Software made in Québec · Data hosted in Canada · Support from the Québec team

Privacy Policy — Mobile POS Application

Last updated: October 18, 2026

This policy describes how InnoLogiciel Inc. (“InnoBooks”, “we”) collects, uses, shares and retains personal information when you use the InnoBooks POS mobile application (point of sale and bookkeeping).

1. Data controller

InnoLogiciel Inc., a company incorporated in Quebec, Canada. For any question or request regarding your personal data, contact [email protected].

2. Nature of the application

InnoBooks POS is an application for businesses and self-employed professionals to process payments, issue receipts and invoices, and maintain bookkeeping compliant with Canadian and Quebec tax requirements. It is not intended for consumers or minors.

3. Data we collect

3.1 Account holder data

  • Identity: first name, last name, email address
  • Authentication: password (stored in hashed form only), one-time code sent by email (two-factor authentication), session tokens, Google or Apple credentials when signing in via a third-party provider
  • Internal identifier: a unique numeric ID generated by our servers to associate your account with your operational data

The application does not create accounts: accounts are created on innobooks.net. A Google or Apple sign-in with an address that has no InnoBooks account is refused.

3.2 Operational data you enter

  • Items and services, prices, taxes, inventory
  • Orders, invoices, receipts and transaction history
  • Information about your customers that you choose to enter: name, phone number, email address (these fields are optional)
  • The name of the employee who makes each sale; in Quebec, the journal of till actions required by MEV-WEB (items added or removed, price changes, printing errors)
  • Item photos (stored)
  • Shopping list: items, quantities, notes, prices and promotions. The photo of a list, flyers and supplier price lists (photo, PDF, Excel or CSV) are read by Google’s artificial intelligence (see 5.3), then discarded: only the lines you confirm are saved
  • Synced notes and reminders (title, text, due date); note photos and videos stay on the device

3.3 Technical data

  • Location (Android and iOS): Stripe Terminal requires the device location (precise or approximate) to accept a card payment, to prevent fraud; on Android it is also used to find Bluetooth readers. Stripe’s module sends it to Stripe; our servers do not receive it. Refusing it only blocks card payments.
  • Bluetooth permission: used exclusively to communicate with certified Stripe payment terminals
  • Crash reporting: when the application closes unexpectedly, the technical stack trace, the device model, the operating system version and a Firebase-generated installation identifier are sent to Google (see 5.3). No name, email address, phone number or sales data is attached.
  • Camera: barcodes are read on the device and the images never leave it. On Android, the Google ML Kit module that reads them sends anonymous diagnostics and an installation identifier to Google (see 5.3).
  • Tablet identifier: a random identifier created by the application, sent with its version and platform to the company’s tablet registry (number of tablets allowed).
  • Microphone: the application does not record audio; dictation goes through the device keyboard.
  • No advertising ID, no Advertising ID, and no analytics tracker is collected

4. Purposes of use

Your personal information is used only to:

  • Create and manage your account, authenticate you securely
  • Provide point-of-sale, invoicing and bookkeeping functionality
  • Process payments through our certified partners
  • Transmit sales records to the Government of Quebec as required by the Sales Recording Module (MEV), where applicable
  • Send receipts and notifications related to your operations (email, SMS, push notifications)
  • Communicate with you for technical support, account security and material changes to the service
  • Comply with our legal and tax obligations (Income Tax Act of Canada, Tax Administration Act of Quebec, Act respecting the protection of personal information in the private sector, known as Law 25)
  • Detect and prevent fraud, abuse and unauthorized access

We never sell your personal information and do not use it for advertising purposes.

5. Third-party sharing

Information is shared only to the extent necessary to deliver the service, with the following third parties:

5.1 Stripe, Inc. (United States)

  • Data transferred: merchant name, internal user identifier (as metadata), transaction details, business postal code (for tax calculation)
  • Purpose: card payment processing (Stripe Terminal), fraud prevention (Stripe Radar), automatic tax calculation (Stripe Tax)
  • Card numbers are processed directly by the Stripe terminal and never transit through our servers or the application

5.2 Twilio Inc. (United States)

  • Data transferred: recipient phone number, SMS content including customer name
  • Purpose: delivery of text-message receipts when requested

5.3 Google LLC (United States)

  • Google SMTP (Gmail): recipient email address and email content for delivery of receipts, notifications and authentication codes
  • Firebase Cloud Messaging: push notification metadata (may include user identifier, customer name and phone number)
  • Google Sign-In: if you choose to sign in with your Google account, Google transmits your name and email address to us
  • Firebase Crashlytics: application crash reports (stack trace, device model, operating system version, Firebase installation identifier and the company identifier of the account), used solely to diagnose and fix failures
  • Google ML Kit (Android): anonymous barcode-scanning diagnostics and an installation identifier

5.4 Apple Inc. (United States)

If you choose to sign in with Apple, Apple transmits to us an account identifier and, if you authorize it, your name and an email address (real or private relay).

5.5 Government of Quebec — Revenu Québec

For businesses using our MEV-WEB compliant Sales Recording Module (SRM / MEV), transaction data is transmitted to the Government of Quebec in accordance with the Tax Administration Act (RLRQ c A-6.002). This data is retained and managed by Revenu Québec under its own policies. InnoBooks has no authority to request its deletion.

5.6 Hosting provider

Our application servers are hosted by OVH SAS in their data centers located in Canada.

5.7 Government authorities

We may disclose information to competent authorities when a law, court order or valid legal process requires it.

5.8 Anthropic, PBC (United States)

  • Claude (artificial intelligence): photos, PDF, Excel or CSV files and texts you submit in the shopping list, and item texts to translate, to extract the lines or translate them; we do not keep these files

6. Retention period

  • Profile and authentication data: until account closure, then 30 days after a deletion request
  • Invoices, receipts and transaction records: 6 years, as required by the Income Tax Act (Canada) and the Tax Administration Act (Quebec). This data is dissociated from your profile where possible, but cannot be deleted before the end of the legally mandated retention period.
  • Data transmitted to Revenu Québec via the SRM (MEV): retained according to the policies of the Government of Quebec, outside our control
  • Stripe data: retained by Stripe in accordance with its PCI-DSS and anti-money-laundering obligations

7. Security

  • Encryption in transit: TLS 1.2+ required for all network communication. Cleartext HTTP traffic is blocked at the operating-system level (Android Network Security Config, iOS App Transport Security).
  • Encryption at rest: passwords are stored in hashed and salted form only. Sensitive secrets on the device are stored in the system’s secure keystore (iOS Keychain / Android Keystore).
  • Two-factor authentication: a one-time code is emailed on every sign-in from a new device.
  • Restricted access: only a limited number of authorized InnoLogiciel employees may access the data, and only for technical support or operations.
  • Monitoring and backup: firewalls, audit logs and regular backups.

8. Your rights

Under Quebec’s Law 25 and applicable privacy legislation, you have the right to:

  • Access your personal information
  • Correct any inaccurate or incomplete information
  • Request deletion of your account and data not subject to legal retention: sign in at app.innobooks.net, open your profile, then choose “Delete my account” (30-day grace period, then anonymization)
  • Withdraw consent for optional processing of your data
  • Lodge a complaint with the Commission d’accès à l’information du Québec (CAI) if you believe your rights have not been respected

To exercise a right, write to [email protected]. We respond within 30 days.

9. Children

InnoBooks POS is not intended for persons under 13 years of age. We do not knowingly collect data from minors. If we learn that an account was created by a minor, we will close it without delay.

10. International transfers

Some of our providers (Stripe, Twilio, Google, Apple) process data outside Canada, primarily in the United States. These companies apply recognized safeguards (standard contractual clauses, certifications, etc.) that meet Canadian and Quebec requirements.

11. Changes

This policy may be updated. The date at the top of the page indicates the latest version. Material changes will be communicated to you by email or by in-app notification.

12. Contact

For any question regarding this policy or your personal data: InnoLogiciel Inc. Email: [email protected]