How we handle your information when you use POSONLY.
Effective October 11, 2026.
POSONLY is operated by Pablito Torres, trading as POSONLY. Contact us at pewbbs@gmail.com about privacy or your information.
POSONLY helps businesses manage inventory, sales, receipts, teams, reports, and subscription records. Business administrators choose what information to enter and which staff can access their workspace. If a business entered your customer or employee information, you can also contact that business about its use of your data.
We use these details to provide the features you choose, keep company records together, manage permissions and subscription access, send requested password-recovery emails, and investigate problems or misuse.
The POS records payment methods and amounts. Its current checkout form does not collect card numbers, security codes, or bank login credentials. Do not put these details in free-text fields.
Google sign-in is optional. Email-and-password registration and sign-in remain available. When you choose Google, we request basic identity, email, and profile permissions to verify your account.
Google supplies an account identifier, your email address and verification status, and your display name when available. We check security information in its signed response to verify the sign-in. The profile permission may include a picture; POSONLY does not extract, display, or store your Google profile picture.
We use your Google identity to register your company account, sign you in, or connect Google to the company account you are already using. You review and submit your company details before a new workspace is created. Matching email addresses alone do not link an existing account.
We save the provider name, a hash of the Google account identifier, verified email, linked POSONLY user, and connection timestamps. Your POSONLY account also stores its name and email. Temporary sign-in and pending-registration details are held in the protected application session.
We do not persist Google access, refresh, or ID tokens. We request no offline access and no access to Gmail messages, Google Drive files, contacts, or calendars. We do not send inventory or sales records to Google for sign-in.
Google identity information is used for these account features, not sold or used for advertising. It is handled by our application and hosting infrastructure as described below. Google operates its own sign-in service under Google’s privacy policy.
Your company’s authorized staff can access information allowed by their role. Administrators manage team access, Settings, billing, and supported exports. Customer contact information can be available to staff using that company’s POS.
Authorized platform owners manage companies, subscriptions, invoices, and website content. Server and database operators may need technical access to maintain the service or investigate an issue.
Hostinger hosts POSONLY’s application, database, and stored files and processes network requests. Hostinger’s email infrastructure handles outbound password-recovery emails, including destination addresses and message contents.
If you choose Google, your browser visits Google’s service and POSONLY exchanges the authorization code with Google to verify your identity. Printed receipts, saved PDFs, and downloaded reports are controlled by the business and the people who create or receive those copies.
When you choose enabled PayMongo hosted checkout for a subscription invoice, POSONLY sends PayMongo the plan description, invoice amount in Philippine pesos, a payment reference, and checkout return URLs. Your browser opens PayMongo’s payment page. We retain checkout and payment identifiers, payment mode, status, and confirmation times to verify the invoice and manage subscription access.
You enter hosted-checkout payment details with PayMongo, rather than in POSONLY’s forms. POSONLY does not collect or store your card number or security code. PayMongo processes information under PayMongo’s privacy policy. Live mode collects real payments; test and local simulated records are labeled separately.
External commerce synchronization is not connected. Simulated channel orders and local simulated invoice payments contact no payment provider.
We use first-party session cookies and request-security mechanisms to keep you signed in and protect forms. Company and developer sign-ins use separate sessions. Blocking these cookies can prevent sign-in or form submission.
The website keeps its A/B presentation choice in browser session storage. Our website event records contain landing-page view, demo-open, pricing-view, or trial-click labels, the presentation variant, and timestamps. We use them to understand the website’s main actions.
These event records do not contain names, emails, IP addresses, or customer identifiers. Session records and hosting logs are separate and may contain network and browser information. The website does not use a Google Analytics or advertising tracking SDK. Google may use its own cookies on its sign-in pages.
The production service uses HTTPS, password hashing, secure session cookies, encrypted session payloads, protected server configuration, and company and role checks. Receipt logos are stored privately and served through an authenticated company route. Google sign-in responses are verified, and sensitive account routes have request protections and rate limits.
Business data is stored in the application database and file storage. These controls reduce risk; they do not guarantee absolute security or mean that every database field and backup is individually encrypted.
The current service has no general automatic deletion period for company accounts, Google connections, customer and business records, sales, invoices, activity history, or website events. Signing out, pausing an account, canceling renewal, or removing Google authorization does not delete these records.
The application’s scheduled maintenance removes handled monitoring events older than 30 days and failed-job records after seven days. Outstanding pending queue diagnostics remain. Daily application logs rotate with a default limit of 14 files. These limits do not set retention periods for business records, hosting logs, backups, or downloaded copies.
Contact pewbbs@gmail.com to ask about a particular record or request deletion. We will need to verify the request and its relationship to the relevant company before acting, and explain any records that need to be retained.
Open Sign-in accounts to review your company account’s Google connection. Connecting Google requires your signed-in company account and preserves its company and role. It does not grant developer access.
You can review or remove Google authorization in Google Account connections. Doing this does not delete your saved POSONLY connection or company records, and it does not end an existing POSONLY session.
Company administrators can edit supported Settings fields, replace or remove receipt logos, manage team names, roles and active access, and download supported sales, financial and invoice CSV reports. Those reports are not a complete personal-data export. There is currently no self-service account-deletion or Google-disconnection button.
For access, correction, another copy, deletion, or removal of a Google connection, email pewbbs@gmail.com. We may need to verify your identity and the business administrator’s authority. If you use Google without a password, arrange another way to sign in before requesting removal of the connection. Eligible accounts can use password recovery.
We will publish updates here with their effective date when our practices change. Changes to Google data access or use will be disclosed before that processing begins, with new permission requested when needed.
Questions about this policy? Contact pewbbs@gmail.com.