DeviPOS Privacy Policy

Last updated: 2 November 2026

This policy explains what information the DeviPOS app and its cloud service collect, why, how it is kept safe, and the choices you have. DeviPOS is made by DeviStack Technologies ("DeviStack", "we", "us"), India.

DeviPOS is billing software for restaurants, cafés and food businesses. It runs on Windows PCs and on Android phones and tablets. It is meant for businesses and their staff, not for personal use by children.

1. Who is responsible for which data

• Your account and licence data (the restaurant owner's sign-in details, the restaurant's licence and payments to us): we decide how this is used, so we are responsible for it.
• Your restaurant's business data (menu, bills, staff, and the names and phone numbers of your customers, if you enter them): this belongs to your restaurant. We only store it and give it back to you, on your instructions, so that your devices can back up, restore and share it. We do not use it for anything else. Your restaurant is responsible for telling its own customers why it records their details.

2. What we collect

The restaurant owner's account

• Name, mobile number and/or email address. Our team creates the account when you buy a licence; there is no sign-up in the app.
• Your password, stored only as a secure one-way hash. We cannot read it.

Restaurant details you enter

• Restaurant name, address, phone, GSTIN, FSSAI number, UPI ID, bill footer and logo, tax and charge settings.

Business records made while you use the app

• Menu items, categories, prices and tax rates; tables.
• Staff names and roles. Staff PINs are stored only as a secure one-way hash.
• Orders, KOTs, bills, discounts, cancellations, payment mode and amounts (cash, UPI, card), cash drawer entries and day-end totals.
• Customer name, phone number and delivery address, only if your staff enter them on an order.
• An activity log of sensitive actions (for example a removed item, a discount or a cancelled bill) and which staff member did it.

DeviPOS only records how a bill was paid. It does not process card or UPI payments and never sees card numbers or bank details.

Device information

• A device ID made from the device's hardware (on Android, from its Android ID) and turned into a one-way hash on the device, so we never receive the original value. It is used so that a licence works only on the devices you activated.
• Device name (for example "COUNTER-PC" or the phone model), device type, app version and operating system version, and when the device last checked in.

Problem reports

• When the app has an error, it sends us the error message and where in the app it happened, so our team can fix problems without having to ask you.
• Every 10 minutes it also sends a short health report: printer status, KOTs waiting to print, backup status, free disk space, memory, data size, operating system and licence state.
• Only if our team asks, the device uploads its app log file to help solve a specific problem.
• Problem reports and logs do not contain bills, amounts, menu items or customer details.

What we do not collect

• No location, contacts, photos, camera, microphone or call history.
• No advertising ID. The app has no ads and no third-party analytics or tracking.

This website

• The website has no sign-in, no cookies for tracking and no analytics.
• If you ask for a demo, the form sends your name, mobile number, restaurant name, city and type of business to us, by opening WhatsApp with these details filled in. We use them only to contact you about DeviPOS. WhatsApp's own privacy policy applies to the message itself.
• The website loads its fonts from Google Fonts, so your browser connects to Google's servers when you open a page.

3. Permissions the Android app uses

4. Why we use it

• To run the service: sign-in, activating your devices, checking your licence, backing up your data to the cloud, restoring it on a new or repaired device, and sharing it between your restaurant's devices.
• To support you: finding and fixing problems from error and health reports, and helping you when you contact us.
• To manage your licence: recording your payments to us, renewal reminders and licence status.
• To meet legal duties, for example tax and accounting records of your payments to us.

We do not sell your data, use it for advertising, or use your restaurant's business data or customer details for our own purposes. Our team's admin tools show licence and backup health only; they do not show your bills, sales or customers.

5. Who we share it with

• Hosting providers who run our servers and database for us: Amazon Web Services and Microsoft Azure, in India (Mumbai). They store data on our behalf and may not use it for their own purposes.
• Authorities, only when the law requires it.
• A buyer or successor, if our business is sold or merged, under the same promises as this policy.

We do not share data with advertisers or data brokers.

6. Where it is stored and how it is protected

• Our cloud servers and database are in India (Mumbai). Your data is not stored outside India.
• Your data is stored first on your own device, so the app keeps working without internet. A copy is sent to our cloud for backup and for your other devices.
• Everything between the app and our cloud travels encrypted (HTTPS).
• Passwords and PINs are stored only as one-way hashes. Each restaurant can only reach its own data.
• Access to our servers is limited to our team, and every change our team makes to a restaurant's licence is recorded.

If something goes wrong

If there is ever a breach of personal data in our care, we will tell the affected restaurant owners without delay, with what happened, what it may mean for them and what we are doing about it, and we will report it to the Data Protection Board of India as the law requires.

7. How long we keep it

• While your licence is active, we keep your data so you can restore it at any time.
• After your licence ends, we keep it for 12 months so you can come back or ask for a copy, and then delete it, unless the law requires us to keep part of it longer.
• Records of your payments to us (invoices, amounts, dates) are kept for as long as tax and accounting laws require, even after the rest is deleted.
• Error reports are deleted 30 days after the error was last seen. Uploaded log files: we keep only the last few per device.
• Data on your own device stays there until you remove it. On Android, uninstalling the app removes it. On a Windows PC, uninstalling keeps the data folder (so a reinstall can carry on); delete that folder, or ask us to help. Uninstalling does not delete the cloud copy; ask us if you want that deleted.

8. Your choices and rights

Under India's Digital Personal Data Protection Act, 2023, you have these rights about your personal data:

• See and correct: you can see and change your restaurant's details, menu, staff and customer details in the app at any time.
• Get a copy: reports can be exported to Excel from the app, and you can ask us for a copy of your cloud data.
• Delete your account: DeviPOS accounts are created by our team, not in the app, and are deleted the same way. Call or WhatsApp 90165 53147 or email contact@devistack.com from the registered mobile or email, with the restaurant name. We confirm that the request comes from the registered owner, then delete the owner account and the restaurant's data from our cloud (owner details, restaurant details, menu, staff, bills, customer details and device records). Only records of your payments to us are kept, as section 7 explains. Uninstalling the app on Android removes the data on that device; on a Windows PC, the data folder also has to be deleted, and we can help.
• Withdraw consent: you can stop using DeviPOS and ask us to delete your data at any time. Data already used lawfully before that stays lawful.
• Nominate someone: you can name a person who may use these rights for you if you die or become unable to. Tell us their name and contact details using the details below.
• Complain: if you are not happy with our answer, you can complain to the Data Protection Board of India.
• Your customers: if a customer of your restaurant asks to have their details removed, your restaurant can edit or remove them, or ask us for help.

To make a request, contact us using the details below. Tell us your registered mobile number or email and the restaurant name, so we can find your account. We aim to reply within 7 working days, and always within 90 days, the longest the law allows.

You can ask for this policy in Hindi, Gujarati or another language listed in the Eighth Schedule of the Constitution of India.

9. Children

DeviPOS is a business tool for restaurants and their staff. It is not meant for children, and we do not knowingly collect data from children.

10. Changes to this policy

If we change this policy, we will update the date at the top. For important changes we will also tell restaurant owners in the app or by message before they apply.

11. Contact and grievances

For privacy questions, requests or complaints:

• Grievance Officer, DeviStack Technologies
• Email: contact@devistack.com
• Phone / WhatsApp: 90165 53147 (10 am to 7 pm, Monday to Saturday)

This policy is written to follow India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.