VoicePOS Privacy Policy

When you install VoicePOS you approve the permissions it requests on your Clover account. Through those permissions, and through your use of the App, we collect:

• Business information: business name, business hours, tip settings and order types. The App can update these settings when you ask it to.
• Inventory: items, categories, modifiers, discounts, tags, tax rates, prices and stock levels. The App reads and changes this data when you ask it to.
• Employees: employee names, roles and shifts. The App reads this data; it does not create or update employees. If you set up PINs for your staff to sign in to the App, we store them only as salted hashes.
• Customers: customer names, email addresses and phone numbers. The App reads them when you ask it to look up a customer; it does not create customers.
• Orders and payments: orders and sales reports, and payment details such as amount, tip, payment result, tender type (for example, cash or card), date and time, and the employee who took the payment. The App never receives full card numbers and does not store card details.
• Voice and text commands: the text of your commands and of the App's replies. When you speak a command, the audio is sent to our speech-to-text provider to be transcribed. We keep only the text: we never store audio recordings.
• Usage data: command history, the features you use and how you interact with the App.
• Authentication tokens: the OAuth tokens that let the App access your Clover account, encrypted with AES-256-GCM.

Customer and employee details are stored in your command and conversation history only when a command you give, or the App's reply to it, includes them.

• To carry out your voice and text commands, such as changing prices, updating stock or reporting on sales.
• To understand requests in natural language with AI, and to read the App's replies aloud.
• To keep your command history, conversation history and undo working.
• To maintain and improve the accuracy of command interpretation and the performance of the App.
• To display your command history and usage analytics.
• To send important updates and security alerts about the App, including push notifications if you turn them on.
• To provide customer support and respond to inquiries.

We may also use personal data as necessary to comply with applicable law and legal process, to enforce the terms that govern the App, and to protect against fraudulent, harmful, unauthorized or illegal activity. We do not sell personal information, and we do not use it for advertising.

We share personal data only:

• With the Merchant on whose behalf we collected it. Changes you request are written back to your Clover account.
• With the platform on which the App runs, the Clover POS. Clover's Privacy Notice is available at https://www.clover.com/privacy-policy.
• With the service providers listed in section 4, which help us run the App.
• With other third parties when the Merchant directs us to.
• When required by law, such as in response to a subpoena or a request from a government authority, or when necessary to protect our rights, safety or property, or those of others.
• With a buyer or successor in a merger, acquisition, reorganization or sale of assets, who will be required to honor this Privacy Policy.

VoicePOS relies on the following service providers:

• OpenAI: natural-language understanding of commands and the App's replies. It receives the text of your commands and the data needed to answer them, such as item names, prices, customer names or payment totals.
• Groq: speech-to-text transcription (Whisper model). It receives the audio of spoken commands.
• ElevenLabs: text-to-speech, to read the App's replies aloud. It receives the text of those replies.
• Supabase: database and authentication.
• Upstash: Redis caching for performance.
• Vercel: application hosting.

Each provider has its own privacy policy. We share only the minimum data each one needs to perform its function.

• OAuth tokens are encrypted with AES-256-GCM and stored in Supabase with Row Level Security (RLS) policies.
• Voice data is processed in real time and only text transcriptions are retained. Audio recordings are never stored.
• Staff PINs are stored only as salted hashes.
• Data is hosted on secure cloud infrastructure (Vercel, Supabase).
• All data in transit is encrypted with HTTPS/TLS.

• Cached inventory data expires after 5 minutes.
• Command history, voice transcripts and conversation history are retained while VoicePOS is installed on your Clover account, so that features like command history and undo keep working.
• OAuth tokens are retained while VoicePOS is installed on your Clover account.

When you uninstall VoicePOS

• Immediately: we delete the OAuth tokens that give VoicePOS access to your Clover account, revoke every active session on every device, and delete stored staff PINs and push notification subscriptions. VoicePOS can no longer read or write anything in your Clover account.
• Within 30 days: we delete your command history, voice transcripts, conversation history, scheduled discounts and scheduled availability. The 30-day window exists so that an accidental uninstall, or a reinstall, does not wipe your history.
• What we keep, and why: we retain a security audit log recording which actions were performed on your inventory, by whom and when, together with a minimal record of the account (an identifier and the install and uninstall dates). We keep it to investigate disputes about changes made to a Merchant's inventory, to detect fraud and abuse, and to meet our own security auditing obligations; the legal basis is our legitimate interest and the establishment or defense of legal claims. It contains no payment data and no customer personal data, and it is append-only by design: entries cannot be altered or removed, including by us. You can request a copy of the entries concerning your account at any time using the contact details below.

As a Merchant, you can:

• Access your stored data by requesting it by email.
• Request deletion of your data at any time. Uninstalling VoicePOS triggers the deletion described in section 6, and you can also ask us to run it sooner. The security audit log is the one exception, for the reasons given in section 6.
• Revoke VoicePOS's access at any time by uninstalling the App from your Clover account.
• Opt out of non-essential data collection, such as push notifications.

Your customers and staff should send requests about their personal data (for example, to access, correct or delete it) to you, the Merchant. If we receive such a request directly, we will refer it to you, and we will reasonably assist you in responding to it.

For California residents: we process personal information as a service provider to the Merchant under the California Consumer Privacy Act (CCPA). We do not sell or share personal information, as those terms are defined in the CCPA, and we do not use it for any purpose other than providing the App to the Merchant.

If you have a complaint about how we handle personal data, contact us using the details in section 10.

VoicePOS is designed for business use and is not intended for children under 13. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify Merchants of material changes through the App, and the date at the top of this page always shows the latest version.

For privacy questions or data requests, contact:

HENOC MARKETING LLC, Orlando, Florida

Email: miolabs01@gmail.com