Privacy Policy — Mobile POS Application

Last updated: April 22, 2026

This policy describes how InnoLogiciel Inc. (“InnoBooks”, “we”) collects, uses, shares and retains personal information when you use the InnoBooks POS mobile application (point of sale and bookkeeping).

1. Data controller

InnoLogiciel Inc., a company incorporated in Quebec, Canada. For any question or request regarding your personal data, contact [email protected].

2. Nature of the application

InnoBooks POS is an application for businesses and self-employed professionals to process payments, issue receipts and invoices, and maintain bookkeeping compliant with Canadian and Quebec tax requirements. It is not intended for consumers or minors.

3. Data we collect

3.1 Account holder data

  • Identity: first name, last name, email address
  • Authentication: password (stored in hashed form only), one-time code sent by email (two-factor authentication), session tokens, Google or Apple credentials when signing in via a third-party provider
  • Internal identifier: a unique numeric ID generated by our servers to associate your account with your operational data

3.2 Operational data you enter

  • Items and services, prices, taxes, inventory
  • Orders, invoices, receipts and transaction history
  • Information about your customers that you choose to enter: name, phone number, email address (these fields are optional)

3.3 Technical data

  • Location permission (Android): required by the operating system to allow Bluetooth Low Energy scanning for Stripe card readers. The application does not read, store or transmit any geographic coordinates.
  • Bluetooth permission: used exclusively to communicate with certified Stripe payment terminals
  • No advertising ID, no Advertising ID, and no analytics tracker is collected

4. Purposes of use

Your personal information is used only to:

  • Create and manage your account, authenticate you securely
  • Provide point-of-sale, invoicing and bookkeeping functionality
  • Process payments through our certified partners
  • Transmit sales records to the Government of Quebec as required by the Sales Recording Module (MEV), where applicable
  • Send receipts and notifications related to your operations (email, SMS, push notifications)
  • Communicate with you for technical support, account security and material changes to the service
  • Comply with our legal and tax obligations (Income Tax Act of Canada, Tax Administration Act of Quebec, Act respecting the protection of personal information in the private sector, known as Law 25)
  • Detect and prevent fraud, abuse and unauthorized access

We never sell your personal information and do not use it for advertising purposes.

5. Third-party sharing

Information is shared only to the extent necessary to deliver the service, with the following third parties:

5.1 Stripe, Inc. (United States)

  • Data transferred: merchant name, internal user identifier (as metadata), transaction details, business postal code (for tax calculation)
  • Purpose: card payment processing (Stripe Terminal), fraud prevention (Stripe Radar), automatic tax calculation (Stripe Tax)
  • Card numbers are processed directly by the Stripe terminal and never transit through our servers or the application

5.2 Twilio Inc. (United States)

  • Data transferred: recipient phone number, SMS content including customer name
  • Purpose: delivery of text-message receipts when requested

5.3 Google LLC (United States)

  • Google SMTP (Gmail): recipient email address and email content for delivery of receipts, notifications and authentication codes
  • Firebase Cloud Messaging: push notification metadata (may include user identifier, customer name and phone number)
  • Google Sign-In: if you choose to sign in with your Google account, Google transmits your name and email address to us

5.4 Apple Inc. (United States)

If you choose to sign in with Apple, Apple transmits to us an account identifier and, if you authorize it, your name and an email address (real or private relay).

5.5 Government of Quebec — Revenu Québec

For businesses using our certified Sales Recording Module (SRM / MEV), transaction data is transmitted to the Government of Quebec in accordance with the Tax Administration Act (RLRQ c A-6.002). This data is retained and managed by Revenu Québec under its own policies. InnoBooks has no authority to request its deletion.

5.6 Hosting provider

Our application servers are hosted by OVH SAS in their data centers located in Canada.

5.7 Government authorities

We may disclose information to competent authorities when a law, court order or valid legal process requires it.

6. Retention period

  • Profile and authentication data: until account closure, then 30 days after a deletion request
  • Invoices, receipts and transaction records: 6 years, as required by the Income Tax Act (Canada) and the Tax Administration Act (Quebec). This data is dissociated from your profile where possible, but cannot be deleted before the end of the legally mandated retention period.
  • Data transmitted to Revenu Québec via the SRM (MEV): retained according to the policies of the Government of Quebec, outside our control
  • Stripe data: retained by Stripe in accordance with its PCI-DSS and anti-money-laundering obligations

7. Security

  • Encryption in transit: TLS 1.2+ required for all network communication. Cleartext HTTP traffic is blocked at the operating-system level (Android Network Security Config, iOS App Transport Security).
  • Encryption at rest: passwords are stored in hashed and salted form only. Sensitive secrets on the device are stored in the system’s secure keystore (iOS Keychain / Android Keystore).
  • Two-factor authentication: a one-time code is emailed on every sign-in from a new device.
  • Restricted access: only a limited number of authorized InnoLogiciel employees may access the data, and only for technical support or operations.
  • Monitoring and backup: firewalls, audit logs and regular backups.

8. Your rights

Under Quebec’s Law 25 and applicable privacy legislation, you have the right to:

  • Access your personal information
  • Correct any inaccurate or incomplete information
  • Request deletion of your account and data not subject to legal retention: Account deletion request
  • Withdraw consent for optional processing of your data
  • Lodge a complaint with the Commission d’accès à l’information du Québec (CAI) if you believe your rights have not been respected

To exercise a right, write to [email protected]. We respond within 30 days.

9. Children

InnoBooks POS is not intended for persons under 13 years of age. We do not knowingly collect data from minors. If we learn that an account was created by a minor, we will close it without delay.

10. International transfers

Some of our providers (Stripe, Twilio, Google, Apple) process data outside Canada, primarily in the United States. These companies apply recognized safeguards (standard contractual clauses, certifications, etc.) that meet Canadian and Quebec requirements.

11. Changes

This policy may be updated. The date at the top of the page indicates the latest version. Material changes will be communicated to you by email or by in-app notification.

12. Contact

For any question regarding this policy or your personal data: InnoLogiciel Inc. Email: [email protected]