Privacy Policy

1. Who we are and our role

MOLOS POS provides a point of sale and business management service. For account, billing and website data, we decide how the data is used and act as the data controller.

When a business uses MOLOS POS to record data about its own customers and employees, that business is the data controller and we process the data on its behalf and on its instructions. If you are a customer or employee of a business that uses MOLOS POS, please contact that business first about your data.

2. Data we collect

• Account data: name, email address, mobile number and password. Passwords are never stored in plain text.
• Google sign-in data: if you choose Sign in with Google, Google sends us your name, email address and a Google account ID. We store the ID only as a one-way code so we can recognise your account, and we never receive your Google password or access your Gmail, contacts or files. An existing account is connected to Google automatically only when Google hosts that email address (Gmail or Google Workspace); otherwise the account password is required first. If your account has a password, you can disconnect Google at any time in Security settings. Google handles the sign-in itself under its own privacy policy.
• Business data: business name, branches, addresses and map coordinates, tax ID and receipt settings.
• Data you record: products, orders and payments, customer details such as name, phone, email, address and points, supplier contacts, and employee records such as identity number, bank account, salary, schedules and leave.
• Attendance data: check-in and check-out times, GPS location, distance from the branch, address and photo, when a business uses attendance.
• Billing data: subscription invoices and payment status. Card and bank details are handled by our payment partner and are not stored by us.
• Technical data: IP address, browser and device information, and activity logs used for security and troubleshooting.

3. How we use data

• Provide and operate the Service, including sign-in, permissions and plan limits.
• Process subscription payments and send invoices and service notices.
• Provide support and respond to your requests.
• Protect accounts, detect abuse and keep audit records.
• Improve reliability and features using aggregated information.
• Meet legal, tax and regulatory obligations.

We do not sell personal data, and we do not use the data you record for advertising.

4. Legal basis

We process personal data in line with Indonesia's Personal Data Protection Law (Law No. 27 of 2022): to perform our agreement with you, to meet legal obligations, for legitimate interests such as security and fraud prevention, and with consent where the law requires it. Businesses that record attendance locations and photos are responsible for obtaining any consent needed from their staff.

5. Sharing

We share personal data only when it is needed:

• Payment partners that process subscription payments, and the providers you connect yourself, such as Xendit, Midtrans or DOKU, for your own sales.
• Infrastructure providers that host and back up the Service under confidentiality and security obligations.
• Authorities, when required by law or a valid legal request.
• A successor business, if MOLOS POS is merged, acquired or transferred, which must keep protecting the data under this policy.

6. Security

Sensitive data encrypted, including contact details, identity numbers, bank details and payment keys. Access is limited by role and branch, each business is isolated from the others, and important actions are recorded in an audit log. No system is completely secure, so if a breach affects your personal data we will notify you and the relevant authority as the law requires.

7. Retention

• Account and business data is kept while your account is active.
• After a subscription ends, data is kept for at least 90 days so you can renew, and may then be permanently deleted.
• Technical request logs are kept for a short period, normally 7 days.
• Invoices and records we must keep for tax or legal reasons are kept for as long as the law requires.
• Deleted data may remain in backups for a limited time until those backups are replaced.

8. Cookies and local storage

We use essential cookies only, to keep you signed in securely. Your browser also stores preferences such as theme, language, selected branch and easy mode. We do not use advertising or third-party tracking cookies.

9. Your rights

Under Indonesian law, you have the right to:

• know how your personal data is used, and access and get a copy of it;
• correct data that is inaccurate or incomplete;
• ask us to stop processing, delete or destroy your data, subject to legal requirements;
• withdraw consent where processing is based on consent;
• object to decisions made only by automated processing;
• receive your data in a commonly used format to move it elsewhere.

Many details can be viewed, corrected or exported directly in the dashboard. For other requests, email [email protected]. We may need to verify your identity first, and we respond within the time the law requires.

10. Data location and transfers

If personal data is stored or processed outside Indonesia, we make sure it receives a level of protection equal to or higher than Indonesian law requires.

11. Children

MOLOS POS is intended for businesses and is not directed at children. We do not knowingly create accounts for anyone under 18.

12. Changes to this policy

We may update this policy. For material changes, we will notify account owners by email or in the dashboard before they take effect. The date at the top shows when it was last updated.

13. Contact

Questions or requests about your personal data can be sent to [email protected]. See also our Terms & Conditions.