Privacy Policy
- Last updated
Draft — to be reviewed by a lawyer
This text is a draft: it is not in force until a lawyer has reviewed it. Information marked “À REMPLIR” (to be filled in) in brackets is still to be provided.
This policy explains what personal information Braavu POS processes, why, who it is shared with, how long it is kept and how to exercise your rights. It covers the point-of-sale software, the back office, the help center and the connector for artificial intelligence (AI) assistants.
1. Who we are
Braavu POS is point-of-sale and management software offered to businesses ("merchants") as an online service (the "Service"). It is operated by [À REMPLIR : legal name of the company] ("we"), located at [À REMPLIR : postal address of the company].
This policy applies to:
- merchants who subscribe to the Service and the people who represent them;
- merchants' staff who use the register or the back office ("users");
- merchants' customers, for the information the merchant records in the Service;
- visitors to this help center and people who write to our support team.
It follows Québec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1, as amended by Law 25) and, where it applies, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
2. Person in charge of the protection of personal information
Any question, request for access, correction or withdrawal of consent, or complaint goes to our person in charge of the protection of personal information:
- Name and title: [À REMPLIR : name and title of the person in charge of the protection of personal information]
- Email: [À REMPLIR : role-based email address dedicated to privacy]
- Postal address: [À REMPLIR : postal address of the company, attention of the person in charge]
We answer in writing within 30 days of receiving a request.
3. Our two roles: controller and service provider
We are responsible for the information we collect for our own needs: the merchant's account and billing, user accounts and their security, support requests and visits to this help center.
We act on behalf of the merchant (as a service provider or processor) for everything the merchant, its staff and its customers record in the Service: customer records, sales, catalog, stock, employee records, time punches. The merchant is the party responsible for this information under the law. We process it only to provide the Service to the merchant, according to its instructions and our agreement with it; we never use it for our own purposes.
A customer of a business who wants to see, correct or delete their information contacts that business. If the request reaches us, we forward it to the merchant without delay, and we help the merchant answer it with the Service's tools (customer information export, anonymization).
4. Information we process
| Category | Examples | Source |
|---|---|---|
| Merchant and billing | Business name and address, tax numbers, contact person, plan. The merchant's payment card is entered with our billing provider; we only receive its brand, last four digits and expiry date. | The merchant |
| User accounts | Name, login email, language, role and access, hash of the password and PIN (never the password or PIN in clear), sessions, sign-in records (date, IP address, browser) | The merchant and the user |
| Staff activity | Time punches (clock-in and clock-out times), sales, register closings, stock adjustments and manager decisions, linked to the employee who made them | The register and the back office |
| Sales and operations | Items, prices, taxes, discounts, payment methods and amounts, returns, register closings, cash movements, time, register and store. A card payment leaves only its result (amount, type, authorization code), never the card number. | The register |
| Catalog and stock | Products, prices, costs, suppliers and their contact persons, stock quantities, orders | The merchant |
| Merchants' customers | Name, phone, customer code, email (receipt, commercial messages), address and company (optional), staff note, loyalty points, store credit, named gift cards, layaways, business credit accounts, consents and their proof, purchases linked to the customer | The merchant, at the register or in the back office |
| Age verification | Only the record that a cashier checked the age for an age-restricted product (sale, time, employee), never the date of birth or the identity document | The register |
| AI assistant connector | Account that authorized the connection, authorized application, access granted, dates, technical records (see section 11) | The back office and the connector |
| Support | Name, email, phone, business, content of the request | The person who writes to us |
What the Service does not process: full payment card numbers, dates of birth, identity documents, social insurance numbers, payroll data (salary, banking information), biometric data, geolocation, screen session recordings.
5. Why we use it
- Provide the Service: sell, print and email receipts, manage stock, loyalty, store credit, gift cards and reports.
- Authenticate users, protect accounts, prevent fraud and detect security incidents.
- Bill the merchant.
- Answer support requests.
- Meet our legal obligations, including keeping tax records.
We do not sell any personal information. We do not use the information of merchants, their staff or their customers for advertising, or to train artificial intelligence models. The Service makes no decision based exclusively on automated processing of your information.
6. Consent
We collect personal information with the person's consent, or where the law allows it without consent (for example to perform the contract or meet a legal obligation). You can withdraw your consent at any time by writing to the person in charge, subject to legal or contractual obligations that require us to keep certain information.
For a business's customers, the merchant obtains consent. The Service helps: each consent (commercial emails, commercial text messages, privacy policy) is recorded separately, with its proof, and can be withdrawn.
7. Where the information is hosted
- Production: the Service's servers, database, files (product photos), email sending and technical logs are hosted by Amazon Web Services in the
ca-central-1region, in Montréal (Canada). Backups stay there too. - Register stations: each installed register keeps, in the store, an encrypted copy of what it needs to sell without a network (catalog, name, phone, code and points of the merchant's customers) and an encrypted log of its operations, deleted 30 days after the server has received them.
- Back office and help center: their pages are static files served by Cloudflare. They store no business data; data travels directly between your browser and our servers in Canada.
- Development: we develop and test the Service in a separate environment, hosted by Railway in the eastern United States. It only contains fictitious or test data, never the real information of a merchant, its staff or its customers. [À REMPLIR : confirm before publication that no real data remains in the development environment]
8. Who we share it with
We disclose personal information only to the providers who help us offer the Service, bound by a written agreement that requires them to protect it and use it only for us:
| Provider | Role | Location |
|---|---|---|
| Amazon Web Services | Hosting of the server, database and files; email sending (receipts, password reset); technical logs | Canada (Montréal) |
| Cloudflare | Hosting of the static pages of the back office and help center; it sees visitors' IP addresses, no business data | Global network |
| Stripe | Merchant billing (business information, card entered with Stripe); no information about the merchant's customers or staff | United States |
| Google (address suggestions) | Only the text typed in the first line of an address is sent, to suggest addresses; no name, email or phone | United States |
| [À REMPLIR : card payment provider, if any] | Card payment authorization; card data stays with the provider | [À REMPLIR : processing location] |
| [À REMPLIR : other service provider, if any] | [À REMPLIR : role] | [À REMPLIR : location] |
We may also disclose information:
- to software the merchant connects to the Service itself (accounting, e-commerce, AI assistant), only within the access the merchant grants and can revoke at any time;
- to authorities, when the law requires it;
- to the buyer of part or all of our business, as permitted by law, who would be bound by this policy.
9. Disclosure outside Québec
The Service's information is hosted in Québec (Montréal). Some providers named in section 8 process it outside Québec (United States, global network). Before such a disclosure, we assess the privacy factors, including the sensitivity of the information, the purpose, the protection measures and the legal framework of the destination, and we govern the disclosure by a written agreement.
An AI assistant the merchant connects to the Service is chosen by the merchant: disclosure to its provider happens at the merchant's request (see section 11).
10. How long we keep it
We keep information as long as its purpose requires or the law demands, then we destroy or anonymize it. Retention periods applied by the Service:
| Information | Period |
|---|---|
| Tax records: sales, returns, payments, cash journal, closings | 6 years; a name they contain is then anonymized |
| Record of a customer with no balance owed | Anonymized 5 years after their last purchase or last activity |
| Link between a customer and their store credit or gift card | Anonymized 6 years after the last activity; the value owed never expires |
| Receipt email address | With the sale, 6 years, so the receipt can be sent again |
| Proof of consent | Duration of the consent, then 3 years after its withdrawal or end |
| Age verification record | 3 years |
| Employee time punches | 3 years after the end of the pay period concerned |
| Account of a user who left | Email and name anonymized 1 year after the account is deactivated |
| Sign-in records and access logs | 1 year |
| AI assistant connector records | 30 days |
| Local register log | 30 days after the server has received the operations |
| Backups | 7 days; a deletion reaches backups at the latest at the end of this period |
| Register of confidentiality incidents | 5 years after the incident becomes known |
| Support requests | [À REMPLIR : retention period of support requests] |
| Merchant's data at the end of the subscription | [À REMPLIR : export period offered to the merchant, then deletion], except what the law requires us to keep |
11. Connector for AI assistants
The Service offers a connector (an MCP server, Model Context Protocol) that lets a merchant link an artificial intelligence assistant, such as ChatGPT, Claude, Grok or Codex, to its business, to ask it questions about its sales, stock and catalog.
Read only
The connector only reads. None of its tools creates, changes or deletes anything: it cannot sell, refund, or change a price, stock, customer or setting.
Who authorizes it
Only an administrator of the merchant, with access to all of its stores, can authorize a connection. They sign in to the back office (with their usual security measures), then an explicit consent screen shows them the application requesting access, where the access will be delivered and each access requested. Nothing is granted until they consent. They can only grant access their own role allows; if a single requested access exceeds their rights, the whole request is refused.
What the assistant can read
| Access shown at consent | What the assistant can read |
|---|---|
| Sales and sales reports | List and detail of sales (items, quantities, prices, taxes, discount amounts, payments by method, returns), daily summary, best sellers by product, category, store or day, taxes collected, payments, returns, register closings (expected, counted, variance) |
| Stock reports and dashboard | Dashboard (sales of the day and week, top items, open registers, variances, stock-outs), low stock, stock value at retail price, items without sales, negative stock |
| Stock levels | Quantities by store and latest movements of an item (type, quantity, date, reason code) |
| Catalog | Products (name, codes, price, brand, category, tags, weight and dimensions), categories, brands |
What the assistant never receives
The connector removes this information from each response before sending it:
- the name or identifier of an employee: salesperson, cashier, manager who authorized a discount, opened or closed a register, voided a sale;
- a customer's name, phone, email, code or loyalty;
- notes and reasons typed by staff (sale note, reason for a discount, a variance or an adjustment);
- product cost and supplier;
- serial numbers, the last digits of a gift card, tax registration numbers, the document number of a tax exemption, register station names.
The connector offers no reading of customer records, employees, settings, or balances of people (gift cards, store credit, loyalty points, layaways, credit accounts).
A sale remains business information. In a small business, however, a specific sale (time, items) could allow someone who already knows the customer to recognize them. The merchant decides what it asks its assistant.
Access duration and revocation
- Each access handed to the assistant is valid for 10 minutes. The application renews it on its own as long as the connection is valid.
- A connection ends at the latest 7 days after consent: the administrator must then consent again.
- Each call checks the rights again: a revoked connection, a deactivated account or a removed permission refuses the next call.
- The administrator revokes a connection at any time in the back office, under Settings > Connected software. They can also remove the connector in their assistant.
Logging
We keep, for 30 days, technical records of each connection (consent, renewal, revocation) and of each call: access identifier, merchant, tool name, result, time, duration and response size. These records never contain the questions asked, the call parameters, the content of the responses, or a person's name. The authorization history (who consented, for which application, which access, when, revocation) is visible to the merchant under Settings > Connected software and kept [À REMPLIR : retention period of the authorization history].
The connector keeps no business data: it reads the Service's API at each call, with no copy or cache, and has no direct access to the database. In production, it is hosted in Canada with the Service. [À REMPLIR : confirm before publication that the production connector is hosted in the AWS ca-central-1 region]
What the assistant's provider does next
A response handed to the assistant is then processed by that assistant's provider (for example OpenAI, Anthropic or xAI), under its own terms and privacy policy, often outside Canada. This provider may keep the conversation and, depending on the account settings, use it for its own purposes. We have no control over this processing and this provider is not our service provider.
Before connecting an assistant, the merchant reviews its provider's policy and its retention and training settings, for example those of OpenAI, Anthropic or xAI. The merchant is responsible for this disclosure of its information, including outside Québec.
12. Security
We protect information with measures suited to its sensitivity, including:
- encryption of exchanges (TLS) between registers, browsers, our servers and the database;
- encrypted local database and log on registers, with keys kept in the operating system's vault;
- separation of each merchant's data in the database;
- passwords and PINs kept as hashes, never in clear; two-step verification offered for back-office accounts;
- access tokens specific to each register and each connected software, revocable one by one;
- our staff's access limited to what their work requires.
13. Confidentiality incidents
If personal information is lost, accessed or disclosed without authorization, we promptly take measures to reduce the risk of harm and prevent a recurrence, and we record it in our register of incidents. If the incident presents a risk of serious injury, we notify the Commission d'accès à l'information du Québec and the people concerned and, where PIPEDA applies, the Office of the Privacy Commissioner of Canada.
When the incident affects information we process for a merchant, we notify the merchant [À REMPLIR : notice period to the merchant, for example without delay and no later than 72 hours after becoming aware] and give it what it needs to meet its own obligations.
14. Your rights
Under the law, you can:
- access the personal information we hold about you;
- have it corrected if it is inaccurate, incomplete or ambiguous;
- withdraw your consent to its use or disclosure;
- obtain the information you provided to us in a structured, commonly used technological format;
- ask that its dissemination or indexing stop where the law allows it;
- know the information used for a decision based exclusively on automated processing (the Service makes none).
Write to the person in charge. We may ask you to confirm your identity. We answer within 30 days; a refusal is explained in writing.
If you are a customer of a business that uses Braavu POS, send your request to that business (section 3).
You can file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
15. Cookies and browser storage
- Help center: no cookies. Your appearance choice (light or dark) is kept in your browser's local storage.
- Back office: a single session cookie, needed to sign in, protected (
HttpOnly,Secure,SameSite) and deleted at the end of the session. Your language choice is kept in your browser's local storage. - No advertising cookies, no third-party audience measurement tools, no session recording.
16. Minors
The Service is intended for businesses. It is not directed at people under 14 and does not knowingly collect their information.
17. Changes to this policy
We may change this policy. The date of the last update appears at the top of the page. A significant change is announced to merchants in the back office or by email before it takes effect.
The French version of this policy prevails in case of discrepancy.
For any question: support or the person in charge of the protection of personal information.