Privacy Policy

1. Two kinds of data

• Your account data. Information about you and your business as our customer. We decide how it is used, as described here.
• Your business data. What you and your staff enter while using CarrotPOS: products, stock, sales, your customers and suppliers, and accounting records. You control this data; we process it only to provide the service to you.

2. What we collect

• Account details: business name, your name, email address, password (stored only as a secure hash), plan and currency.
• Billing records: invoices and payment status. Card payments are handled by our payment processors; we never see or store full card numbers.
• Business data you enter, as described above.
• Support conversations you send us.
• Technical data: IP address, browser and device type, and logs of requests and errors, used for security and troubleshooting.
• Website usage: pages visited and how visitors arrive at our website, collected through Google Tag Manager and Google Analytics.

3. How we use it

• to run your account, process sales and produce your reports;
• to bill you and handle payments;
• to send service emails such as email verification, password resets, billing notices and support replies (we do not send marketing email without your consent);
• to keep the service secure, prevent abuse and fix problems;
• to understand how our website is used so we can improve it.

We do not sell your information, and we do not use your business data for advertising.

4. Who we share it with

We use trusted providers who process data for us under contract, only as needed:

• cloud hosting and database providers, which store the service and its backups;
• Zoho Mail, to deliver our emails;
• Stripe and SSLCommerz, to process payments;
• error monitoring, to diagnose problems;
• Google (Tag Manager and Analytics), for website usage statistics;
• AI model providers, only if a business turns on the optional AI features. They receive summarised figures needed to answer a question, not your customers' contact details.

We may also disclose information when the law requires it, or to protect our rights or users' safety.

5. Cookies and local storage

CarrotPOS keeps your sign-in session in your browser's session storage and remembers a few preferences (such as a till's chosen register) in local storage. Our website uses Google Tag Manager, which may set analytics cookies to measure visits. You can block or delete cookies in your browser settings; the app will still work.

6. How we protect it

Each business's data is isolated at the database level, connections are encrypted in transit, passwords are hashed, and sensitive credentials are encrypted at rest. Staff access to customer data is limited and every such access by our administrators is logged.

7. How long we keep it

We keep your data while your account is active. When an account is closed, personal details (such as names and email addresses) are anonymised. Financial records may be kept for as long as tax and accounting laws require. Backups are overwritten on a rolling schedule.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to how it is used. Email [email protected] and we will respond within 30 days. If you are a customer of a business that uses CarrotPOS, please contact that business first; we will help them answer your request.

9. International transfers

Tech N Byte LLC is based in the United States and our providers may process data in other countries. Where required, we use appropriate safeguards for these transfers.

10. Children

CarrotPOS is a business service and is not intended for anyone under 18.

11. Changes

If we change this policy in a meaningful way we will tell account owners by email or in the app. The date at the top shows when it was last updated.

12. Contact

Privacy questions: [email protected]. Account help: [email protected].