Privacy policy
Plug & Play makes point-of-sale software for shops. This policy explains exactly what our apps collect, why, where it is stored and how to have it removed. It describes what the software actually does today — not what it may do later.
Last reviewed
Who this covers
This policy covers Plug & Play POS (used by shop staff at the counter) and Plug & Play POS admin (used by the business owner), on Android, iOS and the web, together with the backend service they talk to.
There are two very different kinds of person in this system, and the distinction runs through everything below:
- Our users — the business owner and their staff. They hold accounts with us.
- Our users' customers — the shoppers whose purchases are rung up. They have no account with us, and we act only on the shop's instructions in respect of their records. The shop decides what is recorded about them and for how long.
What we collect
Account information
When a business owner signs up we store a name, email address, phone number, role and, if one is set, a profile photo URL. Staff accounts hold the same fields and are created by the owner, not by the staff member.
Owners sign in with an email address and password, or with Google. Staff sign in with a one-time code sent to their phone number by SMS.
We do not verify that you own the email address you sign up with. We record it as unverified and we do not block sign-in on it. We mention this because it is the honest description of the system, and because it means an email address in our records is a contact detail, not proof of identity.
Business and sales information
The substance of what we store is the shop's own operating data: its products, prices, tax rates, categories, stock levels and stock movements, its tables and floor layout where it uses them, its staff list and shift records, and its completed sales — including line items, discounts, tax breakdown and payment method.
Where a shop chooses to record a customer against a sale, that record may hold the customer's name, phone number and email address. Whether to collect this is the shop's decision, and shops should tell their own customers what they record.
Images
Product photographs and a business logo, uploaded by the owner.
Device permissions
Camera is the only permission we ask you to grant, and it is used for exactly one thing: scanning a barcode at the counter. Scanning happens on the device — we do not upload camera frames, and we do not read your photo library.
Alongside it the apps declare the ordinary non-sensitive permissions any connected app needs — internet access and network status — which Android grants without asking. The staff till additionally declares permissions contributed by the hardware libraries it uses to reach Bluetooth and USB receipt printers, and to show notifications. You are prompted for anything Android considers sensitive; you are never prompted for the rest.
Neither app requests location, contacts, calendar, microphone, SMS or file-system access.
What we do not collect
- No analytics. Neither app contains an analytics SDK. There is no usage tracking, no event pipeline and no behavioural profile.
- No advertising. No ad SDK, no attribution SDK, no advertising identifier. We do not serve ads and we do not sell or share data for advertising.
- No crash or performance reporting. The apps ship with crash reporting disabled: the library is present but is never initialised, because no build supplies the key that would switch it on. No diagnostic data leaves your device today. If that ever changes we will update this page and our Play Data safety declaration together, and say so.
- No payment details, ever. Subscription payments open Razorpay's own hosted checkout page. Card numbers, UPI IDs and bank details are entered on Razorpay's page and go to Razorpay. Our apps never see them and our servers never receive them.
- No push notifications. Neither app sends you push messages today. The staff till bundles a messaging library it does not use, which is why Android may list a notifications permission against it.
Why we hold it
Only to run the service you are paying for: to show the till its catalogue, record and total a sale, print a receipt, keep stock counts, produce the shop's own reports, manage staff access, and bill the subscription. We do not profile users and we do not use business data to train anything.
Where it is stored
Business data lives in a single managed PostgreSQL database in AWS Singapore (ap-southeast-1). If you are in India, that means your data is stored outside India — Singapore is the closest region to the shops we serve.
A copy of the parts a till needs to keep selling — its product catalogue, recent orders, and any sale rung up while the connection was down — is also stored on the device itself, in the app's private storage. That local copy is what makes the POS work offline. It is cleared when a different account signs in on that device.
Who else processes it
We use a small number of service providers, each doing one job. They process data on our instructions; we do not sell data and we do not share it for anyone else's purposes.
| Provider | What it does | What it handles |
|---|---|---|
| A managed PostgreSQL provider (Singapore) | Hosts the database | Your business records |
| A cloud identity and file-storage provider | Sign-in, SMS codes, image storage | Email, phone number, uploaded images |
| A global edge network | Runs our API and serves the web apps | Requests in transit |
| Razorpay | Takes subscription payments | Payment details, entered on their page — never on ours |
We will name any of these on request, and we will tell you here before adding a provider that handles a new kind of data.
How it is protected
- Everything is encrypted in transit over HTTPS, between the apps and our API and onward to the database.
- Every request is authorised server-side. Which business you belong to is resolved from our own records against your signed-in identity — never taken from anything the app sends — so one business cannot read another's data by asking for it.
- Staff accounts see only what their role permits.
How long we keep it
Account and catalogue data is kept while the account is open. Completed sales are kept longer, and deliberately: they are the shop's books. Tax and company law require records of sales to be retained for years after the transaction, so a request to close an account does not erase sales history. The deletion page sets out precisely what is removed, what is kept, and why.
Our database uses "soft deletion": a deleted record is marked deleted and stops being returned anywhere in the product, and is purged on the schedule described on the deletion page.
Your choices
- See and correct your data. Almost all of it is editable directly in the admin portal — products, staff, business details, branding.
- Delete your account. From Settings → Delete account in the admin app, or from this page if you have already uninstalled it. We action requests within 30 days.
- Turn off camera access in your device settings at any time. Barcode scanning stops working; nothing else does.
Children
These are business tools for shop owners and their staff, intended for people aged 18 and over. They are not directed at children and we do not knowingly collect data from them.
Changes
If this policy changes we will update the review date at the top. The page lives at a fixed URL and is versioned with the software it describes, so a change to what the apps collect and a change to this page happen together.
Contact
Use the form on our privacy requests page for any question about this policy or about your data — asking for a copy of it, having something corrected, or deleting your account. The page is titled for deletion because that is what Google Play requires us to publish, but the same form handles all three, and nothing is deleted unless you ask for it. We use the email address you give there solely to reach you about your request.