Privacy Policy
Last updated October 27, 2026
Your business records. Clear boundaries.
This notice explains what information we process, why it is needed, when it is shared, and how to contact us about your rights. It applies alongside our Terms and Conditions.
Product references and private store records are different. XenoPOS Catalog may use product titles, descriptions, photos and identifiers so other stores can find product references. Your prices, costs, stock quantities, sales and customer records are not included in that catalogue contribution.
1. Who is responsible for your information?
XenoPOS is provided by AckerWorx, a company registered in the United Kingdom. This notice covers the XenoPOS website, web POS, supported applications, shared catalogue and support services that link to it. Contact us through our contact form or the support portal about privacy questions. Our correspondence address is 71–75 Shelton Street, London, England WC2H 9JQ.
AckerWorx is based in the United Kingdom. Where applicable, we process personal information in accordance with UK data protection law, including the UK GDPR and the Data Protection Act 2018. Other data protection laws may also apply depending on the people, businesses and processing involved.
We determine the purposes of processing for our own account administration, billing, security, communications and shared catalogue operations. For customer and staff records that a merchant enters to run its business, the merchant generally decides the purposes and we process that information to provide the service on its behalf. The applicable roles depend on the activity and law; a required data-processing agreement is separate from this notice.
If you are a customer or employee of a store using XenoPOS, contact that store first about its records, loyalty programme, receipts or staff timecards. We assist the responsible merchant with requests where appropriate.
2. What information do we collect?
Account and business information: owner and staff names, email addresses, contact details, store names and addresses, country, account roles, preferences and authentication information. The information required for a feature is indicated when it is collected. Without required account details, we may be unable to provide access or fulfil your request.
Store records: products, descriptions, photos, identifiers, prices, costs, stock movements, orders, payment records, customer contact and loyalty details, and staff activity or timecards where the merchant uses those features. Merchant records can contain personal information even when used for business purposes.
Billing and support: subscription and invoice details, payment status and provider references, support messages and attachments, and records of assistance. Payment providers collect the payment credentials needed for their checkout; this notice does not claim that XenoPOS routinely collects or stores full card numbers or security codes.
Technical information: IP addresses, browser and device details, application versions, device identifiers, connection and authentication events, diagnostic information and security logs. Connected devices may send status information for device management and troubleshooting.
We receive information from you, authorised staff and merchants, devices, connected services and payment providers as needed for the features used. We do not describe unrelated social-media, advertising or data-broker sources as routine collection.
3. Why do we use information?
We use information to create and secure accounts, provide sales and inventory functions, process staff and customer records for the merchant, synchronise supported devices, manage subscriptions, send service messages, respond to support requests, detect misuse, resolve disputes and fulfil legal obligations.
We also use the limited product reference material described below to operate XenoPOS Catalog. Improving the Services does not make your private merchant records public. Any optional marketing communication is subject to the choices and requirements applicable to it.
4. What legal bases apply?
Where a lawful basis is required, we rely on performance of a contract to provide account services you request; legal obligations for required accounting, regulatory or disclosure duties; and legitimate interests, where permitted and balanced against your rights, in securing the platform, preventing misuse, troubleshooting and administering the service.
Where consent is required for a particular optional use or device permission, we request it for that use. You may withdraw consent without affecting the lawfulness of earlier processing. Accepting terms or continuing to use a website is not blanket consent for every use of personal information.
When we process merchant-controlled customer or staff records on the merchant’s behalf, the merchant is responsible for its lawful basis and notices. Product content that contains personal information remains subject to applicable privacy law; a copyright licence does not remove those requirements.
5. XenoPOS Catalog and product contributions
XenoPOS Catalog is a shared product reference library. Other XenoPOS stores can search for available product information by barcode or name and use it when adding their own products. It helps reduce repeated entry of the same product information; it is separate from a store’s private inventory and transaction records.
We may contribute product titles or names, descriptions, product photos, variant labels included in product names, and barcodes or equivalent identifiers from products you add or update. Photos may be copied into catalogue-managed storage. Contributions are enabled by default and can apply to Free / Lite, trial and paid stores. Buying a paid plan does not itself opt a store out; this notice does not promise a self-service contribution switch.
Not included in the store contribution: your selling prices, purchase costs, stock quantities, sales or transaction records, customer information, or your store’s brand and category assignments. These exclusions concern the contribution to the catalogue; we still process such records as needed to operate your private store functions.
Contributor store and user identifiers and contribution dates may be retained for authorised staff administration and provenance. Those attribution fields are not displayed in store-facing catalogue results. Your own text or photos may identify people or your business, so do not include confidential notes, personal details or content you cannot lawfully share in product-reference material.
Approved catalogue content may be available to other stores, and they may retain product references they have imported. Contact us about inaccurate, identifying or infringing material. We assess correction, removal and privacy requests under the applicable law and rights; removing a source record does not automatically recall copies already supplied to other stores.
The limited permission for product material is described in section 10 of the Terms and Conditions. It does not authorise unrestricted use of private business or personal records.
7. Support access and account security
Support staff may access account information needed to investigate your request. Where a support session provides access to a store, it is subject to the service’s access controls and audit records. Keep passwords, staff PINs, device access and recovery details secure and review staff permissions.
When you open Help & Support from your store, authentication information may be passed to the support service to sign you in and associate your request with your store. Do not put passwords, full payment-card details or unnecessary customer records in support messages.
9. Device permissions and diagnostics
Permissions depend on the application and feature you use. Supported features may request camera access for barcode scanning or product photos, and Bluetooth or location-related system permissions needed to discover nearby hardware. A platform permission needed for hardware discovery is not a statement that XenoPOS continuously tracks your precise location.
Device status and diagnostics may include identifiers, software and hardware information, connectivity and performance information. Some diagnostic collection depends on device settings and permissions. Review the app’s explanations and your operating-system controls; declining a permission may prevent the associated feature from working.
Do not upload sensitive personal information unless it is needed for a lawful, supported business purpose and the necessary safeguards are in place. We do not make the blanket claim that no sensitive information could ever be processed: merchant records, free text and attachments can contain it.
10. How long is information kept?
Retention depends on the purpose and type of record, the account relationship, merchant instructions, legal accounting and record-keeping duties, security or dispute needs, and the handling of backups. We retain personal information only while there is an applicable purpose or legal requirement, then delete, anonymise or restrict it as appropriate.
A report-history window is a plan access limit, not a deletion schedule or guarantee of indefinite retention. Account cancellation, store closure, deletion of an individual record and subscription cancellation are different actions. Contact us about the applicable retention and deletion arrangements for your account.
This notice does not promise that all information disappears immediately or within three months of termination. Records subject to legal obligations and backups may require different handling. Catalogue entries and references already imported by other stores are addressed in the catalogue section.
11. Where is information processed?
Information may be processed in countries where AckerWorx, its service providers and the relevant merchant operate. The service arrangement determines the hosting and processing locations. We do not present an unverified fixed list of hosting countries as applicable to every account.
Where required, transfers of personal information are subject to appropriate safeguards and applicable law, such as contractual protections or another valid transfer mechanism. Use of the Services does not by itself waive transfer protections. Contact us for the locations and safeguards relevant to your account, especially if you require location-specific processing.
12. How is information protected?
We use access controls, authentication, store access boundaries and security logging to help protect information. Security and recovery measures must be appropriate to the relevant service and applicable law. No online system is completely secure, and we do not guarantee that every incident can be prevented.
If an incident affects personal information, we assess it and notify the responsible merchant, affected people or authorities where required by applicable law. Contact us promptly about suspected unauthorised access. This notice does not replace your business’s own security and incident-response duties.
13. Your privacy rights
Depending on your location and the applicable law, you may have rights to be informed, access your personal information, correct it, request deletion or blocking, object to or restrict processing, receive portable information, withdraw consent, and complain to a regulator. Rights have conditions and exceptions; not every right applies to every processing activity.
For merchant-controlled records, contact the store responsible for the information first. For information AckerWorx controls, use the contact routes below. We may need proportionate information to verify your identity or authority. We respond within the deadlines required by the applicable law and explain any lawful limits.
You can raise a complaint with the UK Information Commissioner’s Office, or another competent privacy authority where applicable. You do not have to complain to us first to exercise a statutory right.
14. Children and merchant records
XenoPOS business account registration is intended for adults with authority to act for their business. We do not direct registration or marketing at children. If you believe a child has supplied account information improperly, contact us.
A merchant may hold information about younger customers or staff under its own lawful obligations. The merchant remains responsible for the required notices, age-related safeguards and lawful processing; an adult-only account rule does not mean merchant records can never contain a minor’s information.
15. Communications and your choices
We send operational messages about accounts, security, billing and support as needed to provide the Services. Any marketing messages must follow applicable law and include an appropriate way to stop them. Stopping marketing does not prevent necessary service messages.
Use the available account, browser and device controls for preferences. Where you cannot change something yourself, contact us. We do not treat a browser preference signal as a substitute for a consent control or legal right that the service must support.
16. Planned Store Community Stock Selling
We are exploring an optional feature to help participating stores connect about surplus stock and possible store-to-store purchases. It is not currently implemented or available. This notice describes no existing community stock-trading data flow.
Any future participation, visible information, location use, communication or trading arrangements would be explained before the feature is used, with the choices and permissions required by law. Contributing product references to XenoPOS Catalog does not itself authorise publishing your private stock, costs or sales, joining a trading scheme, or committing you to a transaction. Internal design and commercial details are not part of this notice.
17. Changes to this notice
We may update this notice as the service or applicable requirements change. We will update the revision date and provide notice of material changes as required by law. A new notice does not retroactively remove rights or turn an unrelated processing purpose into consent.
18. Contact and privacy requests
Send privacy questions or requests through our contact form or support portal, stating that the request concerns privacy. Identify the relevant store or account where possible, but do not send passwords or unnecessary sensitive information.
AckerWorx correspondence: 71–75 Shelton Street, London, England WC2H 9JQ. If you are acting for someone else, explain your authority. Contact the relevant merchant for its customer or employee records; we can help route a request where appropriate.