Privacy Policy — Kassenta POS

Effective date: 29 May 2026

Last updated: 10 October 2026

1. Introduction

This Privacy Policy explains how Kassenta ("Kassenta", "we", "us", or "our"), a company based in Egypt operating at www.kassenta.com, handles information in connection with the Kassenta POS mobile application (package com.barmagly.pos) and its supporting backend services at kassenta.com.

Kassenta POS is a tablet-optimized Point of Sale and mini-ERP application for pharmacies, retail stores, cafes, restaurants, and small businesses. It provides cart and checkout, inventory and product management, customer CRM, reporting, table and online ordering, delivery management, and multi-currency payments. Each merchant ("Store") operates an isolated workspace activated via a license key.

This policy also covers the Kassenta Driver app (package com.barmagly.driver, also at kassenta.com/driver), used by delivery drivers of those stores. What it collects is described in section 2.4.

Who is the data controller? When a merchant uses Kassenta POS to run their business, the merchant is the controller of customer and transaction data they enter. Kassenta acts as a processor on the merchant's behalf. For account holders (merchants, owners, managers, cashiers), Kassenta is the controller of the account information needed to provide the service.

2. Data We Collect

2.1 Information merchants enter into the app

Merchants and their staff voluntarily enter business data into Kassenta POS, which may include:

Account and staff information: employee names, PINs (stored hashed), email addresses for administrators, and roles (Admin/Owner, Manager, Cashier).
Store information: store name, branches, addresses, tax IDs, logos, operating hours, and currency configuration.
Product and inventory data: product names, prices, categories, modifiers, sizes, addons, stock levels, and barcodes.
Customer data entered by the merchant: customer name, phone number, delivery address, and order history (used for CRM and delivery).
Order and transaction records: cart contents, discounts, payment method (Cash, Card, TWINT, Stripe), receipts, returns, and notes.
Operational data: delivery zones, promo codes, driver assignments, table layouts, QR-based online orders.

2.2 Information collected automatically

Authentication tokens and session identifiers associated with the merchant's license key.
Technical logs from the backend (IP address, timestamps, request paths, HTTP status codes, app version, device OS) used for security, abuse prevention, and debugging.
Crash and error events generated by the app or server, used to diagnose issues.

2.3 What we do not collect

We do not embed third-party analytics or advertising SDKs by default.
We do not collect contacts, SMS, call logs, photos, or files outside the app's own storage.
We do not sell personal data to anyone, for any purpose.
We do not use customer or transaction data for advertising or profiling.
Kassenta POS does not track precise location in the background. Only the Kassenta Driver app does, and only while the driver is online (section 2.4).

2.4 Kassenta Driver app (delivery drivers)

The Kassenta Driver app connects a store, its delivery drivers and its customers. For drivers it processes:

Data	Why	Who can see it
Google account: account ID, name, e-mail, profile photo (Google Sign-In)	Sign-in, and one account per driver	The driver. Not shared with stores or customers
National ID number	Identity check and fraud prevention: one ID can hold only one driver account	Kassenta only. The app shows it masked to the driver; it is not shared with stores or customers
Phone number, confirmed with a one-time WhatsApp code	Identity check; links the driver to the stores that registered that number	The stores the driver works for
Precise location, including in the background	Live delivery tracking and dispatch	The driver's store; the customer of an order the driver is carrying (on that order's tracking page)
Delivery activity: accepted orders, steps and times, cash collected, delivery fees	Delivery workflow, the driver's earnings, the store's records	The driver and the store
Device notification token	New-order alerts	Kassenta only

Location while online only. The app collects location only between Go online and Go offline. Before Android asks for background location, the app explains this on screen, and while the driver is online Android shows a permanent notification. Going offline stops collection at once. Location points are kept for at most 90 days; the latest position of an order stays with that order.

Services used by the driver app: Google Sign-In (Google LLC); WhatsApp, to send the one-time code; Firebase Cloud Messaging (Google LLC) for notifications on some devices; OpenStreetMap map tiles; route calculation by OSRM or Google Maps, which receive the start and end coordinates of a route.

Deleting a driver account: in the app under Settings → Delete my account, or as described on kassenta.com/delete-account.

3. Permissions

Kassenta POS requests only the permissions required for its features:

Permission	Why it is used	Optional?
INTERNET / ACCESS_NETWORK_STATE	To synchronize with the Kassenta backend (kassenta.com), receive online orders, and process payments.	Required
CAMERA	To scan product barcodes during checkout and inventory entry. Camera frames are processed on-device and are not uploaded or stored.	Required for barcode scanning only
Location (runtime, foreground)	Used optionally to determine the store's delivery zone or to help configure delivery boundaries. Location is only read when the merchant explicitly invokes a location-related feature.	Optional — the app works without it
VIBRATE	To provide haptic feedback (e.g., scan confirmation, button presses). No data is collected.	Required for UI feedback

4. How We Use Data

We process data to:

Provide the core POS, inventory, CRM, reporting, and delivery features of the app.
Authenticate users and enforce role-based access (Admin/Owner, Manager, Cashier).
Activate and validate license keys (format KASSENTA-XXXX-XXXX-XXXX-XXXX).
Generate receipts, reports, and merchant communications.
Process payments through merchant-configured providers (Stripe, TWINT, Card, Cash).
Send transactional notifications (WhatsApp, email) when the merchant configures them.
Maintain system security, prevent fraud, and debug technical issues.
Comply with applicable legal, accounting, and tax obligations.

We do not use merchant or customer data for advertising, profiling, or training third-party AI models.

5. Data Sharing and Sub-Processors

We do not sell personal data. We share data only with the limited sub-processors necessary to operate the service:

Sub-processor	Purpose	Region
Google Cloud Storage	Stores product images, store logos, and receipt assets uploaded by merchants. Access is server-side and authenticated.	EU / Global
Stripe	Processes card payments — only if the merchant explicitly configures Stripe. Cardholder data is sent directly to Stripe and is not stored on our servers.	Global
Kassenta infrastructure (kassenta.com)	Hosts the application backend and PostgreSQL database. Operated by Kassenta under HTTPS.	EU

We may also disclose information if required by law, court order, or to protect the rights, safety, or property of Kassenta, our users, or the public. In the event of a corporate transaction (merger, acquisition), data may be transferred to the successor entity under equivalent protections.

6. Data Retention

We retain merchant and transaction data for as long as the merchant maintains an active Kassenta POS license, so the merchant can access historical reports and comply with accounting and tax laws.

On verified request from the merchant (the data controller), we will delete or anonymize personal data within 30 days, except where longer retention is required by law (e.g., financial records).
Backups containing deleted data are rotated out within a reasonable additional period and are not restored to live systems.
Technical logs are typically retained for up to 90 days for security and debugging.

To request deletion, email privacy@kassenta.com.

7. Children's Privacy

Kassenta POS is a business tool intended for use by adults aged 18 or older. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided personal information through the app, please contact us and we will delete it.

8. Your Rights

Depending on where you live, you may have rights under the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (FADP / nFADP), the Egyptian Personal Data Protection Law (PDPL — Law No. 151 of 2020), or other applicable laws. These rights generally include:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure ("right to be forgotten") — request deletion of personal data.
Restriction — ask us to limit how we process your data.
Portability — receive your data in a structured, machine-readable format.
Objection — object to certain processing activities.
Withdraw consent — where processing relies on consent, withdraw it at any time.
Lodge a complaint with your local data protection authority (e.g., the Swiss FDPIC, an EU supervisory authority, or the Egyptian Personal Data Protection Center).

Because merchants control the data they enter about their own customers, end-customers should first contact the merchant. If you cannot reach them or need our help, contact privacy@kassenta.com and we will assist or route the request appropriately.

9. Cookies

The Kassenta POS mobile app does not use cookies. It uses secure tokens stored locally on the device to keep the merchant signed in.

Our website (www.kassenta.com) uses only essential cookies required for the site to function and for basic security. We do not use advertising or cross-site tracking cookies. If we ever introduce optional analytics cookies, we will request your consent first.

10. International Transfers

Kassenta is based in Egypt, our primary infrastructure is hosted in the EU, and our sub-processors (Google Cloud Storage, Stripe) operate globally. As a result, your information may be transferred to and processed in countries outside your own, including Egypt, Switzerland, the European Union, and the United States.

When we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs), equivalent Swiss FADP safeguards, adequacy decisions where available, and our sub-processors' own certifications and data processing agreements.

11. Security

We apply industry-standard technical and organizational measures to protect your data, including:

HTTPS / TLS encryption for all traffic between the app and kassenta.com.
bcrypt hashing for passwords and employee PINs — we never store them in plain text.
License-key authentication with per-store isolation and signed session tokens.
Role-based access control (Admin/Owner, Manager, Cashier) inside each store.
Server-side validation, rate-limiting, and audit logging of sensitive actions.
Encrypted backups and least-privilege access for our engineering team.

No system is perfectly secure. If we become aware of a personal-data breach that is likely to affect you, we will notify you and the relevant authorities as required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the app, our services, or applicable law. When we do, we will update the "Effective date" above and, for material changes, we will notify merchants in-app or by email before the changes take effect. The current version is always available at https://kassenta.com/privacy.

13. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or your personal data, please contact:

Kassenta
Privacy team
Egypt
Email: privacy@kassenta.com
Website: www.kassenta.com