Who's responsible for my data?§1
Phyled Solutions controls your account data. Each shop controls its own customers' data, we just store it for them.
When you sign up for PhyledPOS, create a staff account, or visit our marketing site, Phyled Solutions is the data controller for that information.
When a shop uses PhyledPOS to record a sale, store a customer's phone number, or open a corporate credit account, that business is the data controller for its own customers' information, and Phyled Solutions acts as a data processor on its behalf, we store and move the data as instructed by how the business uses the software, and never for our own purposes. If you're a shopper or client of a business that happens to run on PhyledPOS, that business, not Phyled Solutions, is who to contact about your data; we're happy to help point you to them if you're unsure who that is.
What do you collect?§2
Your account and sales data, plus two optional features (AI assistant, Drive backup) that only collect anything if you switch them on.
| Category | Examples | Source |
|---|---|---|
| Account & business data | Business name, owner/staff name, email, phone, business type, address | You, at signup or in Settings |
| Staff/user data | Usernames, roles, login history, audit trail of actions taken in the app | The business admin, when adding staff |
| Operational data | Products, stock levels, sales, invoices, corporate credit accounts, expenses | Entered by the shop's staff while using the app |
| End-customer data | A shopper's name and phone number, where a shop chooses to record it against a sale or corporate account | The shop, from its own customers |
| Payment data | Subscription status, invoice history. We never see or store your card number, Paystack's hosted checkout handles that directly. | Paystack |
| Technical data | IP address, device/browser info, session cookies, error logs | Automatically, while using the site/app |
| Optional, AI assistant | If you connect your own Google AI key, your questions and a short sales summary are sent to Google's Gemini API to generate a reply | You, only if you enable this |
| Optional, Drive backup | If you connect Google Drive, your business's backup archive is uploaded to a folder in your own Drive | You, only if you enable this |
Why do you use it?§3
To run the app, keep it secure, and talk to you, and nothing more without your say-so.
- To provide the service, creating your account, running the till, generating invoices and reports, processing subscription payments.
- To keep the platform secure, rate-limiting, signup-risk scoring, and the append-only audit trail that records who did what and when.
- To communicate with you, email verification, trial reminders, billing receipts, support replies.
- With your consent, the AI assistant and Google Drive backup only ever run if you actively connect them; nothing is sent to Google until you do.
Who do you share it with?§4
We don't sell data. We only share it with the three services that make PhyledPOS run.
| Provider | Purpose | What they see |
|---|---|---|
| Paystack | Subscription billing and in-store card/mobile-money checkout | Payment details, never stored on our servers |
| Google (Gemini API) | Optional AI assistant, under your own API key | Chat messages and a short sales summary, only if you enable it |
| Google Drive | Optional automatic backup mirroring, under your own Google account | Your backup archive, only if you connect it |
| Our hosting provider | Running the servers and database | Everything stored in the application, as any host necessarily can access |
Need a formal Data Processing Agreement naming these providers for your own compliance records? Contact us, see §11.
Where is it processed?§5
Mainly Ghana. Only the specific data behind a feature you've turned on ever leaves, via Google.
Our primary infrastructure serves the Ghanaian market. Where an optional feature you've enabled (the AI assistant, or Google Drive) routes data through Google's infrastructure, that data may be processed outside Ghana, including in jurisdictions with different data protection standards. Those transfers happen only for the specific data relevant to that feature, and only once you've turned it on.
How long do you keep it?§6
As long as your account is active, plus clear, fixed windows after it isn't.
- Active accounts: for as long as your subscription or trial is active.
- Unverified signups: if you start signing up but never verify your email, that record is automatically removed after 48 hours.
- Lapsed trials: if a free trial ends without converting to a paid plan, we email a warning 30 days after it lapses, and permanently delete the business's data 30 days after that warning (60 days after the trial ended) if nothing changes in the meantime.
- Cancelled subscriptions: you keep access until the end of the billing period you've already paid for; data isn't deleted automatically on cancellation, so you can resubscribe later, contact us if you'd like it removed sooner.
- Backups: we keep a configurable number of your most recent backup archives (10 by default); older ones are deleted automatically as new ones are made.
- Audit logs: kept for the life of the account as a tamper-evident record, entries can't be edited or deleted individually, only removed in full when the business account itself is deleted.
What are my rights?§7
Export or delete your data yourself, any time, from inside the app.
Depending on where you're located, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. In practice:
- Business owners/staff: update your own details directly in Settings, or ask us to correct/delete them.
- Business data as a whole: every shop can export a complete backup of its data at any time from within the app, in a portable format, and can request permanent deletion of its account.
- A shop's own customers: contact the business you dealt with directly, they control that data; if you can't reach them, contact us and we'll help route the request.
How do you keep it secure?§8
Hashed passwords, no card numbers on our servers, encrypted tokens, and a tamper-evident log of every sensitive action.
Passwords are hashed, never stored in plain text. Card numbers never touch our servers, Paystack's hosted checkout handles that. Connected Google account tokens are encrypted at rest. Every sensitive action in the app is written to an append-only audit log that can't be edited after the fact, which is what lets us investigate and respond to any incident properly. No system is perfectly secure, and we'll notify affected businesses without undue delay if we become aware of a breach affecting their data.
Is there an age requirement?§9
Yes, you must be 18 or older to register. We don't knowingly collect data from anyone under 18.
PhyledPOS is business software for registering and running a shop, not directed at or available to children. You must be at least 18 years old to create an account, and signup requires confirming this before your account is created. We don't knowingly collect personal data from anyone under 18; if we learn an account was created by someone under 18, we'll close it and delete the associated data.
Can this policy change?§10
Yes, and we'll email you when a change actually matters.
We'll update the date at the top of this page whenever we make changes, and for anything material, we'll email the account owner on file.
How do I contact you?§11
Email us, we read every message.
Questions, data requests, or to ask for a Data Processing Agreement: info@phyledsolutions.com.