Privacy Policy

Last updated: 22 October 2026

This policy explains what personal data Retail Carrera (“we”, “us”) handles, why, and the choices you have. It covers this website and the RetailCarrera point-of-sale and retail management service (the “Service”), including the web app and the desktop app.

This website

• Contact form. The form doesn’t send anything to us by itself. It opens your own email app with a message to us that includes the name, phone number and business name you typed. We only receive those details if you send that email, and we use them to reply to you and to set up your account.
• No tracking cookies. This website doesn’t use advertising or analytics cookies.
• Fonts. Typefaces are loaded from Google Fonts, so your browser connects to Google, which receives your IP address.

Data in the Service

When a business (“merchant”) uses RetailCarrera, the Service stores:

• Account data about the merchant’s staff: names, email addresses, roles, sign-in history, and the IP addresses and devices used to sign in (used for security and the session monitor).
• Business data: products, stock, sales, payments, receipts, accounting records, salaries and leave.
• Customer data the merchant chooses to collect, for example loyalty members’ names, phone numbers and email addresses, and the email address a receipt or invoice is sent to.

Who decides. For their staff’s and customers’ data, the merchant decides what is collected and why; we process it on the merchant’s behalf to provide the Service. Merchants are responsible for telling their customers how their data is used.

How we use data

• To run, secure and support the Service, including backups, fraud and abuse prevention, and fixing errors.
• To send the emails and text messages the Service sends: receipts, invoices, one-time codes and alerts.
• To contact merchants about their account, billing and changes to the Service.

We don’t sell personal data, and we don’t use it for advertising.

Service providers

We use providers to run the Service, and they process data only on our instructions:

• Hosting: Railway (servers and database) and Cloudflare (web app delivery).
• Email: Amazon Web Services (Amazon SES).
• Text messages: the SMS provider the merchant configures.
• AI product entry: OpenAI, which receives the product photos and text you submit to that feature.
• Desktop app crash reports: BugSplat.

Retention

• Account and business data is kept while the merchant’s account is active.
• After an account closes, we delete it on request, except records we must keep by law, such as financial records.
• Sign-in records (IP addresses and devices) are kept only as long as they’re needed for security.

Security

• Data is encrypted in transit.
• Access is limited by role-based permissions.
• Passwords are stored as one-way hashes.

No system is perfectly secure; if a breach affects your data, we’ll tell you without undue delay.

Your rights

You can ask us for a copy of your personal data, ask us to correct or delete it, or object to how we use it. If your data is held by a merchant that uses RetailCarrera (for example as a loyalty customer), contact that merchant first; we’ll help them respond.

Contact

Questions or requests: [email protected].

We’ll post changes to this policy on this page and update the date above.