# Privacy Policy — POS SoftSolvIT

## 1. Overview

POS SoftSolvIT is a business point-of-sale (POS) application for merchants who runtheir own [Odoo](https://www.odoo.com) back-office system. The app lets a merchant'sstaff sell products, take payments, and sync those transactions to **the merchant's ownOdoo server**.

**Important — who controls your data.** SoftSolvit provides the app software. The**merchant** (the business that installs and configures the app) operates their ownOdoo server and is the **data controller** for all business and customer data processedthrough it. SoftSolvit does **not** receive your sales, customer or payment data, neverreceives an employee PIN, and does **not** have access to the merchant's Odoo instance.The one exception is a **support report** that the merchant's staff choose to send fromthe app, which carries what is described in §2 — and, only if they tick "Include lastorder", a summary of the most recent order (without the customer's details).

**One exception about credentials, added 2026-08-15.** SoftSolvit never *stores* an Odoopassword or API key. The single moment one reaches SoftSolvit is **device linking**: thefirst time a given device is linked to a database, the login and password entered on thesign-in screen are sent to `softsolvit.com`, which uses them once — immediately — to askthe merchant's *own* Odoo server whether that account exists and is allowed to use thepoint of sale. The answer decides whether that device may be issued a licence key. Thepassword is not written to a database, not written to a log, and is discarded as soon asthe check returns. It happens once per device, not at every sign-in.

This exists because a device that has never been seen before cannot otherwise bedistinguished from an unauthorised one, and a database URL is not a secret — anyone whoguessed it could otherwise claim a licence seat in the merchant's shop.

SoftSolvit operates a **registration/licensing server** (`softsolvit.com`). Forlicensing it receives: the **Odoo database URL**, a **contact phone number** andoptional **contact email**, and the **number of devices** requested, given atregistration; the **database name**, once per device, for the device-linking check; and— each time the app signs in — a **device identifier** (on Android derived from, andaccompanied by, the Android ID; see §3), the **Odoo login name** used to sign in, a**device/platform label**, the **date and time that device was last used**, and, untilthe server confirms it, which versions of the in-app agreements were accepted and when.The device identifier and login name are what make the per-business device limitenforceable and a licence question answerable; see §2 and §4. It also receives a**support report** when, and only when, someone on the till chooses to send one (§2).Every request reaches it, like any internet request, from the device's IP address.Business data otherwise flows only between the device and the destinations the merchantconfigures.

**Egyptian eReceipts.** A merchant who switches them on reports each sale directly tothe **Egyptian Tax Authority** from their own till, with credentials the Authorityissued to them. SoftSolvit is not in that path and receives nothing from it. A receiptfor a sale with **no customer attached** names no buyer. When a **customer isattached**, the receipt also carries that customer's **name** and **phone number** asrecorded in the merchant's customer list, and — only when the Tax ID recorded for thecustomer has the form of a 14-digit Egyptian **National ID** — that number. WhileeReceipts are on, the app refuses any sale of 150,000 EGP or more, whether or not acustomer is attached. See §2 and §4.

**Presented and accepted in the app, from this build on.** The list above is no longeronly published here: on first run the app shows two agreements — the data-collectionagreement and a terms-of-use/liability agreement — each as a full-screen, scrollabletext that must be read to the end and ticked before it can be accepted. **The app cannotbe used until both are accepted**, and the gate is decided on the device, so it appearswhether or not the device is online. The data-collection agreement states the same listdescribed in §2 and §4; it restates rather than extends what this policy already says.Each agreement carries a version number: if either text changes materially, its versionis raised and every device is asked again. The accepted versions and the acceptance timeare recorded on the device, and are reported once to the merchant's registration recordon `softsolvit.com` so we hold a record of which terms that business accepted and when.

## 2. Data the app handles and where it goes

Network communication goes to the following destinations:

1.**The merchant's Odoo server** — the server URL is entered by the merchant at login   (chosen and controlled by the merchant). Almost all data flows here.2.**Thermal receipt printers on the merchant's local network (LAN)** — for printing   receipts and reports (local network only).3. **The Egyptian Tax Authority (`id.eta.gov.eg` and `api.invoicing.eta.gov.eg`, or   their `preprod` test equivalents if the merchant chooses the test environment)** —   contacted **only** when the merchant has switched eReceipts on and entered their own   ETA credentials. The app then reports each sale to the Tax Authority as the law   requires. This is a direct connection between the merchant's till and the Tax   Authority: **SoftSolvit receives nothing from it and cannot see it.** See the   eReceipt rows below.4.**SoftSolvit's registration server (`www.softsolvit.com`)** — contacted to register   the merchant's database for a licence/free trial, to verify that the database's   subscription is active (an access gate), **to register this device against the   licence's device limit each time the app signs in**, to report sign-out so the   device's seat is freed, and to file a **support report** when someone on the till   chooses to send one. This is the only data SoftSolvit itself receives; the exact   fields are in the table below and in §4.5.**The public App Store / Google Play listing** — checked for a newer version of the   app. On iOS the app asks `itunes.apple.com` with the app's bundle identifier; on   Android it reads the Google Play listing (`play.google.com`) with the app's package   name and the device's language and country.6.**A public Cloudflare address (`one.one.one.one`)** — until an Odoo server address   has been entered on the device, the app opens a connection to it and closes it again   to tell whether the device is online. No data is sent.7.**Google Play services (Android only)** — the barcode reader is Google's ML Kit,   delivered through Google Play services, which downloads the barcode-reading component   from Google the first time the scanner is used. Camera images are still analysed on   the device (see below).

Beyond these, something leaves the app only when the user taps a button that hands itto another app: a receipt or report PDF to the device's share sheet, or a link thatopens SoftSolvit's website, WhatsApp, the phone dialler, the user's email app, or thestore listing.

The app contains **no advertising, analytics, tracking, or crash-reporting SDKs**.Errors the app hits are written to a log **on the device only**; they leave it onlyinside a support report someone on the till chooses to send.

| Data | Why it is handled | Where it goes ||---|---|---|| **Odoo login credentials** (server URL, username/email, password or API key) | To authenticate the app to the merchant's Odoo server, and once per device to prove that device may be licensed | Sent to the merchant's Odoo server; stored locally on the device (see §3). **The password / API key is never stored by SoftSolvit.** It is transmitted to `softsolvit.com` exactly once per device, for the device-linking check described above, and discarded after that single use. The server URL and the login name are sent for licensing — see the device-registration row below. || **Employee identifiers and PINs** | Downloaded from Odoo so cashiers can log in with a PIN while offline | Downloaded from the merchant's Odoo server; cached on the device || **Sales, orders, payments, cash movements** | Core POS function — recording and syncing sales | Sent to the merchant's Odoo server; cached on the device until synced || **Customer details** (name, phone, email, tax/VAT id, address) | To attach a customer to a sale, or to create a customer record the merchant requested | Downloaded from / uploaded to the merchant's Odoo server || **Receipt logo image** | Branding on printed receipts | Chosen by the merchant from the device gallery; stored **locally only** — never uploaded off the device || **Receipt content** (item names, prices, cashier/customer name) | To print receipts and kitchen tickets | Sent to the merchant's LAN printer over the local network || **Registration details** (the merchant's Odoo database URL, a contact phone number, optionally a contact email, and the number of devices requested, entered when registering — on the login screen, or at the first sign-in to a database that is not yet registered, where the phone and email may be left out) | To register the database for a licence/free trial and to check that its subscription is active before allowing access | Sent to **SoftSolvit's registration server (`softsolvit.com`)**. The database URL is also re-sent on periodic subscription checks. || **eReceipt documents** (the sale's own numbers and time, lines, prices, discounts, taxes, totals and payment kind; the shop's tax registration number, registered name, activity code and branch address; this till's registered serial; and, **when a customer is attached to the sale**, the buyer details described in the next column) | To issue the electronic receipt the Egyptian Tax Authority requires for each sale, and to send the matching return receipt for a refund | Sent to the **Egyptian Tax Authority** (`id.eta.gov.eg`, `api.invoicing.eta.gov.eg`) from the merchant's own till, using the merchant's own ETA credentials. Every receipt files the buyer as a natural person (`buyer.type = P`). With no customer attached, it carries nothing else about the buyer. With a customer attached, it also carries the customer's **name** and **phone number** as recorded in the merchant's customer list (each left out if empty or longer than the Authority accepts), and the customer's **National ID** only when the Tax ID recorded for them has the form of a 14-digit Egyptian National ID. A return receipt carries the original sale's buyer details where the till holds them, otherwise those of the customer attached to the return. The app refuses any sale of 150,000 EGP or more while eReceipts are on. Nothing is sent to SoftSolvit. || **ETA credentials** (the client id and client secret the Tax Authority issues per registered till, and an optional pre-shared key) | To authenticate this till to the Tax Authority | Entered by the merchant. The client secret and the pre-shared key are stored **only in the device's secure store** — never in the app's settings file, never in a backup of it, and never sent anywhere but the Tax Authority. The client id, which is not a secret, is kept with the app's eReceipt settings on the device. || **Device registration** (this device's identifiers — see §3 — the Odoo login name used to sign in, a device/platform label such as "iOS 18.1 – iPad13,4", the database URL, the date/time the device was last used, and, until the server confirms it, the versions of the in-app agreements accepted on the device and when) | To enforce the licence's limit on how many devices a business may use at once, to show the licence holder which devices are active, and to record which agreements were accepted on which device | Sent to **SoftSolvit's registration server (`softsolvit.com`)** each time the app signs in, and refreshed every 45 seconds while it is open; sign-out is reported so the seat is freed. The licence identifier is sent when the device is registered, linked, or recovers a lost licence key; the device serial is sent at each sign-in (§3 says what each is on Android and iOS). Neither is an advertising identifier, and neither is used as one. No sales, customer or payment data and no employee PIN is sent here. Each device holds a **licence key issued to that device**, which is what identifies it on later calls; the key is stored in the device's secure store. || **Support reports** (only when someone on the till presses Send in the in-app report dialog, opened from the Help screen or from the eReceipt settings) | To investigate and answer the problem being reported | Sent to **SoftSolvit's registration server (`softsolvit.com`)** and filed on the merchant's own record there. A report carries: the subject and message typed; the till's diagnostics — app version and build, the device's name, the Odoo server's host name, the point of sale and session open, the signed-in cashier's name, online/offline and the count of unsent orders (a report from the eReceipt settings carries the eReceipt diagnostics instead, which contain no credentials); the most recent entries of the device's error log (up to 4,000 characters), when it has any — these record what went wrong and where, and can contain fragments of data the app was handling at the time; and, **only if "Include last order" is ticked**, the most recent order on the till: its number, time, status and sync result, order type and table, each line's quantity, product name and amount, the total, the payments (method and amount), and card or coupon codes cut to their last four characters. The order summary says only whether a customer was attached — never the customer's name, phone, address or ID. The separate "email" button instead opens the user's own email app, addressed to info@softsolvit.com with the diagnostics filled in; nothing is sent unless the user sends that email. |

The app does **not** collect location, contacts, microphone, phone/SMS, or health data.

Two device permissions are used, and neither sends anything to SoftSolvit:

-**Photo library** — accessed only when the merchant picks a receipt logo, which is  stored on the device and never uploaded.-**Camera** — used to scan product barcodes at the till, and to photograph a receipt  logo if the merchant chooses the camera instead of the gallery. Barcode frames are  read **on the device** and are never stored or transmitted; only the decoded barcode  number is used, and only to look the product up in the merchant's own catalogue.

## 3. Data stored on the device

For offline selling, the app caches data in the app's private storage:

- Catalog (products, taxes, payment methods, categories).- Employees (names and PINs) and customers (contact details) downloaded from Odoo.- Orders and session data awaiting sync.- App settings, including the last-used Odoo URL/login and the receipt logo.-**Where eReceipts are switched on**: for each sale, the receipt document exactly as it  was sent to the Egyptian Tax Authority (including any buyer details it carried), its  identifier, the QR text printed on the paper, the Authority's answer and a log of the  attempts. It is kept for the same reason and the same length of time as the order  itself, and is removed with the app's data. The Tax Authority secrets are **not** part  of this cache — they are held in the device's secure store (Keychain on iOS, the  keystore on Android).- An **error log**: when the app hits an uncaught error, it appends the time, the error  and the top of its stack trace to a file in the app's private storage, capped at  64 KB. It leaves the device only inside a support report (§2).- The **device identifiers** used for licensing (§2):- On **Android**, the *licence identifier* is derived from the **Android ID** — a value    Android assigns to this app on this device, which stays the same when the app is    uninstalled and reinstalled — and the *device serial* sent at sign-in is the Android    ID itself. The device serial also forms the till's default name and order-number    prefix.- On **iOS**, the app creates one random UUID and keeps it in the system Keychain; it    serves as both the licence identifier and the device serial.- If the Android ID cannot be used, the app creates a random UUID instead, which does    not survive a reinstall. A device that already held identifiers from an earlier    version of the app keeps them.

  These are not advertising identifiers. They exist so the licence's device limit can  count this till, and — where they survive a reinstall — so a reinstalled device  returns to its own seat and its own record instead of using a second one.

The **Odoo password**, this device's **licence key** and the **eReceipt secrets** arenot kept in the cache above: they are held in the device's secure store — the Keychainon iOS; on Android, storage encrypted with a key held in the Android Keystore. If adevice's secure store cannot be written, the Odoo password stays in the app's privatesettings, unencrypted, so that the till can still sign in. Signing out clears the storedpassword from the device.

This local cache is stored in the app's private area of the device and is not encryptedby the app. It is removed when the app's data is cleared or the app is uninstalled(Android Settings → Apps → POS SoftSolvIT → Storage → Clear data / Uninstall).

One exception: on iOS, Apple does not erase an app's Keychain items when the app isdeleted. So reinstalling the app on the same iPhone or iPad reuses the same **deviceidentifier** rather than consuming a second device slot, and anything else the app heldin the Keychain at deletion (such as a licence key, or a password not yet cleared bysigning out) also stays there. To have the identifier cleared from the licence, see §6.

## 4. Data sharing

We do **not** sell your data or share it with advertising or data-broker third parties.Business data (sales, customers, passwords, employee PINs, catalog) is transmitted only tothe merchant's own Odoo server and the merchant's own LAN printer(s), as described above —**SoftSolvit does not receive any of it**, with two exceptions described in §1 and §2: thelogin and password sent once per device for the device-linking check, and whatever asupport report that someone on the till chooses to send carries.

A second destination exists only where the merchant has enabled it: the **Egyptian TaxAuthority**. eReceipt documents go from the merchant's till to the Authority(`id.eta.gov.eg`, `api.invoicing.eta.gov.eg`) under the merchant's own Tax Authoritycredentials, because Egyptian law requires each sale to be reported. **SoftSolvit is nota party to that exchange and receives no copy of it.** When a customer is attached to asale, its receipt identifies that customer to the Authority by name and phone number, andby National ID when the customer's recorded Tax ID has the form of one (§1, §2).

The other exception is **licensing and support**, which reach SoftSolvit's own server(`softsolvit.com`) in these ways:

-**Registration and subscription checks** — the **database URL**, and at registration a**contact phone number**, optional **contact email** and the **number of devices**  requested.-**Device linking**, once per device — the licence identifier, platform label, database  URL and **database name**, and the Odoo login and password for the one-time check.-**Device registration**, each time the app signs in — the **device serial** (§3), the**Odoo login name** used to sign in, a **device/platform label**, the database URL, the**date/time the device was last used**, and, until confirmed, the accepted agreement  versions and acceptance time.-**Support reports**, only when someone on the till sends one — the contents listed in §2.

SoftSolvit uses all of this solely to manage the licence/free trial, the subscriptiongate, and the limit on how many devices a business may use at once — a limit that cannotbe enforced without identifying the device, and a licence question that cannot be answeredwithout recording which login activated it — to keep a record of the agreements accepted,and to answer support reports. None of it is sold or shared for advertising, and it isnever joined to data from other apps or websites.

## 5. Security

- Data transmitted to the merchant's Odoo server is **always encrypted in transit**:  since 2026-10-21 the app connects only over `https://`. An address beginning with`http://` is refused at sign-in, and one stored by an earlier version is upgraded  before it is used.- Traffic to SoftSolvit's server and to the Tax Authority always uses HTTPS.- The Odoo password, the device's licence key and the eReceipt secrets are kept in the  device's secure store (Keychain on iOS; on Android, encrypted with a key held in the  Android Keystore), except that a device whose secure store cannot be written keeps the  Odoo password in the app's private settings (§3). Other local device data relies on  the device's own security (screen lock, app sandboxing, and device/OS encryption). The  receipt-printer connection uses the standard unencrypted ESC/POS protocol over the  local network, as required by thermal printers.

## 6. User accounts

The app does **not** create consumer user accounts and has no in-app sign-up. Staffauthenticate with credentials for the merchant's pre-existing Odoo system. Because noapp-managed account is created, account/data deletion is handled through the merchant'sOdoo system and by clearing the app's local data on the device (§3).

The records SoftSolvit itself holds are the merchant's **registration**, the **deviceregistrations** (including the record of the agreements accepted on each device), andany **support reports** sent, all described in §2 and §4. To have a device's record (itsidentifiers, login name, platform label and last-used timestamps) deleted from thelicence, email **info@softsolvit.com** from the licence-holder's contact address.Removing it frees that device's slot, so the app will register the device again the nexttime it signs in.

## 7. Children

The app is a business tool intended for merchant staff (adults). It is not directed tochildren.

## 8. Changes

We may update this policy; material changes will be reflected by the "Last updated"date above and posted at the policy URL.

## 9. Contact

Fintech for Software Solutions — info@softsolvit.com9 Ibn Elmoataz, El Hegaz Square, Heliopolis, Cairo 11351, Egypt