← Counterly

# Counterly Privacy Policy **Effective date:** July 12, 2026 **Controller:** Counterly POS (`counterlypos.com`) **Contact:** privacy@counterlypos.com ## 1. Who we are Counterly provides cloud point-of-sale, inventory, and back-office software for liquor, convenience, and gas retailers. This policy covers Counterly Admin (`app.counterlypos.com`), HQ (`hq.counterlypos.com`), Counterly POS apps, and related APIs. ## 2. Data we process - **Account & staff identity** — name, email, role, PIN hashes (not plaintext PINs in transit beyond authenticated sessions) - **Store operations** — catalog, inventory, sales, shifts, devices, support bundles - **Device metadata** — app version, register/device ids, printer/terminal pairing endpoints - **Usage diagnostics** — errors and support bundles; we instruct tenants not to include card PAN ## 3. Cardholder data Counterly does **not** store full payment card numbers (PAN). Card payments run on the merchant’s existing terminal (PAX/Verifone/guided). We may store amounts, tender type, auth/reference codes, and optional last4 if returned by the terminal adapter. ## 4. Cookies & mobile shells Authenticated Admin/HQ sessions use HTTP-only cookies. On the Admin iPad WebView shell we set `Secure; SameSite=None` on HTTPS so Store Admin can maintain login. HQ is web-only (`hq.counterlypos.com`) — there is no Counterly HQ App Store app. ## 5. Retention Audit and void/age-check logs are retained about **2 years** by default (configurable per tenant). On cancel, tenants may request export or deletion of store operational data subject to legal holds. ## 6. Subprocessors Infrastructure may include AWS (compute, database, optional Bedrock for AI import/support drafts) and Vercel (Admin/HQ/marketing hosting). AI features that call Bedrock process only the prompts you submit (CSV rows, support draft text)—not card data. ## 7. Your rights Depending on jurisdiction you may request access, correction, export, or deletion by emailing privacy@counterlypos.com. Store owners manage staff accounts inside Admin. ## 8. Children Counterly is a B2B product; we do not knowingly collect data from children. ## 9. Changes We will update this page and the effective date when material changes occur.