Who we are
Octopus POS (business details) makes the POS apps for Windows and Android tablets, the kitchen display, the Octopus Manager website and this site. For any question about your data, write to contact@octopus-pos.com or call +212 694-995225.
The short version
- Your sales data is saved first on your own device, in a local database.
- With the Pro edition it is also copied to our servers over an encrypted connection, so every POS and Octopus Manager see the same data.
- No advertising, no analytics, no tracking. The apps, Octopus Manager and this site contain no third-party analytics or crash-reporting tools.
- We never sell your data, or your customers’ data.
On your device
Each POS — a Windows computer or an Android tablet — keeps its data in a local database (SQLite) on the device itself: products, sales, customers, staff and settings. This is what lets it keep selling without internet.
With the Standard edition your data never leaves the shop. It stays on the POS and only travels over the shop’s own network, to the kitchen display and the waiters’ tablets.
To stay signed in, the app keeps a sign-in token (a JWT) in its own storage on the device. Signing out removes it. You are responsible for the device itself: who uses it and keeping it safe. Sales that have not synced yet exist only on that device.
On our servers (Pro edition)
When a POS is online it sends new sales and changes to our API (api.octopus-pos.com) and receives the changes made elsewhere. The connection is always encrypted (HTTPS/TLS).
Our servers are rented from OVHcloud (OVH SAS) and are located in France, in the European Union — a destination Moroccan law recognises as protecting personal data adequately. OVHcloud stores the data for us and may not use it for anything else. Passwords, PIN codes and staff card codes are stored as hashes — never in plain text.
What we collect
- Your account: business name and contact details; the owner’s and staff members’ names, email addresses and roles; password, PIN and card hashes.
- Your devices: a device identifier, its name and app version — to apply the number of POS on your plan and offer updates.
- The business data you enter: products, prices, stock, sales, payments, bookings, and your own customers’ details (for example a name, a phone number and loyalty points).
- Demo requests: what you type in the form (business name, phone, optional email, activity, message) and your IP address. It reaches us as an email; it is not stored in a database.
- Server logs: IP address, time and page requested, for security and troubleshooting. Kept 31 days.
We do not ask for anything else. The only required fields on our forms are the ones we need to answer you.
Your customers’ data
For the data you record about your own customers and staff, your business is responsible for it (the “controller”) and we only process it on your behalf, to run the service. You need a lawful reason to record it and must answer your customers’ requests about it — we help you do that.
Why we use it
- To provide the service you signed up for (our contract).
- To keep accounts and the service secure (legitimate interest).
- To answer a demo request you sent (your consent, given with the box on the form).
- To send service messages, such as notice of a planned update. You can ask us to stop them at any time; each notice has a link for it.
- To meet legal obligations, such as keeping invoices.
Who else sees data
- OVHcloud — hosts our servers, this website and Octopus Manager.
- Our email provider — carries the emails we send (demo requests, password resets, update notices).
- jsDelivr — delivers Octopus Manager’s layout files, so it sees your IP address when a page loads. It receives no account data.
- WhatsApp (Meta) — only if you choose to chat with us there.
- Authorities — only when the law obliges us.
Nobody else: no advertisers, no data brokers, no analytics companies.
How long we keep it
- Account and business data: while your account is open, then 30 days so you can export it, then erased.
- Invoices we issue to you: 10 years, as Moroccan accounting law requires.
- Demo requests: up to 12 months after our last exchange.
- Server logs: 31 days.
Your rights
Under Moroccan law 09-08 — and the GDPR for visitors from the European Union — you can ask to see, correct or erase your data, or object to how it is used. Use the data deletion page or write to contact@octopus-pos.com. We answer within 30 days.
You can also complain to the CNDP (Commission nationale de contrôle de la protection des données à caractère personnel) in Morocco, or to the data protection authority of your country.
Children
Octopus POS is a tool for businesses. It is not made for children, and the forms on this site are for people aged 18 or over acting for a business. We do not knowingly collect children’s data.
If a shop records a child as a customer, the shop must first get the consent of a parent where the law requires it. If you think we hold a child’s data, write to us and we will erase it.
Changes to this policy
If we change something that matters, we update the date at the top and email account owners before the change applies.