Privacy Policy

This Privacy Policy explains how Winixlabs Software Solutions ("we", "us", or "our") collects, uses, stores, and protects information when you use the WiPOS point-of-sale application and website (collectively, the "Service"). By using WiPOS, you agree to the practices described in this policy.

1. Information We Collect

We collect information necessary to provide and improve the WiPOS Service. This includes:

Account information	Your name, email address, and password when you register for WiPOS.
Business information	Your business name, address, registration number, and contact details that you enter into the application.
Staff (employee) information	If you set up staff accounts, we store each employee's name and assigned role. Staff PINs are never stored in readable form; only a salted, one-way hash used to verify login.
Your customers' information	If you use the optional Customer CRM add-on, the name, phone number, and any notes you choose to record about your own customers are stored so you can look them up across your devices. If you don't use this add-on, we don't collect this information.
Product and inventory data	Product names, prices, categories, variants, stock levels, and product images that you upload or create within WiPOS.
Transaction data	Sales records, payment methods, amounts, receipts, and related transaction information processed through WiPOS.
Diagnostic and crash data	If the app crashes, or if you use the "Troubleshoot" feature to send a log, we collect a short snapshot of recent on-device activity and any crash stack trace, together with your device identifier, app version, and the name/email of whoever sent it (plus any notes you add). If a device repeatedly fails to sync, the app may send this same diagnostic snapshot automatically, without you tapping anything, so we can spot connectivity or sync problems; this never includes your customers' personal details, only technical log lines and, where relevant, internal record IDs (e.g. an invoice number) to help us trace the issue.
Usage data	How you interact with the application, feature usage patterns, device type, operating system version, and app version, used to improve the Service.
Device identifiers	Your device's Android ID, used to associate your account with your authorised device, route sync and push notifications, and enforce device limits. This identifier survives app reinstalls but changes if the device is factory-reset.

2. How We Use Your Information

We use the information we collect solely to operate and improve WiPOS:

Provide the WiPOS Service	Process transactions, sync data to the cloud, generate reports, and display your business data across your devices.
Maintain and secure your account	Authenticate logins, protect against unauthorised access, and enforce subscription validity.
Provide customer support and fix bugs	Respond to enquiries sent via WhatsApp or email, and diagnose technical issues using the diagnostic/crash data described in Section 1.
Send important service communications	Subscription renewals, security notices, or changes to this policy. We do not send unsolicited marketing emails.
Improve the Service	Analyse anonymised usage patterns to fix bugs and develop new features.

We do not sell, rent, or trade your personal information or your customers' transaction data to any third party.

3. Data Storage and Security

Your data is stored on Amazon Web Services (AWS) cloud infrastructure in the Singapore region (ap-southeast-1). All data is:

Encrypted in transit using TLS (Transport Layer Security).
Encrypted at rest using AES-256 encryption.
Isolated per business using database row-level security, so each business can only access its own records.

Cross-border transfer. Because our servers are in Singapore, your data is transferred outside Malaysia. Singapore has its own Personal Data Protection Act offering protection comparable to Malaysia's, and our hosting providers process your data only on our behalf under data processing terms.

A local copy of your data is also stored on your Android device to allow the application to function when the internet is unavailable. Sales are saved on the device first and uploaded to the cloud when a connection is available. This local data is protected by your device's own security mechanisms (PIN, biometrics, or pattern lock).

While we take commercially reasonable steps to protect your information, no method of electronic storage or transmission is 100% secure. We encourage you to use a strong passcode on your device and keep your WiPOS login credentials confidential.

We handle personal data in accordance with Malaysia's Personal Data Protection Act 2010 (as amended by the Personal Data Protection (Amendment) Act 2024).

For a plain-language overview of how WiPOS protects your data, see our Security & Data page.

4. App Permissions

WiPOS only requests the Android permissions it needs to run specific features, and asks for each one at the point you use that feature:

Camera	To scan a pairing QR code when connecting a Satellite device to your Main device (multi-counter Hub add-on) and to display QR codes for DuitNow payments. Photos and video are processed on-device and are not recorded or uploaded.
Photos/Storage	To let you pick an existing photo as a product image.
Bluetooth	To connect to a Bluetooth receipt printer.
Wi-Fi state	To discover and connect Main/Satellite devices on your local network for multi-counter Hub.
Notifications	To show sync and hub-status alerts.

WiPOS does not request access to your location, contacts, microphone, SMS, or call log, on any device.

5. Data Sharing

We share your data only in the following limited circumstances:

Service providers	We share data with our cloud hosting, database and storage providers, whose servers are located in Singapore, as sub-processors to deliver the Service. These providers process data only on our behalf under data processing terms.
Payment processing	If you use the DuitNow QR payment feature, your payment gateway account details are used to generate payment requests directly with our third-party payment gateway partner; your shopper pays the gateway/your bank directly, and we never receive or store card or bank account details. Your own WiPOS subscription is billed through Stripe's hosted checkout page; your card details are entered directly with Stripe and never pass through our systems or database.
Push notifications	We use Firebase Cloud Messaging (Google) to deliver sync and status notifications to your registered devices, using a device push token.
Legal requirements	We may disclose information if required by Malaysian law, a court order, or other legal process, or to protect the rights, property, or safety of WiPOS, our users, or the public.
Business transfers	In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

We do not share your data with advertisers, marketing platforms, or data brokers.

6. Your Transaction Data and Your Customers

WiPOS processes sales transactions on behalf of your business. The sales records, customer-facing receipt data, and payment logs entered into WiPOS belong to you and are stored in your account.

By default, WiPOS does not collect your shoppers' personal information (such as their names) or payment card details — it records the transaction amounts and payment methods you log, not the identity of the individuals purchasing from your store.

If you choose to enable the optional Customer CRM add-on, you may record your own customers' name, phone number, and notes so you can look them up across your devices. That information is entered and controlled by you, and you are responsible for having a lawful basis (such as your customer's consent) to collect and store it, in accordance with Malaysia's Personal Data Protection Act 2010.

If you use the MyKasih reference number logging feature, you are responsible for handling those reference numbers in accordance with applicable Malaysian data protection requirements.

7. Data Retention

We retain your account data and transaction history for as long as your WiPOS subscription is active. If you choose not to renew your subscription:

Your account and data remain accessible until the end of your paid period.
After expiry, your data is retained for a further 90 days to allow for reactivation or export.
After 90 days post-expiry, your data may be permanently deleted from our servers.

You may request deletion of your data at any time by contacting us at the address below.

8. Your Rights

You have the right to:

Access	Request a copy of the personal information we hold about you.
Correction	Request that we correct inaccurate or incomplete information.
Deletion	Request that we delete your account and associated data, subject to any legal retention obligations.
Portability	Export your transaction and product data in Excel (.xlsx) format directly from within the WiPOS application at any time.

To exercise any of these rights, contact us using the details in Section 10. We will respond to requests within 30 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through an in-app notice. Continued use of the Service after changes take effect constitutes your acceptance of the revised policy.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us:

Winixlabs Software Solutions

202603160766 (PG0589332-H)

Bandar Bukit Puchong, 47100 Puchong, Selangor, Malaysia

Email: info@wipos.cc