Privacy policy

Last updated:

Contents
  1. 1. Who we are and our role
  2. 2. Data we process
  3. 3. What we do not do
  4. 4. Purposes and legal bases
  5. 5. Device permissions
  6. 6. Sharing of data
  7. 7. Retention
  8. 8. Security
  9. 9. Your rights
  10. 10. Children
  11. 11. Deleting your account and data
  12. 12. Changes to this policy
  13. 13. Contact

This Privacy Policy explains how personal data is collected, used, stored and protected when you use the UniPOS Mobile Manager mobile app (Android and iOS, the “App”). The App is a reporting and control tool for restaurants that use the UniPOS cloud point-of-sale system. Where the same data flows apply, this policy also covers other UniPOS services (for example, the web admin panel).

The App is not a consumer app — its users are restaurant owners and staff authorised by the restaurant (managers, accountants, storekeepers and similar roles).

1. Who we are and our role

The App is developed and operated by UniPOS. “We”, “us” and “UniPOS” in this policy refer to it.

  • For user accounts and the App’s technical data (sign-in, session, push notification tokens, notification preferences), UniPOS is the controller.
  • The restaurant’s business data (sales, receipts, stock, finance, staff, and the restaurant’s own customer records such as names, phone numbers and reviews) belongs to the restaurant. The restaurant is the controller of this data; UniPOS processes it on the restaurant’s behalf and on its instructions under the service agreement.

If you are a customer of a restaurant and have a question about the data that restaurant holds about you, please contact the restaurant first. We will help the restaurant respond to your request.

2. Data we process

2.1. Sign-in data

To sign in you enter a username and password (owner account), or a username, password and restaurant name (staff account). This data is sent over an encrypted HTTPS connection to the UniPOS server (api.unipos.tech). Your password is not stored on the device. Accounts are not created in the App — they are created by UniPOS or by the restaurant in the web admin panel.

2.2. Session data

After a successful sign-in, a session record is stored on the device: the restaurant (profile) ID and name, your role, your username, staff ID and name, the branches you are allowed to access, and the sign-in time. This record is kept encrypted in the device’s secure storage (Android Keystore / iOS Keychain) and is deleted when you sign out.

2.3. App PIN and biometric unlock

You can optionally set a PIN for the App. The PIN is stored only on your device, encrypted, and is never sent to our servers. Fingerprint or face unlock is performed by the operating system — the App never receives or stores biometric data; it only receives a success or failure result. Uninstalling and reinstalling the App removes the PIN.

2.4. Push notifications (optional)

When you enable push notifications to receive alerts about POS events (for example, a deleted receipt, a discount or a cancelled payment), the following is sent to the UniPOS notification server (sapi.unipos.tech):

  • the device token issued by Firebase Cloud Messaging (Google LLC);
  • device manufacturer and model, operating system version, and App version;
  • restaurant and branch IDs;
  • your notification preferences (mode, selected event types, branches).

You can turn push notifications off at any time in the App’s Settings or in your phone’s system settings. The token is removed from the server when you sign out or turn push off. On Android 13 and later the App asks for a separate permission to show notifications.

2.5. Restaurant business data

The App displays the restaurant’s data stored on UniPOS servers: sales, receipts, stock levels, financial figures, staff, and the restaurant’s customer records (names, phone numbers, reviews). Authorised users can edit some records — for example a menu item’s name, price and image, categories, expenses, and waiters’ POS PINs. These changes are saved on UniPOS servers in the restaurant’s account.

2.6. Photos

Only when you choose to change a product or category image is the single photo you select through the system photo picker or camera uploaded to UniPOS servers as that item’s image. The App does not request broad access to your photo library and does not see your other photos.

2.7. On-device preferences and cache

Language, theme, dashboard layout and table settings are stored on the device. Some report data is cached on the device temporarily so that reports open faster; the cache is cleared when you sign out.

2.8. Receipt PDFs

Receipt PDFs are generated on the device itself and are shared only when you tap Share, through the app you choose in the system share sheet.

3. What we do not do

  • The App shows no advertising, and no data is collected for advertising.
  • No analytics or tracking SDKs are used.
  • The App does not request access to your location or contacts.
  • Personal data is not sold and is not shared with third parties for advertising.
  • Data is not used for profiling or automated decision-making.

4. Purposes and legal bases

  • Providing the service — identifying you, showing the restaurant’s reports, saving the changes you make. Basis: performance of the service agreement with the restaurant.
  • Push notifications — alerting you about the events you choose. Basis: your consent, which you can withdraw at any time.
  • Security — preventing unauthorised access to accounts and limiting access by role. Basis: our and the restaurant’s legitimate interests.
  • Legal obligations — keeping records required by tax and accounting law. Basis: legal obligation.

5. Device permissions

  • Internet and network state — to communicate with UniPOS servers.
  • Notifications (Android 13+) — only if you enable push notifications.
  • Biometrics — only if you enable fingerprint / face unlock; the check is performed by the operating system.
  • Camera / photo picker — only at the moment you change a product or category image, at your choice.

6. Sharing of data

We share data only where it is necessary for the service to work:

  • Google Firebase Cloud Messaging (Google LLC) — to deliver push notifications to your device. Google processes this data under its own policies: Google Privacy Policy, Privacy and Security in Firebase. Google’s servers may be located outside Azerbaijan.
  • Hosting providers — infrastructure providers that host UniPOS servers; they store data only on our behalf.
  • The restaurant — the restaurant’s business data is shown to users the restaurant has authorised; the restaurant owner defines the scope of access through roles and permissions.
  • Public authorities — only where and as required by law.

We do not sell personal data and do not share it with anyone for advertising.

7. Retention

  • Account and business data are kept while the restaurant’s UniPOS subscription is active. After the subscription ends or after a deletion request, data is deleted or anonymised, except records that tax and accounting law requires us to keep (for example, sales and fiscal records), which are kept for the period required by that law.
  • Push token and notification preferences are kept while push is enabled and are removed when you sign out or turn push off.
  • On-device data (session, cache) is removed when you sign out; the PIN and preferences are removed when you uninstall the App.

8. Security

  • All communication between the App and our servers is encrypted with HTTPS/TLS.
  • The session and PIN are stored in the device’s encrypted storage (Android Keystore / iOS Keychain).
  • Access to data is limited by roles and permissions set by the restaurant owner.

No system can guarantee absolute security. If you suspect unauthorised use of your account, tell the restaurant owner or us (contact@unipos.tech) immediately.

9. Your rights

Under the Law of the Republic of Azerbaijan “On Personal Data” and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

  • know what data about you is processed and obtain a copy of it;
  • have inaccurate or incomplete data corrected;
  • request deletion of your data (see Account deletion);
  • object to processing or request its restriction;
  • withdraw your consent at any time (for example, by turning off push notifications);
  • lodge a complaint with a competent supervisory authority.

To exercise your rights, email contact@unipos.tech. After verifying your identity and your link to the account, we respond within the period set by law, normally within 30 days. If the request concerns data controlled by a restaurant, we will forward it to that restaurant.

10. Children

The App is intended for businesses and is not directed at children. Users must be at least 18 years old and authorised by the restaurant. We do not knowingly collect data from children.

11. Deleting your account and data

How to delete your account and the related data is explained on a separate page: Account deletion.

12. Changes to this policy

We may update this policy from time to time. The new version is published on this page and the “Last updated” date at the top changes. We give additional notice of significant changes through the App or the website.

13. Contact

For questions about this policy or your personal data: