Privacy Policy

POPIPOS is a cloud-based point-of-sale platform operated by TRUEGRAIN FOODS PRIVATE LIMITED, located in Jaipur, Rajasthan, India. When this policy mentions "POPIPOS", "we", "us", or "our", it refers to TRUEGRAIN FOODS PRIVATE LIMITED.

We collect information necessary to provide our services. The types of data vary depending on whether you are a business user (restaurant owner/staff using POPIPOS) or an end customer (a diner whose data is processed through POPIPOS).

• To provide, maintain, and improve our POS platform
• To send transactional WhatsApp messages on behalf of businesses (order receipts, OTP authentication codes, loyalty point updates)
• To track message delivery status and troubleshoot failures
• To manage loyalty programs and customer engagement features
• To generate sales reports and business analytics for our users
• To communicate service updates, security alerts, and support responses
• To comply with legal obligations, including tax and accounting requirements under Indian law

We share data with the following categories of third parties, solely to provide our services:

We do not sell, rent, or trade personal information to third parties for marketing purposes.

• Business account data: Retained for the duration of the account and up to 90 days after deletion request
• Order and transaction records: Retained for a minimum of 8 years as required by Indian tax and accounting regulations
• WhatsApp message logs: Message metadata (delivery status, timestamps) retained for 90 days. Message content is not stored beyond the delivery attempt
• OTP codes: Automatically deleted after use or expiry (5 minutes)

We implement industry-standard security measures to protect your data:

• All data is encrypted in transit (TLS 1.2+) and at rest
• WhatsApp API access tokens are encrypted before storage
• Row-level security policies ensure data isolation between organizations
• Authentication uses secure password hashing (bcrypt)
• Webhook payloads are verified using HMAC-SHA256 signatures
• Access to production systems is restricted and audited

Under applicable Indian data protection laws, you have the right to:

• Access -- Request a copy of your personal data
• Correction -- Request correction of inaccurate data
• Deletion -- Request deletion of your data, subject to legal retention requirements
• Opt-out of messaging -- End customers can ask the business to stop sending WhatsApp messages at any time
• Data portability -- Request your data in a machine-readable format

To exercise these rights, contact us at privacy@popipos.com. We will respond within 30 days.

POPIPOS uses essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising pixels. The platform does not serve advertisements.

POPIPOS is a business-to-business service not intended for use by individuals under 18 years of age. We do not knowingly collect data from minors.

We may update this policy from time to time. If we make material changes, we will notify business users via email and update the "Last updated" date above. Continued use of the platform after changes constitutes acceptance of the revised policy.