173). As the store owner, you are responsible for how you collect and use your own customers' data — KPOS provides the tool but does not access this data unless you opt into remote backup.
Retention
Local store data is kept on your device until you delete it or uninstall with "remove all data" — we never had it, so we cannot delete it for you. Account data (name, email, licence records) is kept while your account is active. If you delete your account it is deactivated immediately, retained for 30 days as a dispute window, then permanently and automatically deleted — no manual step, and we keep a dated record of what was deleted so we can confirm it to you. Completed payment records survive that deletion in anonymised form, detached from your name and email, because Philippine tax rules require proof of sale to be retained. Analytics is retained in aggregate, not tied to your identity. Opt-in backups are kept while backup is enabled, and deleted on request or when you disable it.
Your rights under RA 10173
You have the right to be informed, to access your personal data, to object to processing, to correct inaccurate data, to have your data erased or blocked, and to be indemnified for damages from unlawful processing. To exercise any of these, email info@mykpos.xyz. If you believe your rights were violated, you may also complain to the National Privacy Commission (NPC).
Security
Passwords are stored hashed, never in plain text, via our authentication provider. The App encrypts your license locally, keyed to your device. Data in transit uses HTTPS. No system is perfectly secure; we minimize risk by keeping most data local to your device rather than in the cloud.
Changes to this policy
We may update this policy from time to time. Material changes will be noted on this page.