Privacy Policy — SA2

Last updated: March 18, 2026

SA2 (“App”, “we”, “us”) is a point-of-sale application developed for retail businesses. This Privacy Policy explains how we collect, use, and protect your information.

1. Information We Collect

1.1 Data You Provide

Business profile: Store name, address, phone number, tax ID.
Staff accounts: Names, PINs (hashed, never stored in plaintext), roles.
Product catalog: Product names, prices, barcodes, images, categories.
Transaction data: Sales records, payment amounts, refund history.
Customer data (optional): Customer names, phone numbers, loyalty points.

1.2 Data Collected Automatically

Device identifiers: A randomly generated UUID bound to each terminal for sync purposes.
Crash reports: Stack traces, device model, and OS version sent to Sentry (no PII included).
Push notification tokens: Firebase Cloud Messaging tokens for delivery of notifications you configure.

1.3 Data We Do NOT Collect

Payment card numbers (PAN), CVV, or magnetic stripe data.
Biometric data (fingerprints, facial recognition).
Location data beyond the address you manually enter.
Contacts, call logs, or SMS content from your device.

2. How We Use Your Information

Purpose	Legal Basis
Process sales and generate receipts	Contract performance
Synchronize data between devices in your store	Contract performance
Send push notifications you configure (low stock, shift alerts)	Your consent
Diagnose crashes and improve stability	Legitimate interest
Generate business analytics (revenue, margins, stock levels)	Contract performance

3. Data Storage and Security

Local storage: All business data is stored on-device in an AES-256 encrypted SQLite database (SQLCipher).
Sync storage: When you connect to a SA2 Store Server (self-hosted or cloud), data is transmitted over TLS 1.2+ with certificate pinning and stored in a PostgreSQL database with Row-Level Security (RLS).
Solo mode: Data never leaves your device. No server communication occurs.
Encryption key: Derived per-device using flutter_secure_storage (Android Keystore / iOS Keychain). We cannot access your encryption keys.

We do not sell, rent, or trade your data. Data is shared only:

With your own SA2 Store Server that you deploy and control.
With Sentry for anonymized crash reports (no business data, no PII).
With Firebase Cloud Messaging (Google) for push notification delivery tokens only.
With Telegram / WhatsApp only if you configure notification channels yourself.
When required by law enforcement with a valid legal order.

5. Data Retention

On-device: Data persists until you uninstall the app or manually clear it.
Store Server: Data persists until you delete it or decommission the server. You own the server and its data.
Crash reports: Retained in Sentry for 90 days, then automatically deleted.
Push tokens: Deactivated on logout; expired tokens are pruned automatically.

6. Your Rights

You have the right to:

Access all your data (it is stored locally on your device).
Export your data via the Data Exchange feature (JSON, CSV, Excel formats).
Delete your data by uninstalling the app or using the backup/restore settings.
Withdraw consent for push notifications at any time in Settings.
Request erasure from the Store Server by contacting the server administrator (you or your organization).

7. Children’s Privacy

SA2 is a business tool not directed at children under 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Continued use of the App after changes constitutes acceptance.

9. Contact

For privacy-related questions or data requests:

Email: hello@sa2.store

This policy applies to SA2 version 1.0 and later.