This policy explains what personal data BoutiquePOS collects, why, who receives it and your rights. It covers the website at getboutiquepos.com and the hosted BoutiquePOS point-of-sale app. It is written for visitors and merchants in the United States, the United Arab Emirates and Pakistan, and for anyone visiting from the European Union.
The service is operated by BoutiquePOS (legal entity details to be published).
Who is responsible for your data?
For data you give us on this website (forms, demo requests, data requests), BoutiquePOS decides how it is used, so we are the “controller” (or “business” under California law).
For data a merchant puts into the POS app about their own customers, staff and sales, the merchant is in charge. We process that data on the merchant’s behalf and only to provide the service. In that case we are a “processor” or “service provider”. If you are a shopper and want to know what a boutique holds about you, contact the boutique first. We will help them answer you.
What data do we collect?
We collect three kinds of data: what you tell us, what the service needs to run, and a small amount of technical data your browser sends.
Data you give us
- Contact and demo forms: your name, business name, email address, phone or WhatsApp number, country, the plan or topic you are asking about, and anything you type into the message box.
- Account signup: your name, business name, login email, password (stored only as a secure hash), currency, tax settings and billing details for your subscription.
- Support conversations: what you send us by form, email or WhatsApp while we help you.
- Data requests: the details you give on the data request page so we can find and verify your records.
Data stored in the POS app
Merchants add products, stock, suppliers, purchase orders, sales, returns, expenses, staff accounts, customer records, loyalty points and purchase history. This is the merchant’s business data. We hold it so the app works, and we do not use it for our own marketing.
Technical data
When you visit the site, our hosting provider receives standard request data such as your IP address, browser type, the page requested and the time. It is used to deliver pages and stop abuse. The site also stores a few settings in your own browser (theme, country, your cookie choice). The Cookie Policy lists every key.
If you arrive from an ad or a tagged link, we keep the campaign tags (utm values, gclid, fbclid or msclkid) in your browser so that, if you send a form, we can tell which ad or link brought you. These are not sent anywhere unless you submit a form.
Payment card data
We do not collect or store card numbers. Merchants take card payments through their own card processor. Our own subscription billing, where a card is used, is handled by a payment provider that keeps the card details; we only see a reference, the card brand and the last four digits.
How do we use your data?
We use it to do what you asked and to run a safe, working service. Specifically:
- to reply to your message, book and run your demo, and follow up about the plan you asked about;
- to create and run your account, import your catalog, provide support and send service notices (renewals, security alerts, changes to terms);
- to bill your subscription and keep tax and accounting records;
- to protect the site and app from spam, fraud and attacks;
- to understand which ads or links bring enquiries, using the campaign tags described above;
- to meet legal obligations and resolve disputes.
We send marketing emails only where the law allows it and you can opt out at any time.
Our legal bases (EU, UAE and similar laws)
Where a law asks for a legal basis, we rely on: performing a contract with you (your account), taking steps you asked for before a contract (your demo request), our legitimate interests (security, improving the service, measuring which links bring enquiries, in a way that does not override your rights), legal obligations (tax records), and your consent (optional analytics or marketing cookies, and some marketing messages). Where we rely on consent, you can withdraw it at any time.
Who do we share data with?
We share data only with the service providers who help us run BoutiquePOS, and only what each one needs. We do not sell personal data and we do not “share” it for cross-context behavioral advertising as California law defines those terms.
| Provider | What it does | What it receives |
|---|---|---|
| Cloudflare (Pages) | Hosts this website and delivers pages | Request data such as IP address and browser |
| Cloudflare Turnstile | Checks that a form is sent by a person, not a bot | Browser and device signals when a form loads |
| GoHighLevel | Our CRM, where form enquiries and follow-ups are kept | What you type into a form, plus campaign tags |
| Discord | Sends our team a notice that a new enquiry arrived | A short summary of the form, so we reply quickly |
| Our own servers (VPS) | Host the POS app and its daily backups | Merchant account and business data |
| Billing provider | Charges subscription payments | Billing details; card data stays with them |
We may also disclose data if the law requires it, to protect people or our service from harm, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.
Where is your data stored and sent?
Our providers operate in several countries, including the United States. This means your data may be processed outside the country where you live. Where the law of your country (for example the UAE PDPL or the GDPR) requires safeguards for such transfers, we rely on the provider’s contractual commitments and the transfer mechanisms that law allows.
How long do we keep data?
We keep data only as long as we need it:
- Enquiries that do not become customers: up to 24 months after our last contact, then deleted or anonymized.
- Merchant account data: for as long as the account is active. After you close your account you have 30 days to export; then we delete it from live systems, and it falls out of backups as they rotate.
- Billing and tax records: as long as tax law in the relevant country requires.
- Browser settings on your device: until you clear them.
How do we protect it?
We use encrypted connections (HTTPS), hashed passwords, per-merchant access controls, role-based permissions inside the app, limited staff access and daily backups of the POS app. No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authority where the law requires it.
What are your rights?
You can ask us to show you, correct, export or delete your personal data, and to stop using it for marketing. The details depend on where you live. The quickest way is the form on our data request page, which also explains each region in more detail. You can also use the Show email button on our contact page. We will not treat you differently for using your rights.
United States
Residents of California (under the CCPA as amended by the CPRA) and of other states with consumer privacy laws, such as Virginia, Colorado, Connecticut, Utah and Texas, may have the right to know what we collect, to access, correct and delete it, to get a portable copy, and to opt out of sale, sharing for targeted advertising and certain profiling. We do not sell or share data in those senses. You may use an authorized agent, and you can appeal a decision we make about your request by replying to our answer. If we ever add tags that a Global Privacy Control signal applies to, we will honor that signal as an opt-out where the law requires.
Our marketing emails follow the CAN-SPAM Act: they identify us, have a clear subject line and include a working unsubscribe link that we honor promptly.
United Arab Emirates
Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), you can ask for information about the processing, access and correction of your data, deletion, restriction of processing, objection to processing (including for direct marketing) and transfer of your data to another controller. You may also have rights under UAE consumer protection law, which this policy does not limit.
Pakistan
The Prevention of Electronic Crimes Act 2016 protects against unauthorized access to and misuse of data and information systems. A dedicated personal data protection law is pending. Until it is in force, we give visitors and merchants in Pakistan the same rights to access, correct, delete and export their data that we give everyone else.
European Union and United Kingdom visitors
If the GDPR or UK GDPR applies to you, you have the rights to access, rectification, erasure, restriction, portability and objection, and to withdraw consent. You can also complain to your local data protection authority.
Cookies and similar storage
No analytics or marketing tags load before you consent. At the time of writing none are configured. Our cookie banner groups any future tags into categories you can accept or reject. Essential storage, such as remembering your cookie choice, works without consent. See the Cookie Policy for the full list.
Children
BoutiquePOS is a business tool and is not directed at children. We do not knowingly collect personal data from children under 13, in line with COPPA, or from anyone under 16 without the consent the law requires. If you think a child has sent us data, contact us and we will delete it.
Changes to this policy
We will update this page when our practices change and change the “updated” date at the top. If a change is significant, we will also tell account holders by email or in the app before it takes effect.
How do you contact us about privacy?
Use the Show email button on our contact page or the form at /data-request/. We reply within one business day and complete requests within the time the law in your region allows.
