Privacy policy

This policy explains how Colossus Investments Limited, which provides Zero POS (“we”, “us”), handles personal data for its own purposes. For that data, we are the controller.

It covers the owners and teams of the businesses that use Zero POS, visitors to this website, and anyone who writes to us.

It does not cover what a shop records in Zero POS about its own customers and team. The shop decides that, so the shop is the controller, and we handle it only on the shop’s behalf: see Shops’ customers and teams.

For anything about privacy, write to info@zerolines.life.

About the businesses that use Zero POS, and the people who have accounts in them:

• the business’s name, country, currency, time zone and tax settings, given when its workspace is opened;
• each person’s name, email address, role, the shops they work in and the language they choose, and, where given, a username, phone number and photo;
• how each person signs in: their password, which we keep only as a one-way hash that cannot be turned back into the password, and any passkeys they save, of which we hold only the public part;
• when each person last signed in, and the workspace’s activity history: who made each change that matters, and when;
• for anyone who turns on notifications, the address their browser gives us for sending notifications to that device, and which browser it is.

About visitors to this website:

• the technical details every browser sends when it asks for a page, such as its IP address and which browser it is, which our host uses to deliver the page and to protect the website from abuse;
• how quickly pages load, and the anonymous visit count, both described in Cookies and measurement.

About people who write to us: your name and email address, what you write, and our replies.

About people who leave their details in one of this website’s forms (to ask a question, to have their products imported, or to be reminded before the founding rate closes):

• your name and email address and, if you give them, your business’s name, a phone number, the type of business, how many shops it has and your message;
• what you asked for, the page the form was on and the language you used, and the country your connection comes from, as our host tells us;
• the first of this website’s pages you arrived on and the site that sent you there, if your browser kept them (see Cookies and measurement);
• whether you ticked a box to receive our news, or only the founding-rate reminder, with when you did and the wording you agreed to.

We hold no card or bank details. Nothing is billed during early access, and when a shop takes a card payment, it does so on its own card terminal: Zero POS only records that the sale was paid by card, and how much.

We use personal data only for the purposes below. Data protection law requires a legal basis for each, and we give ours.

To provide Zero POS: opening and running workspaces, signing people in, and sending the emails the service needs, such as email verification, password resets, and the reports and notices people choose to receive. Legal basis: our contract with the business that uses Zero POS and, for the people in its team, our legitimate interest, and the business’s, in giving them the accounts it asks for.

To keep Zero POS secure: keeping each workspace’s activity history, looking into misuse, and slowing down repeated sign-in attempts and repeated requests to public pages such as the booking page, using the IP address they come from and, for sign-in, the account. Legal basis: our legitimate interest, and that of the businesses that use Zero POS, in protecting the service and the data in it.

To answer the details left in this website’s forms: replying to your question, by email or by phone if you gave a number, importing your products if you asked us to, and following up on what you asked. Legal basis: steps you ask us to take before any contract, and our legitimate interest in answering the people who contact us. News and the founding-rate reminder go only to people who ticked the box for them. Legal basis: your consent, which you can withdraw at any time.

To answer you and help: replying to messages, and helping with a workspace when asked. Legal basis: our legitimate interest in answering the people who contact us and, for the businesses that use Zero POS, our contract with them.

To find and fix faults, and keep pages fast: error reports and page timings. Legal basis: our legitimate interest in a service that works well.

To keep workspace owners informed: for example about changes to prices or to these documents, and before any first bill. Legal basis: our contract with the business.

To meet legal obligations, such as keeping accounting records, and to establish, exercise or defend legal claims. Legal basis: legal obligation, and our legitimate interest.

Where we rely on legitimate interest, we have weighed it against your rights, and you can object: see Your rights.

We do not sell personal data, we do not use it for advertising, and we make no decisions about anyone based solely on automated processing.

This website sets no cookies, and it loads no advertising or analytics trackers. Everything on it, fonts and pictures included, comes from our own address.

To know which pages are read and what brings people here, each page of this website and of the help centre, once it is on screen, sends one small message to our own address with only these: the page’s address, with nothing after a “?” but the help centre’s language; the name of the site whose link you followed, not the page it was on; any campaign tags in the link you followed (utm_source, utm_medium, utm_campaign); your browser’s language; and whether the screen is phone-, tablet- or computer-sized. Our host adds the country the connection comes from. We add one to a few daily totals and keep nothing else: no cookie, nothing stored on your device, no identifier, no IP address. The IP address is used only for a moment, in memory, to stop one machine from inflating the totals. Nothing is sent from a browser that asks not to be tracked (Global Privacy Control or Do Not Track), or from a device signed in to Zero POS. Legal basis: our legitimate interest in knowing which pages help.

To see how fast pages load, this website and the app use Vercel Speed Insights. A small script, served from our own address, measures how quickly each page loads and responds to taps and clicks, and sends those timings to our host, Vercel, which records them with the kind of device, browser and connection, the country and the page’s address — with anything that could identify a shop, a record or a person taken out first: the workspace’s name, record numbers, private links and anything after a “?”. It sets no cookies, and we use it only to see how fast pages are, never to recognise anyone.

The sign-in button at the top of this website’s pages, and the button at the end of each help guide, check whether this device already has Zero POS workspaces saved on it and, if so, offer “Open Zero POS” instead; the same check, when you click a link into the app, keeps a device that uses Zero POS at this address on it. On the home page at zeropos.shop, a short script checks whether Zero POS is running as an installed app and, if so, opens the app instead of the website. These checks happen on the device, and nothing is sent.

This website also remembers, in your browser’s own storage on your device, the first of its pages you arrived on and the site that sent you there (as zpos_first_touch). That record is not sent while you browse. When you sign up, or leave your details in one of this website’s forms, the form passes that page and that site to us with your details (to reach the sign-up page at app.zeropos.shop, “Start free” carries them in the part of the address after “#”, which browsers never send to a server), and we keep them with your new workspace or your message, to learn which pages help businesses find Zero POS. Legal basis: our legitimate interest in knowing that.

This website shows its prices in euros, pounds or US dollars; your own device chooses the currency, from the time zone it is set to. If you pick another, this website remembers it in your browser’s own storage on your device (as zpos.site.currency). Nothing is sent.

The app sets cookies only for people who are signing in or signed in, and only the ones it needs to work. They are strictly necessary, so they need no consent, and none of them is used for advertising or analytics:

• zpos_access and zpos_refresh keep a person signed in on a device for up to 400 days, so that nobody has to type a password at the counter;
• zpos_device, which used to mark a device where someone had signed in, is no longer set or read; a browser that still holds one has it removed the next time it opens a Zero POS page;
• zpos_pk_reg and zpos_pk_auth hold a one-time code for five minutes while a passkey is being saved or used;
• zpos_setup_gate can be set for up to an hour while the owner of a new workspace is setting it up;
• our own support staff also use zpos_platform_elevation, which shows that they have proved their second factor.

The app also keeps some information in the browser’s own storage on the device: the list of workspaces saved on it, so that people can switch between them without a password, and some recently loaded information, so that screens open quickly.

We use a few service providers to run Zero POS. They handle personal data only to provide their service to us, under data processing terms that oblige them to protect it:

• Vercel hosts this website and the Zero POS app, and provides the page timings described above;
• MongoDB Atlas, from MongoDB, Inc., is the database in which Zero POS keeps its data;
• Resend delivers the emails Zero POS sends itself, such as email verification and password resets, receipts from shops that have not connected their own email account, and the email that tells us someone has left their details in this website’s forms;
• Sentry receives reports of errors on our servers, so that we can fix them. A report describes what went wrong and where: the error, the page or request it happened on, and the ids of the records involved. Any email address in it is cut down to its domain, such as example.com, before the report is sent, so a report about an email that could not be sent names the domain it was for, not the address. A report never includes what was sent with the request, such as a form’s contents or a search, nor the cookies that keep someone signed in.

Notifications, for anyone who turns them on, reach their device through the push service of the company that makes their browser or device, such as Apple, Google or Mozilla. They are encrypted on the way.

We use no payment provider yet, because nothing is billed during early access. We will name it here before paid plans start.

We may also disclose personal data where the law requires it, to professional advisers bound to confidentiality, or to a business that takes over Zero POS, which would have to protect it as this policy describes.

Some of these providers are based outside the United Kingdom, Gibraltar, Andorra and the European Economic Area, for example in the United States, so personal data may be handled in other countries.

Such transfers are made only as data protection law allows: to countries recognised as protecting personal data adequately, or with safeguards such as standard contractual clauses. You can ask us about the safeguards that apply.

Workspaces and accounts: for as long as the workspace is open. When a workspace is closed, it is kept intact for 30 days, in case the owner wants it back, and is then due to be deleted permanently.

Records that slow down repeated sign-in attempts and repeated requests to public pages delete themselves when they expire. Error reports and page timings are kept by Sentry and Vercel for a limited time.

Messages from people who write to us: for as long as we need them to deal with what was asked, and then only as long as we need a record of it.

Details left in this website’s forms: 24 months after you last sent us one of these forms, and then deleted — unless you open a Zero POS workspace with the same email address or become a customer, when we keep them with your account’s records. To have them deleted sooner, or to stop our news or the founding-rate reminder, write to info@zerolines.life: we delete them for good.

Visit totals hold no personal data. Each day’s totals are deleted after about two years.

Anything the law requires us to keep, such as accounting records: for as long as it requires.

Deleted data can remain for a while in the copies we keep to recover from a failure, until those copies are replaced. We use them for nothing else.

Depending on where you are, the UK GDPR, the EU General Data Protection Regulation (GDPR), the Gibraltar GDPR or Andorra’s law on the protection of personal data gives you rights over your personal data. In broad terms, you can:

• find out whether we hold data about you, and get a copy of it;
• have inaccurate data corrected, and incomplete data completed;
• have your data deleted when there is no longer a good reason for us to keep it;
• ask us to restrict how we use it, for example while a correction is being checked;
• object to our using it on the basis of legitimate interest;
• receive the data you gave us in a common, machine-readable format, or have it sent to another organisation;
• withdraw any consent you have given, at any time, without affecting what was done before.

To use any of these rights, write to info@zerolines.life. We may ask you to confirm who you are first. It costs nothing, and we will answer within one month; in complicated cases the law lets us take longer, and we will tell you if we need to.

If your question is about what a shop has recorded about you, as one of its customers or its team, ask the shop: it decides what it records, and why. If you write to us instead, we will pass your request on to the shop and help it answer.

If you are unhappy with how we handle your data, please tell us, so that we can try to put it right. You can also complain to a data protection authority, in particular where you live or work: in the United Kingdom, the Information Commissioner’s Office (ICO); in Gibraltar, the Gibraltar Regulatory Authority; in Andorra, the Andorran Data Protection Agency (Agència Andorrana de Protecció de Dades); in Spain, the Spanish Data Protection Agency (Agencia Española de Protección de Datos); and elsewhere in the European Union, the authority of your country.

What a shop records in Zero POS about its customers and its team, such as its customers’ contact details, purchases and appointments, and its team’s rotas, hours and pay, belongs to the shop. The shop decides what to record and why, so the shop is the controller. We are its processor: we handle that data only to provide Zero POS to the shop, on its instructions, under our data processing agreement.

The same applies to what a shop’s customers enter on its online booking page, and to their choice about receiving its offer emails: the shop is the controller of that data.

A team member’s account belongs to both: the shop uses it to run its team, and we use the sign-in and security details this policy describes to provide Zero POS and keep it secure.

We protect personal data with technical and organisational measures suited to the risk. Our security page describes them in plain words, from passkeys and permissions by role to the activity history and the rules for support access.

If a breach of security puts personal data at risk, we will tell the people affected, and the authorities, as the law requires.

We will update this policy when what we do with personal data changes, for example when we add a service provider or start billing. The date at the top of this page shows when it last changed.

If a change affects how we use your data, we will tell workspace owners by email before it applies.

For anything about this policy or your data, write to info@zerolines.life, or by post to Colossus Investments Limited, 21 Engineer Lane, Gibraltar GX11 1AA.