Thaja POS Privacy Policy

Effective date: 31 October 2026

This policy explains what personal data the Thaja POS app collects, why we collect it, who we share it with, how long we keep it, and the rights you have.

Thaja POS is provided by ICON Tech & Ecom Services Ltd ("Thaja", "we", "us"). You can reach us about privacy at support@thaja.africa.

1. Who this policy is about

People who use the app: shop owners, admins, managers and cashiers. For your account and the records of your work, Thaja is the data controller.
A shop's customers: people whose details a shop enters at the till. For those details the shop is the data controller, and Thaja processes them on the shop's behalf. If you're a customer with a question about your details, ask the shop first; we'll help the shop answer.

2. What we collect

What	Examples	Where it comes from
Account details	Your name, email address and password. We store your password only as a secure hash, never in readable form.	You, when you create an account
Store and staff details	Store and branch names; staff names and roles; staff PINs, stored only as hashes	Owners and managers
Customer details	Customers' names, phone numbers and, optionally, email addresses	Staff, at the till
Sales and refunds	Items, amounts, discounts, how the customer paid (cash, card or transfer), who made the sale, on which till, and when; refund details and reasons	Created as you sell
Products and stock	Product names, photos, options, SKUs, barcodes, prices, tax, stock counts and notes	Owners and staff; Zoho Inventory, if connected
Cash drawer records	Opening amounts, cash put in or taken out and why, counts at closing	Staff
Photos	Product photos you take with the camera or choose from your photo library	You, only the photos you pick
Till identifiers	A random key the app creates for each phone that becomes a till, plus the till's name and branch. It isn't your phone's advertising identifier.	The app
Security and activity records	Sign-ins, wrong PIN attempts, manager approvals and sync status; technical data our servers receive with each request, such as IP address	The app and our servers

What we don't collect:

your location;
the contacts in your phone's address book;
health data;
card numbers or bank details (a card payment is only recorded as "card");
your browsing history;
your phone's advertising identifier.

The app contains no advertising or analytics tools, and we don't track you across other companies' apps or websites.

The camera is used only to scan barcodes and to take product photos. Barcodes are read on the phone itself. We don't keep or send what the camera sees, apart from the product photos you choose to save.

3. Why we use it

To provide the service, under our agreement with you and your shop:
- creating your account and setting up tills;
- recording sales, refunds and the cash drawer;
- keeping stock and printing receipts;
- keeping your Thaja store, and Zoho Inventory if you connect it, up to date;
- sending account emails such as email confirmation and password reset.
To keep the service secure and prevent fraud (our legitimate interest):
- locking a PIN after repeated wrong attempts;
- holding unusual offline sales for an owner to review;
- limiting repeated sign-in attempts;
- investigating misuse.
To meet legal obligations: keeping business records where the law requires it, and answering lawful requests from authorities.
With your permission: iOS asks before the app can use the camera or your photo library. You can change this at any time in the iPhone's Settings.

We don't sell personal data or use it for advertising. We don't make decisions about you that have legal or similarly significant effects by automated means alone. An unusual offline sale is held for a person to review; it isn't refused automatically.

4. Data kept on your phone

So the app can keep selling without an internet connection, it keeps some data on the phone:

the product list, staff names, recent sales and the cash drawer;
sign-in keys, in the iPhone's secure keychain;
data for signing in offline, which is encrypted with the staff member's PIN.

Sales made offline are sent to Thaja when the phone is back online.

5. Who we share it with

Service providers that run Thaja for us. They work under contracts that require them to protect the data and use it only for us:
- Render (servers, United States);
- Neon (database, United States);
- Cloudflare (storage for product photos);
- Resend (account emails);
- Upstash (protection against repeated sign-in attempts);
- Vercel (Thaja's web pages, such as the password-reset page).
Zoho Inventory, only if a shop connects its own Zoho account. We then send the shop's sales, refunds and stock changes to Zoho and receive its products and stock. Zoho's own privacy policy covers the data held in Zoho.
Your shop. A store's owners and managers can see that store's sales, staff activity and customers.
Authorities, when the law requires it, or to protect people's rights and safety.
A buyer or successor, if Thaja is merged or sold. This policy would continue to apply to your data.

6. Data stored outside Nigeria

Our servers and database are in the United States, so your data is transferred there from Nigeria, or from wherever you use the app. Some of our providers also work in other countries.

We protect these transfers with each provider's data processing terms, which require them to keep personal data secure and to use it only to provide their service to us.

7. How long we keep it

Account details: while your account exists. We delete them when you delete your account, except anything the law requires us to keep.
Store records (sales, refunds, cash drawer, stock): while the store exists on Thaja, and after that for 6 years where tax or business-record laws require it.
Customer details: until the shop removes them or closes its store.
Security and activity records: 12 months.

8. Deleting your account

In the app: More → Delete account, or Delete account under the list of your stores. By email: write to support@thaja.africa from your account's email address.
What happens: we delete your login and your personal account details. The store and its business records (sales, refunds, stock) stay with the store, so the business and its other staff can carry on; your name may remain on past sales you made. If you're the store's only owner and want the whole store deleted, email us.
Staff who sign in only with a PIN: an owner or manager can turn off your sign-in in More → Manage → Staff. To have your details removed, ask the shop, or email us.

9. Your rights

Under the Nigeria Data Protection Act 2023 you can ask us to:

give you a copy of your personal data;
correct data that's wrong;
delete your data;
limit or stop some uses of it;
send your data to you, or to another service, in a common format;
stop any use of your data that relies on your permission.

To do any of this, email support@thaja.africa. We'll reply within 30 days.

If you're unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

A shop's customers should make these requests to the shop; we'll help the shop answer them.

10. How we protect your data

All traffic between the app and our servers is encrypted (HTTPS).
Passwords and PINs are stored only as hashes.
Offline sign-in data is encrypted on the phone.
What each person can see and do depends on their role: owner, admin, manager or cashier.

No system is perfectly secure. If you notice a security problem, tell us at support@thaja.africa. If a data breach affects you, we'll tell you and the Nigeria Data Protection Commission as the law requires.

11. Children

Thaja POS is a tool for businesses. It isn't meant for anyone under 18, and we don't knowingly collect children's personal data.

12. Changes to this policy

We'll post any change here with a new effective date. If a change is significant, we'll also tell you in the app or by email.

13. Contact us

ICON Tech & Ecom Services Ltd
Email: support@thaja.africa