DGEN POS
Privacy Policy
Version 2026-10-07 · Last updated October 7, 2026
This Privacy Policy explains how DGEN Technologies Corp. ("DGEN", "we", "us") collects, uses, shares and protects personal information when you use DGEN POS: the admin dashboard at admin.shaunsaini.com, the point-of-sale app at pos.shaunsaini.com, and the emails we send about your account (together, the "Service").
We are a Canadian company. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, British Columbia's Personal Information Protection Act (PIPA). Effective: [EFFECTIVE DATE]. Each section starts with a plain-language summary; the full text is what applies.
1. Who this policy covers
In short: Two kinds of people: merchants and their staff (you deal with us directly), and merchants' customers (the store you shopped at is responsible for your information; we hold it for the store).
Merchants and staff. If you own, manage or work at a business that uses the Service, we collect your personal information directly and we are the organization responsible for it.
Merchants' customers. If you shopped at a store that uses the Service, the store collected your information for its own purposes (for example receipts, loyalty or age verification). The store is the organization responsible for that information. We process it only on the store's instructions, as its service provider, and this policy describes how we handle it. For questions about how a store uses your information, contact the store; you can also contact us and we will help route your request.
This policy does not cover the practices of other companies, such as Stripe or Google, even when you reach them through the Service. Their own privacy policies apply.
2. What we collect
In short: Account and business details, staff records, the customer and sales records a store enters, technical logs, and support messages. We never see or store full card numbers.
Account and business information: your name, email address, password (stored only as a one-way hash), phone number, role, the business name, store addresses, time zone, industry, licence details for regulated stores, and, if you sign in with Google, the email address, name and profile picture Google shares with us.
Signup details: the information you enter before your first payment (kept for 24 hours if you do not complete checkout), the marketing source that brought you to us (UTM parameters), and your acceptance of these documents, including the version accepted, the time, and the network address and browser used.
Staff information entered by the merchant: names, email addresses, phone numbers, roles, staff PINs (stored only as a one-way hash), clock-in and clock-out times, and, if the merchant chooses to record it, an hourly wage.
Customer records entered by the merchant: name, nickname, email address, phone number, address, date of birth, loyalty points, store credit, notes and, for regulated stores, medical or membership details the merchant records. When a store scans a government ID to look up a customer, the barcode is decoded on the till to find the matching customer record; the Service does not keep the scanned barcode data.
Sales and transaction data: orders, line items, taxes, tips, discounts, refunds, till counts and payment records. For card payments we keep the amount, the status and the references Stripe returns (such as the card brand and last four digits). Card numbers go directly to Stripe's readers and forms; we never receive or store them.
Technical and usage data: sign-in events; API requests (the endpoint, timing, status, and the account and store involved); the network address and browser used; audit-trail entries for actions taken in an account; error reports; feature-usage events; and device details for enrolled POS and kiosk devices.
Support and communications: messages you send us, the details you enter if you book a call with us, and delivery records of the emails we send (recipient, event type, status).
3. How we use it
In short: To run the Service for you, bill you, keep it secure, support you, meet legal duties and improve it. We do not sell personal information or use it for advertising.
- Provide the Service: create and manage accounts, process orders, print and email receipts, sync tills and devices, and show reports.
- Billing: charge subscription fees through Stripe, count each month's completed sales against your plan's monthly sales figure (never to stop a sale), and send billing notices (payment failures, grace periods, renewals, a month over your plan's figure).
- Security and integrity: authenticate users, enforce roles, rate-limit requests, keep audit trails, detect abuse, and investigate incidents.
- Support: answer your questions and troubleshoot problems.
- Legal and regulatory: keep the records the law requires, respond to lawful requests, and help merchants meet their own record-keeping duties.
- Improvement: understand, in aggregate, how features are used so we can fix problems and plan changes. We do not use personal information to train artificial-intelligence models, and we do not use it for third-party advertising.
We rely on your consent (given at signup and when you enter information), on the need to perform our agreement with you, and on purposes a reasonable person would consider appropriate in the circumstances, as PIPEDA and PIPA allow. Where consent is the basis, you may withdraw it, subject to legal or contractual restrictions; withdrawing may mean we can no longer provide parts of the Service.
5. Where your information is stored
In short: Our servers and database are in Canada. Three providers process information outside Canada: Stripe (payments), Sentry (error reports) and Google (sign-in, our email and call booking). You acknowledge the payment, error-report and sign-in transfers at signup.
Our application, database, queues, secrets and email delivery run in AWS's Canada (Central) region, and the web apps' server functions run in Vercel's Montreal region. Your account, staff, customer and transaction records are stored in Canada.
Some information leaves Canada: Stripe processes payments and billing globally, including in the United States; Sentry receives error reports in the United States; and Google processes sign-in, the email you exchange with us and the calls you book with us in its global infrastructure. While information is outside Canada it is subject to the laws of that country, including lawful access by its authorities. We use providers that commit to data processing terms with security, confidentiality and breach-notification obligations comparable to what PIPEDA requires. The consent box at signup includes an acknowledgement of the payment, error-report and sign-in transfers (PIPEDA Principle 4.1.3; BC PIPA section 34).
6. How long we keep it
In short: For as long as your account is active, then a wind-down period so you can get a copy, then deletion, except records the law says we must keep (tax, audit, regulated-retail records).
Account, staff, customer and transaction records: for the life of the merchant account. After an account is closed we keep the data for [RETENTION PERIOD AFTER ACCOUNT CLOSURE — operator to confirm] so the merchant can request a copy, then delete or de-identify it, except where we must keep it longer for legal, tax or regulatory reasons (for example provincial regulators' record-keeping rules for cannabis and liquor sales).
Incomplete signups: deleted 24 hours after they are started if checkout is not completed.
Audit trails, billing records and acceptance records: kept for the life of the account and for the period the law requires afterwards, because they prove what happened and who agreed to what.
API metering records and rate-limit counters expire automatically after a fixed period (90 days for metering). Error reports are kept for the retention period configured with Sentry.
Browser storage on your devices (see "Cookies and browser storage"): kept until you sign out, clear your browser, or un-enrol the device.
7. How we protect it
In short: Encryption in transit, hashed passwords and PINs, role-based access, audit trails and no card numbers on our systems. If a breach ever creates a real risk of significant harm, we tell you and the Privacy Commissioner.
- Encryption in transit (HTTPS) for every connection between the apps, the API and our providers.
- Passwords and staff PINs are stored only as one-way hashes. Sign-in tokens expire (access tokens after one hour, refresh tokens after 24 hours).
- Role-based access: owners, admins, managers and cashiers see and do only what their role allows, and every account is scoped to its own organization.
- Audit trails of changes to accounts, settings, orders and payments, including who made them and from where.
- No card numbers: payment card data goes directly to Stripe, which is PCI DSS certified. We store only what Stripe returns.
- Access to production systems is limited to the people who need it to run the Service.
No system is perfectly secure. If a breach of security safeguards involving personal information under our control creates a real risk of significant harm, we will notify the affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and the merchant concerned so it can meet its own obligations, as soon as feasible, and we will keep a record of the breach.
8. Your rights and choices
In short: You can ask what we hold about you, correct it, withdraw consent, or have it deleted. Email our privacy officer; we answer within 30 days, and you can complain to the Privacy Commissioner if you are not satisfied.
- Access: ask for a copy of the personal information we hold about you and how we have used and shared it.
- Correction: ask us to fix information that is inaccurate or incomplete. Merchant owners and admins can edit staff and customer records in the dashboard.
- Withdraw consent: you may withdraw consent for uses that rely on it, subject to legal or contractual restrictions.
- Deletion: ask us to delete your information, subject to records we must keep.
- Marketing: we send only service and billing emails; we do not send marketing email to merchants or their customers.
To exercise a right, contact our privacy officer at [PRIVACY OFFICER CONTACT]. We will verify your identity and respond within 30 days (PIPEDA allows an extension in limited cases, and we will tell you if we need one). We will not charge a fee unless the law allows it and we tell you first.
If you are a merchant's customer, we may direct your request to the merchant, because it is the organization responsible for your information, and we will help it respond.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in British Columbia, to the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca).
10. Children
In short: The Service is for businesses. We do not knowingly collect information from anyone under the age of majority, and regulated stores must check age.
The Service is intended for businesses and their adult staff. We do not knowingly collect personal information from anyone under the age of majority in their province. Merchants selling age-restricted products must verify age before completing a sale. If you believe we hold information about a minor that we should not, contact our privacy officer and we will delete it.
11. Changes to this policy
In short: We version this policy by date. Material changes get notice, and may need to be accepted again.
Each version of this policy is identified by its date at the top of the page. If we make material changes, we will notify merchants by email to the account owner or by a notice in the dashboard before the change takes effect, and may ask an owner or admin to accept the new version. The version you accepted, and when, is recorded in your account.
12. Contact and privacy officer
In short: Our privacy officer handles questions, requests and complaints.
Privacy officer: [PRIVACY OFFICER CONTACT]
DGEN Technologies Corp.
[REGISTERED ADDRESS]
General support: rachit@1humanos.com