Privacy Policy

1. Who we are

The App is provided by:

For any privacy question or to exercise your rights, contact us at info@simpli-pos.com.

2. Scope

This Policy applies to information handled through (a) the Simpli POS mobile application (the "App") on supported platforms (iOS and Android), and (b) our website at simpli-pos.com. It does not apply to third-party products or services we do not control, including the operating system on your device or the third-party services described in Section 7.

3. Plain-language summary

Simpli POS is offline-first. Your business and customer records (orders, sales amounts, customers, menu, employees) are stored locally on your device and are not transmitted to us. We collect only a limited set of anonymous diagnostic and usage data to keep the App stable and to decide what to improve, plus any feedback you choose to send us. We do not sell or share your personal information, and we do not use it for cross-app advertising or tracking.

4. Information we collect

4.1 Information stored only on your device (not collected by us)

The App stores your operational data locally on the device: orders, sales totals and payment amounts, customers, menu items and prices, employees, store configuration, and similar business records. This information stays on your device (and on devices you connect on your own local network) and is not sent to us or to our service providers.

4.2 Diagnostic and usage data we collect (via Google Firebase)

When the App runs on a device with the required Google services available, we collect:

• Crash and stability data (Firebase Crashlytics): crash reports, error stack traces, and related technical context such as device model, operating system version, and App version.
• Usage/analytics events (Google Analytics for Firebase): which screens are viewed and counts of certain in-App actions (for example, that an order was completed, a feature was used, or an onboarding step was reached), together with non-identifying parameters drawn from a fixed allowlist (for example, an item count, or a payment method label such as "cash" or "card"), App version, platform, language, and theme.
• An anonymous installation identifier: a randomly generated identifier (UUID) created the first time the App launches. It lets us correlate diagnostic and usage data from the same installation without identifying you.

We have engineered the App so that analytics event parameters pass through a single code path that strips any value not on a strict allowlist before any data leaves the device.

4.3 Menu photos you submit (AI Menu Import)

If you use the optional "AI Menu Import" feature to photograph a menu page, the App sends that photo to our Cloud Functions for Firebase backend, which passes it to Google's Gemini API to recognize and extract the menu text. We do not retain a copy of the photo once the recognized result is returned to your device.

When you use this feature on Android, the App also reads your device's Android ID and sends it with the request. This is used solely to apply a fair-use limit to this feature and to prevent that limit from being reset by reinstalling the App; it is not used for advertising, tracking, or any other purpose.

4.4 Feedback you submit

If you use the in-App "Send Feedback" feature, we collect the information you provide: a category, an optional star rating, and the free-text you type, along with the App version, platform, language, and the anonymous installation identifier. Please do not include personal information about your customers in feedback text.

4.5 Information we do NOT collect

We do not collect or transmit: sales amounts, totals, tips, or other monetary values; customer names, phone numbers, emails, or addresses; menu item names, prices, or other business content; your store name or owner/employee names; or PINs or credentials. We do not use advertising identifiers (such as the iOS IDFA) and do not track you across other apps or websites.

4.6 Website visitor data

When you visit simpli-pos.com, our web server may collect standard server log data (IP address, browser type, pages visited, referrer URL) for security and operational purposes. We do not currently use advertising cookies or third-party cross-site tracking on our website. If we add analytics tools in the future, we will update this Policy and, where required by law, seek your consent.

4.7 "Get started" requests submitted on our website

If you use the "Get started" form on simpli-pos.com to request help setting up card processing, we collect the information you provide — your business name, business address, and your name, email address, and phone number — and forward it by email to our team so someone can set up your CardConnect merchant application on your behalf. This form is processed by Formspree, a third-party form service (see Section 7). We use this information only to complete the setup you requested; we do not use it for advertising or share it with anyone else. We do not collect your SSN, EIN, bank account details, or other sensitive financial information through this form — those are collected later, directly by CardConnect, as described in Section 4.8.

4.8 Merchant account application data

If you apply for an integrated merchant account to accept card payments, the App directs you to an application hosted by our payment processor, CardConnect. CardConnect — not Simpli POS — collects the information required for identity verification, underwriting, and regulatory compliance: legal business name, Employer Identification Number (EIN) or Social Security Number (SSN), bank account details, beneficial ownership information, and government-issued identity documents. We do not receive, transmit, or store this information ourselves; it is collected and processed directly by CardConnect pursuant to CardConnect's own privacy policy and applicable financial regulations (including the Bank Secrecy Act and anti-money-laundering requirements). See Section 4.7 for the separate, non-sensitive information we collect if you use the "Get started" form on our website before that application is created.

5. How we use information

We use the information described above to:

• detect, diagnose, and fix crashes and technical problems;
• understand which features are used so we can prioritize improvements;
• measure adoption and retention at an aggregate level;
• respond to and act on feedback you send us; and
• maintain the security and integrity of the App.

6. How information is shared

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under California law). We disclose information only as follows:

• Service providers / processors. We use Google Firebase (see Section 7) to process diagnostic, analytics, and feedback data on our behalf. Google processes this data under its terms and acts as our service provider.
• Legal and safety. We may disclose information if required by law, legal process, or governmental request, or to protect the rights, property, or safety of our users, the public, or us.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we will notify you of any change in ownership or use of your information.

7. Third-party services

The App uses the following third-party services:

The Google Firebase services above are provided by Google LLC. Their handling of data is governed by Google's Privacy Policy and, where applicable, the Firebase data processing terms. Feedback is stored in a write-only collection that client devices cannot read back. CardConnect collects merchant application data directly from you, not through us, and its handling of that data is governed by CardConnect's own privacy policy and applicable financial regulations, as described in Section 4.8. Formspree's handling of "Get started" form submissions is governed by Formspree's own privacy policy; we delete the submission from Formspree once our team has actioned it.

8. Data retention

• Analytics data is retained according to the Google Analytics for Firebase retention setting we configure (currently 14 months).
• Crash reports are retained by Crashlytics for the period Google provides, after which they are aggregated or deleted.
• Feedback is retained for as long as it remains useful for diagnosing issues and improving the App, unless you ask us to delete it.
• Menu photos submitted via AI Menu Import are processed transiently and are not retained after the recognized result is returned to you.
• "Get started" form submissions are deleted from Formspree once our team has actioned your request, and retained in our own records only as long as needed to set up and follow up on your merchant application.

9. Data security

We rely on Google Firebase's encryption of data in transit and at rest, and we limit the data the App transmits to the minimum described in this Policy. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International data transfers

Diagnostic, analytics, and feedback data is processed and stored by Google on servers located in the United States. If you use the App from outside the United States, you understand that this data will be transferred to and processed in the United States.

11. Children's privacy

The App is a business/point-of-sale tool intended for use by businesses and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

12. Your privacy rights

12.1 California residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know/Access the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom it is disclosed;
• Delete personal information we have collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information — note that we do not sell or share personal information;
• Limit the use of sensitive personal information — note that we do not collect sensitive personal information as defined by the CPRA; and
• Non-discrimination for exercising your rights.

Categories of personal information collected (CCPA). In the past 12 months we have collected the following CCPA categories:

We collect this information from your use of the App and from your device, for the business purposes described in Section 5.

How to exercise your rights. Submit a request to info@simpli-pos.com. We will verify your request as required by law and respond within the timeframe required by applicable law (generally 45 days, extendable). You may use an authorized agent to submit a request on your behalf with proper authorization.

Note on anonymous data. Because most data we collect is de-identified / anonymous and is not associated with your name or identity, we may be unable to associate a request with specific data. Where we cannot reasonably link data to you, we are not required to re-identify it. You can stop all further collection at any time by uninstalling the App or using the device controls in Section 13.

12.2 Residents of other U.S. states

Depending on your state of residence (for example, Virginia, Colorado, Connecticut, Utah, Texas, and others with comprehensive privacy laws), you may have similar rights to access, delete, correct, and opt out of certain processing. To exercise any such rights, contact us at info@simpli-pos.com.

12.3 European Union and United Kingdom residents (GDPR / UK GDPR)

If you are located in the European Union or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR, including the right to: access the personal data we hold about you; rectify inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; and receive your data in a portable format. You also have the right to lodge a complaint with your local data protection supervisory authority.

Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission. To exercise any of your GDPR rights, contact us at info@simpli-pos.com.

13. Your choices

• Feedback is voluntary — it is sent only when you choose to submit it.
• Device-level controls — your device's operating system provides controls over diagnostics and identifiers; the App does not use advertising identifiers.
• Stop all collection — uninstalling the App stops all further diagnostic and usage data collection.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the App after changes take effect constitutes acceptance of the updated Policy.

15. Contact us

Questions, concerns, or requests regarding this Policy or your personal information: