Privacy Policy

This Privacy Policy explains how MediaCity Inc. ("AccoPOS", "we", "our", "us") collects, uses, stores, and protects information when you use the AccoPOS point-of-sale platform — including the web application, Electron desktop app, Poynt Smart Terminal app, and related services (collectively the "Service").

By using AccoPOS you agree to the practices described in this policy. If you do not agree, please discontinue use of the Service.

1Information We Collect

We collect three categories of information:

A. Account & Business Information

• Business name, address, phone number, and email address
• Owner/admin name and contact details provided during registration
• Subscription plan and billing contact information
• Store logo and branding assets you upload

B. Operational Data (generated through normal use)

• Product catalog: names, prices, SKUs, barcodes, stock quantities, categories
• Sales transactions: items sold, quantities, prices, discounts, totals, timestamps
• Payment method type (cash / card / split) — not card numbers
• Customer records (if loyalty or invoicing module is enabled): name, phone, email, points balance
• Employee / cashier names and session logs
• Purchase orders, supplier details, and inventory adjustments
• Saved orders, quotations, and receipts

C. Technical & Usage Data

• IP address and browser/device type for security and session management
• Log files recording login events and errors (no personal browsing data)
• Electron app version and operating system for update and compatibility purposes

2How We Use Your Data

We do not use your data for advertising profiling, and we do not sell or rent your data to any third party for their marketing purposes.

3Payment Card Data

AccoPOS integrates with the following payment processors depending on your hardware and configuration:

• Poynt / GoDaddy Payments — for Poynt Smart Terminal users. Card data is processed entirely within the Poynt secure enclave and is subject to GoDaddy's Privacy Policy.
• Generic terminal bridge — AccoPOS sends an amount to your configured terminal via a local bridge. Card data never passes through AccoPOS software.

AccoPOS is not a payment processor and is not responsible for the security of card data during payment processing. That responsibility lies entirely with your chosen payment processor.

4Data Sharing & Disclosure

We share your information only in the following limited circumstances:

• Service providers: Hosting infrastructure, email delivery (for receipt/invoice sending), and analytics tools that operate under strict data processing agreements and may not use your data for their own purposes.
• Payment processors: Transaction amount and reference are shared with your payment terminal provider to authorise a sale (see Section 3).
• Legal requirement: We may disclose data if required by a valid court order, subpoena, or applicable law. We will notify you where legally permitted to do so.
• Business transfer: If MediaCity Inc. is acquired or merged, your data may transfer to the successor entity under equivalent privacy protections.

We never sell, trade, or share your business or customer data with advertisers, data brokers, or any third party for commercial gain.

5Data Storage & Security

AccoPOS takes data security seriously and implements appropriate technical and organisational measures:

• Encryption in transit: All communication between your browser/app and our servers uses TLS 1.2 or higher (HTTPS).
• Access control: Staff access is restricted by role-based permissions configured by the business owner. Employee PINs are stored as hashed values — never in plain text.
• Server security: Our hosting infrastructure employs firewalls, intrusion detection, and regular security patches.
• Database isolation: Each business account's data is logically isolated by company ID and cannot be accessed by other tenants.
• Backups: Automated daily backups are retained for 30 days to protect against data loss.

6Data Retention

We retain your data for as long as your account is active or as needed to provide the Service:

• Transaction records are retained for a minimum of 7 years to comply with Canadian Revenue Agency (CRA) and applicable tax regulations.
• Account data is retained while your subscription is active. After cancellation, account data is held for 90 days to allow for reactivation, then permanently deleted.
• Log files (login events, errors) are retained for 90 days and then purged.
• Backup snapshots are retained for 30 rolling days.

You may export all your data from the AccoPOS admin panel at any time. You may also request early deletion by contacting us — subject to our legal retention obligations.

7Your Rights

As the business owner (data controller), you have the following rights under applicable privacy laws including PIPEDA (Canada) and GDPR (where applicable):

• Access: Request a copy of all data we hold about your business and its operations.
• Correction: Update or correct inaccurate information through the admin panel or by contacting us.
• Deletion: Request deletion of your account and associated data (subject to legal retention requirements).
• Portability: Export your product catalog, sales history, and customer records in CSV format at any time.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interests where your rights override ours.

To exercise any of these rights, email us at privacy@accopos.com. We will respond within 30 days.

Your end-customers (whose names or emails may appear on receipts) also have privacy rights. As the business using AccoPOS, you are the data controller for your customer data and are responsible for informing your customers about how their data is used.

8Cookies & Local Storage

AccoPOS uses minimal cookies strictly necessary for operation:

We do not use advertising cookies, tracking pixels, or third-party analytics cookies. The public landing page at accopos.com uses no tracking cookies.

9Third-Party Services

AccoPOS integrates with or loads resources from the following third parties:

• Bootstrap CDN / jsDelivr — UI framework CSS/JS loaded from CDN. No personal data is transmitted.
• Font Awesome / Google Fonts — Icon and font libraries. Your IP address may be logged by these CDN providers per their own policies.
• Poynt / GoDaddy — Payment terminal integration (see Section 3).
• PHPMailer / SMTP — Used to send receipts and invoices via your configured SMTP server. Email content may pass through the SMTP provider you configure.

AccoPOS does not embed Google Analytics, Facebook Pixel, or any advertising/tracking services.

10Children's Privacy

AccoPOS is business software intended for use by adults operating commercial enterprises. It is not directed at, and we do not knowingly collect personal information from, children under the age of 13 (or 16 in jurisdictions where that threshold applies).

If you believe a child has provided personal information through our Service, please contact us immediately and we will take steps to delete it.

11Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes we will:

• Update the "Last updated" date at the top of this page
• Display an in-app notification to active users at next login
• Send an email notice to the primary account holder's registered email address

Your continued use of AccoPOS after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree to the revised policy, you must discontinue using the Service.

12Contact Us

For privacy-related questions, data requests, or to report a concern, please contact our privacy team:

If you are located in the European Economic Area and believe we have not addressed your concern, you have the right to lodge a complaint with your local data protection authority.