Global Privacy Policy

TECHSHAN-IMS is business-to-business software. An organization (the "Customer") subscribes and receives an isolated workspace, called a tenant. Within that workspace the Customer records its own operations: what it stocks and where, what it buys and sells, who its staff, suppliers and customers are, what it owes and is owed, and what its tax position is.

The Service additionally lets a Customer run a public online storefront and sell through a marketplace. Where it does, members of the public who shop with that Customer will have information recorded in the Customer's workspace. Those shoppers are customers of the Customer, not of TECHSHAN.

TECHSHAN does not trade in the data held in Customer workspaces. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CPRA, and we have not done so in the preceding twelve months. We do not use Customer Data to train our own models.

This Policy covers the TECHSHAN-IMS web, desktop, and mobile applications, the REST API, and any storefront hosted by us on a Customer's behalf.

It does not cover third-party services a Customer chooses to connect, such as its own payment gateway, SMS provider, mail server, or accounting export target. Those are governed by the agreements between the Customer and that provider. It also does not cover a Customer's own website, premises, or offline record-keeping.

• Customer: the organization that subscribes to the Service and controls a tenant workspace.
• Authorized User: an individual the Customer permits to sign in to its workspace, such as an owner, manager, cashier, or storekeeper.
• Customer Data: everything the Customer or its Authorized Users record in the workspace, including records about third parties such as staff, suppliers, and shoppers.
• Account Data: the information needed to create, bill, secure, and support an account, together with the technical logs the platform generates about access to it.
• Shopper: a member of the public who buys from a Customer through a storefront or marketplace operated on the Service.
• Personal information: information relating to an identified or identifiable individual, and the equivalent terms used in the laws listed in the introduction.

For Customer Data, TECHSHAN acts as a processor (a service provider under the CPRA, and a data processor under the GDPR, LGPD, and Nepal's Individual Privacy Act). The Customer is the controller. The Customer decides what to record about its staff, suppliers, and shoppers, why, and on what legal basis. We process it on the Customer's documented instructions, which are the Service's own functions plus any written direction under the subscription agreement.

For Account Data — registration details, billing records, authentication events, security logs, and support correspondence — TECHSHAN acts as a controller, because we decide what is necessary to run and defend the platform.

This distinction determines who you approach to exercise your rights. Section 21 explains how.

The categories below reflect what the Service actually stores. Not every Customer uses every module, so not every category will exist in a given workspace.

• Account and profile information: name, business email address, phone number, postal address, date of birth where the Customer records it, a bcrypt-hashed password, and any WebAuthn or passkey credential you register. Passwords are never stored or recoverable in plain text.
• Authentication and security logs: sign-in attempts and their outcome, the email address used, IP address, user agent, browser, and device description, together with session records and an append-only audit log of significant actions with the acting user's name.
• Workforce and payroll records: employee name, address, phone, personal email, date of birth, emergency contact, photograph, bank account name and number, salary, PAN or tax identification number, employment contract terms, salary structures, and payslips.
• Attendance records: clock-in and clock-out events with timestamps, the site and device used, the method of identification, and — only where the Customer has switched on geofencing — the coordinates reported by the device, its accuracy, and the resulting distance from the worksite. Section 6 explains this in full.
• Trading-party records: names, email addresses, phone numbers, delivery and billing addresses, tax registration numbers, bank details, and credit terms for the Customer's own customers, suppliers, vendor-portal users, delivery riders, and sales leads.
• Shopper records from a storefront or marketplace: name, email address, phone number, delivery and billing address, order and payment status, saved baskets, product reviews, loyalty balances and tier, and — for digital goods — the delivery email address and a download log recording IP address, user agent, outcome, and bytes served.
• Commercial and financial records: inventory catalogues, stock levels by location, purchase and sales orders, invoices, payments, refunds, ledger entries, tax configuration, and the reports built from them.
• Health records, only where the Customer runs a pharmacy, clinic or optical business and uses these features: prescriptions (number, patient name and phone, prescriber and licence, validity, and a scanned copy), the medicines dispensed against them, a controlled-drug register, and eye-test results. On a mobile device they can sit in the encrypted offline queue until the sale syncs. These are the business's own records of what it dispensed or measured: the Service is not a medical device and does not diagnose, treat, cure or prevent any condition, and it gives no medical advice.
• Identity documents, only where a hotel or guesthouse Customer records them: the scan of a guest's identity document taken at check-in.
• Payment references: payment-provider transaction identifiers, the last four digits and brand of a saved card, and provider-issued tokens. Full card numbers, magnetic-stripe data, and CVV codes are never stored on our systems. Section 8 explains this.
• Uploaded content: product images, documents, attachments, and scanned records the Customer places in the workspace, together with electronic signatures captured on documents, including the signer's name and signature image.
• Device and application information: push notification tokens with the device platform and name, random installation identifiers the app creates for POS, card-payment and attendance terminal registrations with the device model, operating system version and last-seen IP address, printer and scanner configuration, and offline queues held on the device until they sync. Our own code never reads a hardware identifier, an advertising ID or the Android ID. Two components built into the mobile application handle identifiers of their own: the payment processor's software for in-person card payments reads the device's Android ID and device details to prevent fraud and secure the payment, and the notification service gives the installation an identifier (a Firebase installation ID on Android) so that notifications reach the right device.
• Communications: transactional email we send on the Customer's or our behalf, including the sending and recipient addresses and delivery status, and any correspondence you send to our support address.

Attendance monitoring is regulated more strictly than ordinary record-keeping in most jurisdictions, so we set out precisely what the Service does.

An attendance event records who clocked in or out, when, at which site, on which device, and by which method. The method may be a QR token, a numeric PIN, an NFC or RFID card, a scanned barcode, a manual entry by a supervisor, or a biometric match performed by the Customer's own terminal.

Where a biometric method is used, the biometric match happens on the Customer's device. TECHSHAN does not receive, process, or store facial geometry, fingerprint templates, or any other biometric identifier. What reaches our systems is a label recording that the method used was biometric. Attendance credentials themselves are stored only as cryptographic hashes — high-entropy tokens and card identifiers as SHA-256, and PINs as bcrypt — so the original value cannot be recovered from our database.

Location is not collected by default. Geofencing is off unless a Customer enables it for a specific site. When enabled, the device reports its coordinates and accuracy at the moment of the clock-in, and we store those values together with the computed distance from the site and whether the check passed. This produces a point-in-time location tied to a work event; it is not continuous tracking, and the Service does not follow a device between clock-ins.

A Customer that enables geofencing, biometric terminals, or any other attendance monitoring is the controller for that processing. It is responsible for having a lawful basis, for giving its workers the notice their local law requires, and for completing any consultation, impact assessment, or works-council process that applies. Several jurisdictions — including EU member states, Illinois and Texas in the United States, and others — impose specific consent and notice duties on biometric and location monitoring at work.

Where a Customer operates a storefront or sells through the marketplace, shoppers provide the information needed to complete a purchase: name, contact details, and a delivery address. Guests may check out without creating an account, in which case the order is identified by order number and phone number.

A shopper account additionally holds saved baskets, order history, saved addresses, loyalty points and tier, and any product reviews submitted. Reviews may be displayed publicly with the reviewer's name, and with images where the Customer permits them.

For digital goods such as e-books, the Service records an entitlement, the email address the item was delivered to, and an access log for each download containing the IP address, user agent, outcome, and volume of data served. This log exists to enforce the licence the shopper bought and to detect credential sharing and abuse; it is retained for that purpose and not used for profiling.

The selling Customer is the merchant and the controller of shopper information. Questions about an order, a refund, a marketing message, or the deletion of a shopper account must be directed to that Customer. TECHSHAN provides the platform and will support the Customer in responding.

Subscription fees for the Service are processed by our payment provider. Card details are entered directly with that provider and we receive only a token and the transaction result.

Separately, a Customer may connect a payment provider to take money from its own shoppers — for example Stripe, or local providers such as Fonepay, Khalti, or eSewa. The Customer is the merchant for those transactions. Where a shopper saves a card for reuse, we store only the provider's token together with the card brand and last four digits, and the stored credential is encrypted at rest with a dedicated key. Where a Customer uses Tap to Pay on a mobile device, the card is read by the payment provider's certified software and the card number never reaches our systems.

TECHSHAN does not store primary account numbers, magnetic-stripe or chip data, or card verification values. Card acceptance remains subject to the PCI DSS obligations of the Customer and its chosen provider.

We do store the commercial record of a payment — amount, currency, method, status, provider reference, and any refund — because that is an accounting record the Customer is required to keep.

The mobile application requests only the permissions its features require, and each is used for a single stated purpose.

The camera is used to scan barcodes and QR codes and to attach photographs to records; images are not captured in the background. NFC is used to read attendance and loyalty cards and to accept contactless card payments. Bluetooth is used only to connect a supported card reader or a receipt printer you add; receipt printers on the local network are reached directly from the device. Notifications are used to deliver operational alerts, which requires storing a push token identifying the device installation. Device biometrics, where you enable them, unlock the application locally through the operating system — the fingerprint or face data stays on the device and is never transmitted to us. Location, camera and Bluetooth are requested only when a feature first needs them, after an in-app explanation of why.

The mobile application does not request or collect continuous or background location. Location is read only in the foreground and only at two moments: an attendance event, as described in Section 6 and only where the Customer has enabled geofencing; and the acceptance of an in-person card payment, where the card networks and our payment processor require the device's location to authorise the payment. In both cases the device's precise location is read, and with it the approximate location it implies; if you allow only approximate location, that is what is used.

Pages marked "Available offline" (point of sale, receipts and returns, inventory items, customers, gift cards, recurring orders and staff attendance) keep a copy of the records they need in a local database on the device, so they keep working without a connection, together with any work done offline that is waiting to upload. That database is encrypted (AES-256) and its key is held in the platform's secure keystore on that device only, so no backup or copy of the file can be opened elsewhere; on Android the application's data is also excluded from cloud backup. Sign-in credentials are also held in the secure keystore. Signing out removes the local copy; work that has not yet uploaded is kept, encrypted, until it can be delivered to the Customer's workspace.

All other pages are TECHSHAN-IMS web pages shown inside the application. They load their data from the Service each time and keep no copy of it on the device beyond the ordinary short-lived web cache; links to any site that is not part of TECHSHAN-IMS open in the device's browser.

Uninstalling the application removes its local database, cache and any unsynchronised queue held on that device.

We use information for the following purposes and no others without telling you first:

• To provide the Service: running the modules the Customer has enabled, storing and retrieving records, producing documents and reports, and synchronising devices.
• To authenticate and authorise: verifying identity, applying role-based permissions, and enforcing isolation between tenants.
• To secure the platform: detecting and investigating unauthorised access, fraud, abuse, and attacks, and maintaining the audit trail that makes an investigation possible.
• To maintain integrity: keeping append-only audit and accounting records so that financial and stock history cannot be silently altered.
• To bill and support: taking subscription payments, answering support requests, and communicating about service changes, incidents, and renewals.
• To send marketing, only where permitted: newsletters and offers go only to people who opted in where their law requires opt-in, every such message names the sender, gives its postal address and carries a one-click unsubscribe link, and an unsubscribe takes effect at once — including for messages already queued. Service messages (security alerts, receipts, billing and renewal notices) are sent regardless of marketing preferences because they are needed to use the Service.
• To comply with law: meeting tax, accounting, employment, and records-retention obligations, and responding to lawful requests.
• To improve the Service: diagnosing faults and understanding aggregate usage. Where we analyse usage we use aggregated or de-identified information, and we do not re-identify it.

Where the GDPR, UK GDPR, or LGPD applies, we rely on the following bases. For Account Data, where TECHSHAN is the controller: performance of the contract with the Customer; our legitimate interests in securing, maintaining, and defending the platform, balanced against your rights; and compliance with legal obligations such as tax and accounting law.

For Customer Data, the Customer as controller determines and is responsible for the legal basis. Common bases in this context are performance of a contract with the individual, the Customer's legitimate interests, compliance with its own legal obligations, and consent where required — for example for marketing messages or, in many jurisdictions, for biometric or location-based attendance monitoring.

Where we rely on legitimate interests, you may object, and we will stop unless we can show compelling grounds that override your interests or we need the information to establish, exercise, or defend legal claims. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

Consent records. When you accept the Terms of Service or this Policy, confirm your age and authority, or opt in to or out of marketing, we record the decision together with the version of the document, the time, the regional rules applied, and the network address and browser it came from. The record is append-only: a withdrawal is stored as a new decision rather than erasing the earlier one, so it can show what you agreed to and when. When a document that requires acceptance changes, you are asked to accept the new version the next time you sign in.

The Service uses strictly necessary browser storage only. An authentication token and your interface preferences are held in localStorage or sessionStorage; a storefront additionally keeps a basket identifier so an order survives a page reload. These are required for the Service to function and cannot be switched off while you are signed in.

We do not use advertising cookies, cross-site trackers, session-replay tools, analytics that profile individuals, or third-party marketing tags in the Service or in a storefront we host. Fonts, icons, QR codes, barcodes and placeholder avatars are served or drawn by the Service itself, so opening a page does not contact another company. Because no non-essential cookies are set, no consent banner is required under the ePrivacy Directive or its national implementations.

The complete list of what is stored on your device, and of every outside service a page or app may contact and why, is in our Cookie & Tracking Policy at /cookie-policy.

A Customer that adds its own tags or pixels to its storefront becomes responsible for the consent and disclosure that entails.

Some features can call a third-party AI provider. They are off unless a Customer's administrator enables them and supplies credentials for the chosen provider.

When a feature is invoked, the prompt and the context it needs are sent to that provider. The Customer chooses the provider and is therefore responsible for reviewing that provider's terms, including whether submitted content may be retained or used for model training, and for ensuring it has the right to send the information at all. Do not enable these features for special-category, health, or biometric data without first confirming that your chosen provider's terms permit it.

TECHSHAN does not use Customer Data to train its own models. AI output is generated automatically and can be wrong; it is a suggestion, and no AI feature makes a decision about a person that produces legal or similarly significant effects. Section 22 covers automated decision-making.

We do not sell personal information and we do not disclose it for anyone else's independent purposes. Information is shared only in the circumstances below.

Our subprocessors are bound by written terms imposing confidentiality and security obligations no less protective than this Policy, and they may process information only on our instructions.

• Infrastructure we select to run the platform: hosting and compute, object storage for uploaded files, managed database and cache services, backup storage, and error monitoring.
• Our own billing provider, used to take subscription payments from Customers.
• Delivery services needed to operate features: transactional email delivery and, for the mobile application, Expo's push notification service, which relays notifications to the services operated by the device platforms.
• Providers a Customer chooses and configures itself: its payment gateways, SMS and messaging providers, its own SMTP server, and any AI provider it enables. We pass information to these only because the Customer has instructed us to.
• Professional advisers, auditors, and insurers, under confidentiality, where needed to run or defend the business.
• A successor in a merger, acquisition, or sale of assets, subject to this Policy continuing to apply and to notice being given.
• Law enforcement, regulators, or courts where we are legally compelled. We assess each request, require valid legal process, disclose only what is strictly necessary, and notify the affected Customer unless prohibited by law.

The Service may be hosted in, and supported from, a country other than the one you are in. Where information is transferred out of the EEA, the United Kingdom, or another jurisdiction that restricts transfers, we rely on a lawful transfer mechanism — an adequacy decision where one covers the destination, and otherwise the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, supported by a transfer risk assessment and by technical measures including encryption in transit and at rest.

Customers who require their data to stay in a particular region should confirm the hosting region with us in writing before subscribing, as the available regions depend on the deployment. A copy of the transfer mechanism we rely on is available on request to the contact address in Section 26.

We apply technical and organizational measures appropriate to the risk, including: encryption of traffic in transit; encryption at rest for stored payment credentials using a dedicated key; an encrypted on-device database and keystore-held credentials in the mobile application; bcrypt password hashing; support for WebAuthn and passkeys; role-based access control; logical isolation between tenants enforced in the database, including row-level security on tenant-scoped tables; parameterised queries and input validation; append-only audit logging; rate limiting; and least-privilege administrative access that is itself logged.

Backups are taken on a regular schedule and point-in-time recovery is maintained so that a failure or a destructive mistake can be reversed.

No system is perfectly secure. We do not guarantee that the Service cannot be compromised, and you remain responsible for the strength and confidentiality of your credentials and for revoking access promptly when a person's role ends.

We keep information for as long as the Customer's subscription is active and afterwards for the periods below, because much of what the Service holds is a statutory record the Customer is obliged to keep.

Financial, tax, and accounting records — invoices, payments, ledger entries, stock valuations — are retained for the period required by the Customer's applicable tax and company law, commonly five to ten years, and cannot be deleted earlier without breaking the accounting record. Employment and payroll records are retained for the period required by applicable employment law. Security and authentication logs are retained for a limited period proportionate to their security purpose. Audit logs are append-only and are retained for the life of the workspace so that the integrity of business records can be demonstrated.

Backups follow their own rotation. Information deleted from the live system persists in encrypted backups until those backups expire on their normal schedule, after which it is overwritten.

Where a Customer instructs us to delete something sooner and no legal obligation requires us to keep it, we act on that instruction.

When a subscription ends, the workspace is first suspended rather than erased. Suspension preserves accounting integrity, pending offline synchronisation, and audit history, and gives the Customer a window to export its records or to reactivate.

Customers can export their business records at any time while the subscription is active, in standard formats, and should do so before terminating.

Any individual user can delete their own account at any time: in the mobile application under Privacy & account, or by following the instructions at /delete-account on our website if they no longer have the application. Deletion immediately ends every sign-in on every device and removes the account's personal details (name, email address, phone number, photograph, date of birth, address, emergency contact, ID card number, PIN and two-factor settings), its passkeys, personal API keys, sign-in history, assistant conversations, notifications and preferences. Business records the user created for the Customer — sales, stock movements, payroll and audit entries — are retained by the Customer as Section 17 requires, but no longer identify the user. If the user was the Customer's last administrator, the workspace is closed and proceeds as described below.

A shopper with an account on a storefront can likewise delete it from the account page of that store. The store keeps its invoices and order history as its tax law requires, but no longer with the shopper's name, contact details, addresses or saved cards; downloads of digital purchases end with the account.

After suspension, deletion proceeds on request or at the end of the retention period, subject to the legal obligations in Section 17. Personal information that is not required for a statutory record is removed or anonymised; aggregate financial figures needed for tax and accounting continuity are retained without the personal identifiers attached to them. To request deletion, contact us at the address in Section 26; we will confirm what has been deleted and state what must be retained and why.

The Service is enterprise software and is not directed at children. We do not knowingly create accounts for, or knowingly collect personal information directly from, children.

Authorized User accounts are created by a Customer for its own personnel. The Customer is responsible for ensuring that every person it invites meets the minimum age for employment and for digital consent in the relevant jurisdiction, which varies and is 16 in several EU member states. We do not operate parental-consent infrastructure, and the Service should not be used to collect information directly from children.

Where a Customer records information about a minor — for example a young worker in its employment records — the Customer is the controller and must have its own lawful basis and safeguards. If we become aware that a child has registered an account directly, we will suspend it and delete the associated Account Data.

We do not make decisions about individuals based solely on automated processing that produce legal effects or similarly significantly affect them, within the meaning of Article 22 of the GDPR.

The Service does compute figures automatically — reorder suggestions, credit limits, loyalty tiers, geofence pass or fail results, and payroll calculations. These are inputs presented to a person, who decides. Where a Customer configures the Service to act on such an output without review, the Customer becomes responsible for that decision and for providing any human-review rights its law requires.

Subject to your jurisdiction, you may have the right to access the personal information held about you, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw consent, and to complain to a supervisory authority. Exercising these rights is free, and we will not treat you differently for doing so.

You can exercise the rights of access and portability yourself, at any time: signed-in users can download the personal data held about them from Profile → Privacy (Download my data), and storefront shoppers from their account page on the store. The file is machine-readable JSON; credentials such as passwords, two-factor secrets and PINs are never included. You can also change your marketing preference there, and see which versions of our documents you accepted and when.

Who to approach depends on who controls the information. If you are an employee, supplier, or shopper of a Customer, that Customer is the controller: direct your request to them. We will not respond to such requests ourselves without the Customer's instruction, because it is not our data to disclose or delete — but we will notify the Customer and help them respond within the statutory deadline.

If your request concerns Account Data we control — your own registration details, sign-in history, or support correspondence — contact us directly at the address in Section 26. We will verify your identity before acting, respond within the period required by applicable law (one month under the GDPR, forty-five days under the CPRA, both extendable where permitted), and explain any refusal.

You may use an authorised agent where your law permits it, provided we can verify both the agent's authority and your identity.

European Economic Area and United Kingdom: you have the rights in Articles 15 to 22 of the GDPR, including the right to lodge a complaint with your national supervisory authority or the UK Information Commissioner's Office. Where required, our Customers act as controllers and we contract with them on Article 28 terms.

California: we do not sell or share personal information for cross-context behavioural advertising, and we have not done so in the preceding twelve months. We act as a service provider in respect of Customer Data and process it only for the business purposes set out in our agreement. You have rights to know, delete, correct, and to limit the use of sensitive personal information, and the right not to be discriminated against for exercising them.

Canada: we handle personal information in accordance with PIPEDA's fair information principles, and you may complain to the Office of the Privacy Commissioner of Canada.

Brazil: the rights in Article 18 of the LGPD apply, including confirmation, access, correction, anonymisation, portability, and deletion.

Japan: we handle personal information in accordance with the Act on the Protection of Personal Information, including its provisions on third-party provision and cross-border transfer.

Nepal: we handle personal information in accordance with the Individual Privacy Act, 2075 (2018) and the Individual Privacy Regulation, 2077 (2020), which require consent for the collection of personal information, accuracy and security of what is collected, and restraint on disclosure without authorisation, and we record electronic transactions consistently with the Electronic Transactions Act, 2063 (2008).

If we become aware of a breach affecting personal information, we will investigate and contain it, and notify affected Customers without undue delay so that they can meet their own notification duties — within 72 hours of becoming aware where the GDPR applies, and within the periods set by other applicable laws.

Our notice will describe what happened, the categories and approximate volume of information involved, the likely consequences, and the measures taken or proposed. Where a Customer is the controller, it is responsible for notifying its own regulator and the affected individuals; we will provide the information it reasonably needs to do so.

A Customer using the Service to process personal information is responsible for: having a lawful basis for what it records; giving its staff, suppliers, and shoppers the privacy notice their law requires; configuring roles and permissions so that people see only what they need; keeping records accurate and up to date; revoking access when someone leaves; carrying out any data protection impact assessment its law requires, particularly before enabling attendance monitoring, geofencing, or AI features; and responding to the requests of its own data subjects.

Customers must not upload special-category data — health, biometric, racial or ethnic origin, religious belief, political opinion, sex life, or trade union membership — into free-text fields not designed for it, and must not use the Service for processing that its own law prohibits.

We may update this Policy as the Service or the law changes. The Effective Date and Last Updated date at the top record when. Where a change materially affects how we handle personal information, we will give notice in the Service or by email before it takes effect, and where the law requires consent we will ask for it rather than assume it. Signed-in users are asked to accept a revised version the next time they sign in, and that acceptance is recorded as Section 11 describes.

Previous versions are available on request.

For privacy questions, to exercise rights over Account Data, to request a copy of our transfer safeguards, or to report a security concern, contact us at [email protected].

If you are an employee, supplier, or shopper of an organization that uses TECHSHAN-IMS, please contact that organization first — they control the information recorded about you, and they can act on it directly.