Privacy Policy

1. Who we are and in what role

FlowPOS is a point-of-sale and business management platform based in Guatemala. For any privacy matter, write to info@rpasolution.com; the details of the responsible company appear at the end of this page.

We process data in two distinct roles:

• As controller: data about people who contact us through the website, FlowPOS account holders and users, and what we need for billing and support.
• As processor: data that each business (the “Merchant”) enters about its own customers and staff — sales, invoices, customers, employees, payroll and attendance. The Merchant decides what it is used for; we process it only to provide the Service and on the Merchant's instructions. If you are a Merchant's customer or employee, contact the Merchant first.

2. What data we process

We ask only for what each purpose needs. Depending on how you interact with us:

• Website forms (demo, contact): name, email, WhatsApp or phone number, business name and type, number of locations, current system and your message. Optional fields can be left blank.
• Status page subscription: your email only.
• FlowPOS account: name, email, password (handled by Google Firebase; we never see it) or your Google account, and the version of the terms you accepted.
• Business details: trade name, tax ID (NIT), legal name, addresses, FEL certifier credentials (encrypted) and billing details.
• Data the Merchant enters about others (as processor): customers, products, sales, employees, salaries, attendance and personal identifiers. Sensitive HR identifiers are stored encrypted.
• Technical data: IP address, browser, device, error and activity logs needed for security and operation.
• Cookies and local storage: described in the Cookie Policy. Analytics and marketing cookies are only switched on with your consent.

• Cookie Policy

3. Why we use it and on what basis

4. Who we share data with

We do not sell or rent personal data. We share it only with providers that help us deliver the Service, under confidentiality and security obligations, and only as far as necessary:

• Google Cloud (hosting, database and files) and Google Firebase (sign-in).
• Cloudflare Turnstile (anti-spam check on forms).
• Chatwoot (sales and support conversation inbox).
• SendGrid and Mailchimp Transactional (email), and Twilio or other SMS and WhatsApp providers (messages the Merchant sends).
• Stripe (card payments, where applicable).
• Sentry (technical error logging).
• Google Maps (address search inside the app).
• FEL certifiers authorised by the SAT (issuing electronic tax documents).
• Google Analytics and Meta (only if you accept analytics or marketing cookies).
• Authorities, when a law or court order requires it.

5. International transfers

Several of these providers store or process data outside Guatemala, mainly in the United States. We choose providers with contractual data-protection commitments and, where applicable, standard contractual clauses.

6. How long we keep it

• Website requests: while useful to serve you and follow up commercially, or until you ask us to delete them.
• Account and business data: while the account is active and, afterwards, for the periods Guatemalan tax and commercial law require.
• Technical and security logs: as long as needed to investigate incidents, then deleted or anonymised.
• Data the Merchant enters: according to the Merchant's instructions; when the contract ends the Merchant can request export and deletion, except what the law requires us to keep.

7. Security

We use encryption in transit (HTTPS), encryption of credentials and sensitive identifiers, role-based access control, authentication managed by Google Firebase and activity logs. No system is infallible: if a breach affects your data, we will tell you without undue delay, along with the measures taken.

8. Your rights

Guatemala's Constitution (articles 24 and 31) recognises the right to know and correct information held about you in files and records. In addition, wherever you live, we offer you these rights:

• Access: know what data of yours we process and get a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Objection and restriction: object to processing or ask us to limit it.
• Portability: receive your data in a commonly used format.
• Withdraw consent at any time, without affecting what was done before.

9. How to exercise your rights

Write to info@rpasolution.com with your name, the email you signed up or contacted us with, and what you are asking for. We may ask you to confirm your identity. We reply within 30 days at most.

To withdraw cookie consent, use the “Cookie settings” button at the foot of any page. To stop receiving news, reply to any of our messages or write to us.

If you live in the European Union, the United Kingdom, Brazil or California, you can also complain to your country's or state's data-protection authority.

10. Minors

FlowPOS is a service for businesses and is not directed at people under 18. We do not knowingly collect data from minors; if you believe we have, write to us and we will delete it.

11. Automated decisions

We do not make decisions with legal or similarly significant effects on you based solely on automated processing.

12. Changes to this policy

If we change this policy materially, we will publish it here with a new date and, if you have an account, ask you to accept the new version before you continue using the Service.