Privacy Policy

This Privacy Policy explains what information Innobrains Technologies ("Innobrains", "we", "us" or "our") collects when you use BooksPOS, our software for book depots, stationers and school uniform sellers. It also explains how we use and protect that information and the choices you have. It applies to the BooksPOS website, BooksPOS Cloud and the owner portal, the Cloud edition, the Offline edition, the BooksPOS Windows app and the BooksPOS Owner app (together, the "Service"), and should be read with our Terms & Conditions.

1. Who is responsible for your information

• Your account and billing information: Innobrains Technologies decides how this is used and is responsible for it.
• Your shop's records: the shop decides what is recorded about its customers, staff, suppliers and stock. On the Cloud edition we store and process the records your store PCs send, on the shop's behalf and only to provide the Service.

2. Information we collect

Information you give us

• Account: your name, mobile number, email address and business name. Your password is stored only as a one-way hash, never in readable form. If you turn on two-step sign-in, its secret and your recovery codes are stored encrypted.
• Staff accounts: the name, email address and role of each person you invite to the owner portal.
• Billing: your plan, invoices, and the payment details and proofs you upload, such as a bank transfer receipt.
• Communications: messages you send us through the contact form (name, email, optional phone and business, topic and message), support tickets, email or WhatsApp.

Information collected automatically

• Store PCs and licences: for each PC paired with your account, its name, the BooksPOS version, when it was paired and last seen, and the licence grants it fetched. We use these to run your licence and to show you which PCs are connected.
• Security log: sensitive actions on your account (such as pairing codes created, PCs revoked, password resets and two-step sign-in changes) with the time, IP address and browser.
• Website visits: the cookies needed to run the site (section 9), and what the contact form records to answer you and to stop abuse: your IP address and browser description.

3. Data from your store PCs

BooksPOS keeps your shop's records on your own store PC. What a store PC sends to BooksPOS Cloud depends on the edition.

• A paired store PC sends the changes it records, such as sales and returns with their items, amounts and dates, and the customer or supplier references in them. The cloud keeps them to show you reports such as daily sales per branch.
• Stock, khata, purchases and expenses (Cloud edition). A store PC on the Cloud edition also sends, every few minutes when something changed, how much of each item it holds and its value; each customer's and supplier's name, code, phone number and balance (what they owe or are owed, advances, credit limit, the date of the oldest unpaid bill and of the last payment), never a CNIC, address or notes; and its purchases, supplier returns, expenses by category, khata recoveries and supplier payments as daily totals. The cloud keeps them to show them to you in the owner portal and the Owner app. The Offline edition sends none of it.
• The day book (Cloud edition). From BooksPOS 1.1.0, a store PC on the Cloud edition also sends its chart of accounts (each account's code, name and type) and, once, every entry of its books (the journal): the entry's number, business date and time, the kind and number of the document it came from, its memo, and each line's account and amount, with the customer's or supplier's name on a line that is theirs. A memo holds what the posting wrote: a customer's or supplier's name, a document number, and the reason or payee a member of staff typed for a void, a return, a stock adjustment, a stock count, an expense or an opening-balance correction. Never sent: a CNIC, phone number or address, a customer's or supplier's notes, a document's notes, or who posted the entry. The cloud keeps them to show you the day book and profit and loss. The Offline edition sends none of it.
• Offline edition. The store PC is activated with BooksPOS Cloud and checks its licence and for updates when it is online. It sends no business data to the cloud.
• FBR details. If you switch on FBR POS integration, the NTN, FBR POS ID and related settings are kept on the store PC, and the owner portal shows each branch's FBR settings and how many invoices are waiting. The FBR access token is entered on the store PC and stays there.
• Your shop's records stay on your store PC as well; the cloud does not replace them.
• Crash reports. When BooksPOS hits a problem it did not expect, the PC notes what went wrong in the program: the BooksPOS, Windows and .NET versions, the screen, the error and where in the code it happened, and how often. Customer and supplier names, phone numbers, addresses, passwords, PINs, tokens and pairing codes are taken out on the PC before anything is kept. A paired store PC sends these reports to the BooksPOS team only while the owner allows it (Settings › System & updates, "Send crash reports to the BooksPOS team"; on unless the owner turns it off), never on the Offline edition; otherwise they stay on the store PC. We keep them for 90 days after the problem was last seen, to find and fix bugs.

4. How we use information

• To provide the Service: signing you in; storing and showing the figures your store PCs send; delivering licences and updates; and running the features you switch on, such as the Owner app.
• To manage your account: reviewing new accounts, running trials, invoicing, verifying payments, managing licences and paired PCs, and handling refunds.
• To support you: answering questions and solving problems. Where needed, this may include looking at your account with your knowledge.
• To protect the Service: security monitoring, and preventing fraud, trial misuse and licence sharing.
• To communicate: sending service emails and notices, such as password resets, invitations, replies to your messages, and notices about your account and important changes.
• To improve BooksPOS: using crash reports, from which customer details are removed before they leave your PC.
• To meet legal obligations: for example tax and accounting record keeping, and lawful requests from authorities.

We do not sell personal information, and we never use your shop's records for advertising.

5. Your customers', staff and suppliers' information

When your shop records information about its own customers, staff or suppliers, the shop decides what is recorded and why. The shop is responsible for having a lawful basis to do so and for telling those people where required. We use such information only to provide the Service to your shop. We never contact your customers or suppliers, and we never share their information for anyone else's use.

6. Where your information is stored

• On your store PC: in both editions, the shop's records are kept on the shop's own main PC, which you control. BooksPOS takes backups on that PC; keeping a copy somewhere else, such as a USB drive, is up to you.
• Cloud edition: what your store PCs send is stored on servers used by us to run the Service. Inside the database, each business's records are kept separate from every other business's, and database rules enforce this.
• Offline edition: your records stay on your own computer. Only licence check-ins and update checks reach us.
• Our servers and service providers may be located in Pakistan or in other countries. Wherever your information is processed, we protect it as this policy describes.

7. Who we share information with

• Service providers: hosting, content delivery and security, and email delivery providers. They process information only to provide their services to us, under obligations to protect it.
• The Federal Board of Revenue: only if you switch on FBR POS integration, and then your store PC sends FBR the invoice information FBR requires, directly.
• Authorities: when the law, a court or a competent authority requires it, or to protect the rights and safety of our customers, the public or us.
• A successor business: if BooksPOS or Innobrains is transferred to another business, your information may be transferred with it. It remains protected by this policy.

8. Access by our team and how we protect information

• Access by our team: only authorised Innobrains staff can access account information, to provide support, verify payments, keep the Service secure or meet legal obligations. Access is limited by role, two-step sign-in is required for our own administrators, and what our staff do to an account is recorded.
• Encryption in transit: connections to BooksPOS Cloud use encrypted HTTPS. Extra tills reach the store PC over the shop network through an encrypted connection and a one-time pairing code.
• Sign-in protection: passwords are hashed, and two-step sign-in is available for owners.
• Separation and permissions: each business's data is kept separate, and each person in the owner portal and on the till has a role that limits what they can see and do.
• Signed licences and updates: licences and updates are signed, so a store PC accepts only a genuine licence and installs only a genuine BooksPOS update.

No system is perfectly secure. If we learn of a security incident affecting your information, we will tell you without undue delay and explain what we are doing about it.

9. This website and cookies

• No trackers. The site uses no analytics, advertising or social media scripts, and loads no fonts or scripts from other companies. The website can load Google Analytics only if we switch it on in its settings; it is off, and this policy will say so before it is ever switched on.
• Cookies. A session cookie and a security token that protects forms, both needed for the contact form and for signing in; and, only if you tick "Keep me signed in", a cookie that keeps you signed in. Pages that only show content are sent without them.
• Crawlers. For automated crawlers that name themselves (search engines, AI assistants, link previews), we count which public pages they read each day, by the name in their user-agent. Nothing is stored about people's visits.

10. How long we keep information

• While you have an account: account information and the records your store PCs sent are kept while your account exists, including after a trial or plan ends, so that you never lose them.
• After a deletion request: when you ask us to close your account, we delete your account and its cloud records within 30 days. We keep only what the law requires, such as invoices and payment records for tax and accounting. Copies in any backups are removed as those backups are replaced.
• Crash reports: these are deleted 90 days after the problem was last seen.
• On your store PC: the records stored on your own computer stay under your control.

11. Your rights and choices

You can view, print and export your records from BooksPOS on your store PC at any time. You may also ask us:

• for a copy of the personal information we hold about you;
• to correct information that is wrong;
• to delete your account and its cloud records, subject to section 10.

To make a request, email info@innobrains.pk from your registered email address, or use the contact form. We may need to verify your identity, and we reply within 30 days. If your request concerns a shop's records about you, for example as its customer, please contact that shop. We will help the shop respond.

12. Children

The Service is meant for businesses and is not directed at children. We do not knowingly collect children's information for our own use. Information a shop records about its customers is handled as described in section 5.

13. Changes to this policy

We may update this policy from time to time. The date of the latest update is shown below, and we will tell you in the owner portal or by email about important changes.

14. Contact

For any question or request about your information:
Innobrains Technologies, Jhang Road, Opposite Madina Hotel, Athara Hazari, Jhang, Punjab 35180, Pakistan.
Email: info@innobrains.pk