Privacy Policy

SmartPOS AI is operated by SMART ERP SYSTEMS TECHNOLOGY - L.L.C - S.P.C, Abu Dhabi, United Arab Emirates (licence no. CN-6463527) (“we”, “us”). We are responsible, as the controller, for the personal data described in this policy.

For any privacy question or request, write to privacy@smartposai.com.

This policy explains how we handle the personal data of:

• visitors to our website smartposai.com;
• our customers and the people who use their accounts (owners, managers, cashiers and other staff who sign in to the Backoffice, the point of sale or our apps);
• partners in our partner programme;
• people who contact us or use our chat;
• business contacts whose details we obtained from public sources (section 3).

Businesses that use SmartPOS AI also store data about their own customers, guests and staff in the Service. For that data, the business is the controller and we act only as its processor under our Data Processing Agreement. Section 10 explains what this means for guests and customers of those businesses.

Account and contact data

Name, email address, business name, country, the address of your SmartPOS AI page (subdomain), a phone number if you provide one, and the users you create with their roles. Passwords and PINs are stored only as one-way hashes.

Billing data

Plan, invoices and payment status. Card details are entered directly with Stripe; we do not receive your full card number.

Usage and security data

IP address, device and browser type, sign-in times, actions in the apps (audit log), error reports and records of requests to our servers. We use them to run and protect the Service.

Website data

Only if you accept analytics cookies: a random visitor ID, the pages you visit, where you came from, campaign parameters, device type and an approximate location (country and city) that we derive from your IP address on our own server. If you accept marketing cookies and came through a partner’s link, we remember which partner referred you.

Communications and chat

Messages you send us by email, support ticket or contact form, and the questions you ask in our chat. Before the website assistant answers, it asks for your email address; we link it to your website visits only if you have accepted analytics cookies.

Emails we send

Our emails contain no tracking pixels and no tracked links, so we do not record whether you open them or which links you click. The same applies to the emails that businesses send to their own customers through SmartPOS AI. Records of email opens and link clicks made before 13 October 2026 are deleted 90 days after the open or click.

Partner data

Name, company, contact details, payout details (for example bank or PayPal details), and your referrals and commissions. When someone opens your referral link, we record the time, IP address and browser of that click to credit you and to prevent fraud.

Business contacts from public sources

To offer our product to businesses, we have collected publicly available business contact details (business name, business email address and website) from sources such as business directories and company websites, and we record where each address came from. This outreach is currently paused.

Consent and acceptance records

Your choice in the cookie banner (stored in your browser) and, when you register, the version of the Terms you accepted, with the time and IP address.

• Providing the Service and managing your account (registration, sign-in, plans, support): performance of our contract with you (GDPR Art. 6(1)(b)).
• Billing, accounting and tax records: performance of the contract and our legal obligations (Art. 6(1)(b) and (c)).
• Security and prevention of fraud and abuse (logs, rate limits, firewall, audit log): our legitimate interest in protecting the Service, our customers and their data (Art. 6(1)(f)).
• Service emails (verification, security alerts, trial and payment reminders, important changes): performance of the contract and our legitimate interest.
• Product tips, onboarding and offers to customers: our legitimate interest in informing customers about our products (Art. 6(1)(f)). You can unsubscribe in every such email.
• Improving the Service and customer success (usage statistics, engagement and cancellation scores, product research): our legitimate interest in improving the Service and helping customers who need support (Art. 6(1)(f)). You can object at any time.
• Website analytics and partner referrals: your consent (Art. 6(1)(a)), given in the cookie banner. You can withdraw it at any time.
• Answering enquiries and chat: steps you ask us to take before a contract, performance of the contract, and our legitimate interest in answering questions.
• Partner programme: performance of the partner agreement and legal obligations for payouts.
• Outreach to businesses from public sources: our legitimate interest in offering our product to businesses (Art. 6(1)(f)). You can object or unsubscribe at any time.
• Compliance with law and legal claims: legal obligations and legitimate interest (Art. 6(1)(c) and (f)).

Where the law of Bosnia and Herzegovina or another country applies, the equivalent legal bases of that law apply (for example Article 8 of the Law on Personal Data Protection of Bosnia and Herzegovina).

Account data is necessary to conclude and perform the contract; without it we cannot open an account. Other data is optional unless stated otherwise.

• AI providers. Our AI assistant and AI features send the data needed for a request to OpenAI or Anthropic (see section 6). They process it under their business (API) terms and do not use it to train their models.
• Scores. We calculate scores about accounts and website visitors (for example the likelihood of signing up, activating, upgrading or cancelling, and email engagement) to improve the Service and decide where to offer help. These scores do not have legal or similarly significant effects on you, and no such decision is made solely by automated means.
• Linking visits to an account. If you accepted analytics cookies before registering, we link your earlier website visits to your new account.

We do not sell personal data. We share it only with:

• Hosting: Hetzner Online GmbH, Germany — our servers, databases, backups and our own email server.
• Payments: Stripe — billing of our subscriptions.
• AI: OpenAI and Anthropic — AI features and the AI assistant (section 5).
• Email delivery for outreach: Mailgun — only for outreach emails to businesses (section 3). Our service emails are sent from our own email server.
• Services you connect: accounting, payment, delivery, online shop and other providers that you connect to your account receive the data needed for that connection.
• Partners: if you signed up through a partner’s link, that partner sees your business name, the account’s email address, plan, status and trial dates, so that they can follow their referrals and commissions.
• Authorities and advisers: when the law requires it or to protect our rights, and our lawyers and accountants under confidentiality.
• Business transfers: a buyer or successor if our business is sold or reorganised, under this policy.

The current list of providers that process customer data for us is on the sub-processors page.

We store data on servers in Germany (EU). Our company is based in the United Arab Emirates, and our team may access the data from the UAE and from Bosnia and Herzegovina. Some providers (OpenAI, Anthropic, Mailgun and Stripe) process data in the United States. Where data protected by EU or Bosnian law is transferred to a country without an adequacy decision, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses. You can request a copy at privacy@smartposai.com.

• Account and customer data: while the account exists, also after a paid plan ends. After a confirmed deletion request, we delete it within 30 days; backup copies are overwritten within about 10 days after that.
• Billing records: as long as tax and accounting laws require.
• Records of requests to our servers (IP address, time, request): 90 days in the live log, then in a separate security archive used to investigate security incidents and abuse. After 12 months we shorten the IP address in archived records and remove the user, the browser and the request parameters.
• Firewall events, email delivery logs and records of email opens and clicks: 90 days.
• Error reports, chat and support conversations: as long as needed to solve the problem or answer you and to prevent it from happening again. You can ask us to delete them earlier.
• Website analytics (with consent): visits and events 90 days; the visitor profile 13 months after your last visit, unless it is linked to your account.
• Partner data: during the partnership and afterwards for as long as tax law requires for commission and payout records.
• Business contacts from public sources: until you object or the outreach ends. If you unsubscribe, we keep only your address on a do-not-contact list, so that we can respect your choice.
• Terms acceptance records: together with the account.

Depending on where you are, laws such as the EU General Data Protection Regulation, the Law on Personal Data Protection of Bosnia and Herzegovina (Official Gazette of BiH 12/25) or the UAE Federal Decree-Law No. 45 of 2021 give you the right to:

• access your personal data and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use it;
• object to processing based on legitimate interest, including scores and outreach, and object to direct marketing at any time;
• receive the data you gave us in a machine-readable format (portability);
• withdraw your consent at any time, without affecting earlier processing.

Write to privacy@smartposai.com. We answer within one month and may first ask you to confirm your identity. If your request concerns data that a business using SmartPOS AI holds about you (for example as its customer or employee), please contact that business; we will help it respond.

You also have the right to lodge a complaint with a data protection authority: in Bosnia and Herzegovina, the Personal Data Protection Agency (Agencija za zaštitu ličnih podataka u BiH); in the EU/EEA, the authority of your country; in the UAE, the UAE Data Office.

When you book an appointment, order from a QR menu or online, receive a receipt, collect loyalty points or otherwise deal with a business that uses SmartPOS AI, that business decides how your data is used and is responsible for it. We process the data only on its behalf and on its instructions, for example:

• booking details such as your name, phone number, email address and the appointment;
• orders, receipts and loyalty points;
• messages the business sends you, such as booking confirmations, reminders or receipts.

A business can turn on Cloudflare Turnstile on its booking page to stop automated spam; Cloudflare then checks technical signals from your browser. If the business has entered a link to its own privacy policy, its booking page and QR menu link to it. For questions or requests about this data, please contact the business directly. If you cannot reach it, write to us and we will forward your request.

Our website uses only essential cookies unless you allow analytics or marketing cookies in the cookie banner. We do not use advertising cookies or third-party analytics, and our fonts are served from our own server. Details, durations and how to change your choice are in our Cookie Policy.

We protect personal data with measures appropriate to the risk, including:

• encrypted connections (TLS) for all traffic;
• passwords and PINs stored only as one-way hashes;
• separation of each business’s data, role-based permissions and an audit log of important actions;
• a firewall, rate limits, monitoring and the ability to revoke sessions and devices;
• backups several times a day on a separate server, with a daily restore test.

No system is completely secure. If a breach affects your personal data, we will inform you and the competent authorities as the law requires.

Our services are meant for businesses. They are not directed at children, and only people aged 18 or over may open an account. We do not knowingly collect data about children through our website.

We may update this policy. We announce material changes on this page and, for customers, by email or in the Backoffice before they take effect. The date at the top shows the current version.

• Privacy questions and requests: privacy@smartposai.com
• Other questions: info@smartposai.com
• SMART ERP SYSTEMS TECHNOLOGY - L.L.C - S.P.C, Abu Dhabi, United Arab Emirates, licence no. CN-6463527