Privacy Policy
How Aether POS collects, processes, stores, and safeguards terminal transaction data, inventory logs, and enterprise account credentials.
1. Our Privacy Commitment
Aether POS ("we," "us," or "our") is dedicated to maintaining high standards of data privacy and transparency across our point-of-sale terminals, cloud sync services, and enterprise dashboard platforms (collectively, the "Services").
This policy outlines how corporate payment data, terminal activity, and user account details are handled under relevant financial and data privacy regulations, including PCI-DSS standards.
Aether POS operates strictly as a Data Processor for retail and enterprise client organizations. Enterprise administrators using our services should also review our formal Data Processing Addendum (DPA) and Service Level Agreements.
2. Information We Collect
2.1 Information Provided Directly
- Account Credentials: Full name, enterprise role, work email address, contact numbers, and access credentials.
- Store & Inventory Data: Product catalog listings, stock levels, pricing matrices, register shift logs, and store location profiles.
- Billing & Subscription: Merchant identification numbers, corporate billing addresses, and payment transaction identifiers.
2.2 Automatically Collected System Telemetry
- Device & Terminal Data: Terminal hardware IDs, firmware builds, network connection states, and IP addresses.
- Transaction Telemetry: Masked payment tokens (EMV surrogates), order timestamps, line-item totals, and tax aggregates. Raw primary account numbers (PANs) are never retained.
- System Logs: Offline database buffer depth, sync latency indicators, error logs, and session duration telemetry.
2.3 Third-Party & Partner Data
- Authorized payment gateway integration tokens supplied by merchant acquirers.
- Identity verification metrics supplied by enterprise fraud prevention services.
3. How We Use Information
Data collected by Aether POS is used strictly for operational, system optimization, and security purposes:
- Service Delivery: Authorizing payment requests, processing offline transaction buffers, and synchronizing multi-store inventory.
- System Communications: Dispatching critical system updates, terminal security alerts, and transactional account notices.
- Infrastructure Integrity: Monitoring sub-second transaction routing, diagnosing terminal hardware faults, and preventing unauthorized access.
- Regulatory Compliance: Fulfilling PCI-DSS auditing obligations and maintaining statutory payment processing logs.
4. Information Sharing & Disclosure
We do not sell personal data, merchant records, or transaction histories. Information is shared only under the following defined parameters:
- Subcontractors & Subprocessors: Secure cloud storage vendors and payment processing gateways bound by non-disclosure protocols and DPAs.
- Merchant Authorization: Routing payload data to explicitly authorized acquiring banks or ERP integrations upon merchant direction.
- Legal Requirements: Disclosures mandated by valid subpoenas, court orders, or statutory financial regulations.
- Anonymized Analytics: De-identified, aggregated dataset metrics used strictly for platform benchmark evaluations and latency tuning.
5. Security & Technical Safeguards
We implement technical and physical controls matching PCI-DSS Level 1 and NIST security guidelines:
- AES-256 bit encryption applied to all stored database fields, offline terminal vaults, and data at rest.
- TLS 1.3 secure socket layer protection for all API and hardware terminal communication in transit.
- Mandatory Multi-Factor Authentication (MFA) across all administrative control panels.
- Continuous network vulnerability scans, SOC 2 audits, and periodic third-party penetration tests.
6. Data Retention Schedule
Information is retained in accordance with statutory requirements and active account status:
- Account Profile Data: Maintained for the duration of active subscription plus 3 years.
- Transaction & Settlement Logs: Retained for a minimum of 7 years in accordance with financial audit mandates.
- Terminal Offline Buffers: Flushed and purged immediately following successful cloud synchronization.
- Audit & Security Logs: Preserved for 2 years for continuous threat monitoring.
7. Individual Privacy Rights & Choices
Enterprise clients retain explicit rights regarding their organizational data under applicable privacy frameworks:
- Right to Access & Portability: Export structured sales records and stock metrics via administrative APIs.
- Right to Rectification: Request correction of inaccurate account, billing, or terminal assignment details.
- Right to Erasure: Request merchant account deletion, subject to statutory financial retention laws.
- Communication Preferences: Opt out of non-essential system telemetry reports or promotional updates at any time.
Privacy Office & Contact Information
If you have questions regarding this policy, wish to submit a data handling request, or need to report a terminal security incident, please contact our designated Privacy Office: