Business identity: RushTech POS is developed and managed by Indrapal Singh Kohli, trading as RushTech POS. Where applicable and authorised, Haka Hospitality may support selected business verification, GST billing, and WhatsApp Business verification activities for RushTech POS. This partner arrangement does not transfer ownership of the RushTech POS brand, software, or customer/store data to Haka Hospitality.
1 Information We Collect
This policy applies to the RushTech POS website and hosted services, the RushTech POS Offline app (including optional cloud backup), the RushTech Online Order customer app, and the RushTech Store Owner app. We collect information needed to operate accounts, licences, orders, bookings, payments, delivery, support, backup, and security.
Personal Information:
- Name, email address, phone number, delivery address, saved addresses, and business name when applicable
- Account identifiers and authentication information, including Google account identifiers when Google Sign-In is used
- Billing and payment information when you subscribe to a paid plan
- Login credentials (passwords are stored in encrypted/hashed form)
Online Ordering & Delivery Data:
- Cart contents, orders, bookings, coupons, payment method, order notes, support messages, and order history
- Precise or approximate device location only when you choose current-location delivery; manual address entry remains available where supported
- Customer delivery coordinates, serviceable area, and pincode needed to calculate delivery eligibility and charges
- Documents or images you voluntarily attach to an order when a store enables document upload
- Push-notification tokens and app/device information used to deliver order, booking, payment, and support notifications
Business & Operational Data:
- Products, categories, inventory, and pricing data you enter into the system
- Sales, payments, purchases, expenses, suppliers, customer records, bookings, shifts, reports, and audit events managed through the POS or Store Owner app
- Employee/user accounts, role assignments, access permissions, store profile, GST and payment settings created within your POS account
- When a licensed offline POS user chooses cloud backup, the backup may contain the complete local POS dataset, including customer, supplier, transaction, inventory, audit, shift, store, device, and licence information
Technical Data:
- IP address, browser type, device information, and operating system
- Usage logs, access times, pages visited, and feature interactions
- Error logs and performance metrics for service improvement
2 How We Use Your Information
We use the information we collect for the following purposes:
- To provide, operate, and maintain the RushTech POS platform and services
- To process transactions, generate invoices, and manage your subscription
- To validate offline POS licences and, when requested, create, list, restore, or delete encrypted cloud backups
- To create and fulfil customer orders and bookings, contact customers about those requests, and coordinate delivery or pickup
- To calculate delivery eligibility and charges, provide address assistance, and show order-status updates
- To verify payments and payment status without storing full card, UPI PIN, CVV, or banking credentials in RushTech POS
- To send transactional push notifications about orders, bookings, payments, delivery, and support
- To personalise your experience and deliver relevant feature recommendations
- To communicate with you about account updates, support enquiries, and service notifications
- To send promotional communications (only with your consent; you can opt out at any time)
- To monitor, analyse, and improve platform performance, security, and reliability
- To comply with legal obligations and enforce our terms of service
Note: We will never sell your personal information to third parties for marketing purposes.
3 Data Storage & Security
We use technical and organisational safeguards appropriate to the nature of the service:
- Data exchanged with RushTech production services is transmitted using HTTPS/TLS
- Passwords are hashed using strong one-way hashing algorithms and are never stored in plain text
- Database access is restricted to authorised personnel and systems only
- New RushTech cloud-backup files are encrypted at rest using authenticated encryption; access is protected by the licensed device and a cloud PIN
- The Store Owner app encrypts its offline pending-order queue and disables Android cloud/device-transfer backup
The offline POS primarily stores operational data on the user's device. A local backup file exported by the user is under that user's control and should be stored and shared securely. Optional cloud backups and hosted-service data are processed on RushTech or its hosting providers' infrastructure. RushTech's current production hosting server is located in India, and hosting-provider backup copies may be stored in Singapore. No internet or storage system can be guaranteed completely secure.
4 Cookies & Tracking
RushTech POS uses cookies, app storage, session tokens, and similar technologies to provide secure authentication and app functionality:
- Essential Cookies: Required for authentication, session management, and core platform functionality
- Analytics Cookies: Help us understand how you use the platform so we can improve features and performance
- Preference Storage: Remembers selected stores and app preferences
- Secure App Storage: Customer and Store Owner session tokens use encrypted device storage. Android backup is disabled for the Online Order and Store Owner apps
You can manage cookie preferences through your browser settings. Please note that disabling essential cookies may affect platform functionality.
5 Third-Party Services
We may use trusted third-party service providers to support our operations:
- Razorpay: To securely process online payments. Razorpay may receive the amount, order reference, customer name, email, phone number, and payment transaction details required for checkout and fraud prevention.
- Google Sign-In and Firebase: For Google account sign-in and transactional push notifications. Google services may process account identifiers, notification tokens, and technical device information.
- Google Maps / Device Geocoding: To resolve delivery addresses when the user requests current-location or address-assistance features.
- Cloud Hosting: For reliable data storage and infrastructure
- Email Services: To deliver transactional and support-related communications
Third-party providers process data under their applicable terms and privacy policies. We aim to provide only the information needed for the requested service.
6 Data Sharing & Disclosure
We do not sell, trade, or rent your personal information to third parties. We may share data only in the following circumstances:
- Store fulfilment: The selected store and its authorised staff receive the customer and order details needed to prepare, contact, and deliver the order. The customer app does not display internally assigned rider identity or location.
- Service providers: Razorpay, Firebase, hosting, mapping, email, and notification providers receive only the data needed to provide their contracted service.
- Business store records: A subscribed store controls the customer, staff, supplier, booking, invoice, and POS records it enters or receives. RushTech hosts or backs up those records on the store's behalf where the relevant service is enabled.
- With your consent: When you explicitly authorise additional sharing
- Legal compliance: When required by law, regulation, court order, or government request
- Business transfers: In connection with a merger, acquisition, or sale of assets (with prior notice to you)
- Protection: To protect the rights, property, or safety of RushTech POS, our users, or the public
7 Your Rights
You have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you
- Correction: Request correction of any inaccurate or incomplete data
- Deletion: Request deletion of your personal data, subject to legal retention requirements
- Data Portability: Request your data in a structured, machine-readable format
- Withdraw Consent: Withdraw consent for marketing communications at any time
- Objection: Object to processing of your data for certain purposes
Online-order customers can update their profile and initiate account deletion from the app. RushTech removes or anonymises account-linked data that can be identified through the applicable account and store context. Historical orders, bookings, invoices, fraud/security records, or records independently controlled by a store may be retained or anonymised where required for accounting, tax, dispute, security, or legal purposes. Residual copies in protected system backups expire through the applicable backup-retention cycle.
You may submit an access, export, correction, consent-withdrawal, deletion, or grievance request through our privacy request page. Account deletion requests may also be submitted through the Google Play account deletion page. We will respond to verified requests within 30 days.
8 Data Retention
We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by law.
- Active Accounts: Data is retained while the account is active and as needed to provide ordering, booking, delivery, support, and POS services
- Location Data: Customer delivery coordinates are retained with the related order only as needed for delivery eligibility, fulfilment, dispute handling, and fraud prevention
- Uploaded Order Documents: Retained while needed to process the order and according to the selected store's legal or operational requirements
- Closed Accounts: Account-linked personal data is deleted or anonymised after a verified closure request, subject to store-controlled records, technical backup cycles, disputes, security requirements, and legal retention
- Transaction Records: Financial and transaction records may be retained for up to 7 years for tax and regulatory compliance
- Offline POS Cloud Backups: Up to the 10 most recent active backups are retained for a licensed client; older active versions are pruned and users can delete listed backups in the app
- Store Owner Offline Queue: Pending or failed orders remain on the device until synced; successfully synced queue entries are retained for up to 7 days
- Cloud Backup Security Events: Hashed backup-security event records are retained for up to 180 days
9 Children's Privacy
RushTech POS business services and the RushTech Online Order app are intended for adults and are not directed at children under 18. We do not knowingly collect personal information from children. If we learn that a child has provided personal data, we will take reasonable steps to delete it.
10 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make significant changes:
- We will update the "Effective Date" at the top of this page
- We may notify you via email or through an in-app notification
- Continued use of RushTech POS after updates constitutes acceptance of the revised policy
We encourage you to review this page periodically to stay informed about how we protect your data.
11 Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us: