1. Introduction

This Privacy Policy explains how Fuze-Store IT Solutions (“Fuze Store,” “we,” “our,” or “us”) collects, uses, and protects personal information in connection with the Fuze Store POS and store management platform — including the Fuze Store mobile app for store operators, the Fuze Store customer app, the Fuze Store Hub desktop companion, and our website and account dashboard (collectively, the “Service”).
We comply with applicable data protection laws, including the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations, and — where they apply to international users — the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).

2. Our Two Roles: Controller and Processor

Fuze Store is a business tool used by merchants. Depending on whose data is involved, we act in one of two roles:

• As a data controller — for the personal data of account holders and staff (the merchants and their team members who sign up for and operate Fuze Store). We decide how and why this data is processed, and this Policy applies in full.
• As a data processor — for customer records that merchants enter into their own store (see Section 3c). The merchant is the data controller of their customers' information; we host and process it only on the merchant's instructions. Customers of a store who have questions about their data should contact that store directly. We support merchants in honoring their customers' data-subject requests.

3. Information We Collect

a. Account Information (we are the controller)

• Name, business name, username, email address, mobile number, country, avatar photo, and password (stored hashed, never in plain text).
• Store address, business identification, and subscription details.
• Two-factor authentication secrets and recovery codes (stored encrypted).
• If you sign in with Google or Facebook, we receive your name and email address from the provider to create or link your account. We use these providers for sign-in only — the Facebook SDK's advertising and tracking features (advertiser-ID collection and automatic app-event logging) are disabled in our apps.
• One-time verification codes (OTP): when you verify a mobile number we temporarily store the phone number and a hashed copy of the code; codes expire within minutes.

b. Transaction and Usage Data

• Orders, products, inventory, and staff activity logs created through normal store operation.
• Staff compensation settings, commission entries, and payout records the merchant enters to compute pay statements.
• Staff payout accounts. A merchant that pays staff through an organization may record where each person is paid: the payout method, the bank or e-wallet name, the account name, and the account number. We store the account number encrypted. It is shown only to the organization's members who prepare or pay pay runs, and appears on the pay run spreadsheet those members download. We use it only to show the merchant where to send pay; Fuze Store does not send money to staff and never debits these accounts.
• Payment-related data for your Fuze Store subscription is handled securely by Maya (PayMaya Philippines, Inc.); we do not store full card numbers or security codes. We keep only a reference token from Maya and a masked label (for example, the card brand and its last four digits) so that renewals can be charged and you can recognize the saved method. Payments your customers make to your store are settled directly into your own accounts and do not pass through us, and we do not store your customers' card, bank, or e-wallet details: a payment recorded on an order keeps only the method used, the amount, and any reference number staff type in.
• Technical data such as IP address, browser type, operating system, and device identifiers.
• Push-notification device tokens, when you enable notifications in our mobile apps.
• Crash and error diagnostics via Sentry (see Section 5). Session replay is disabled in our mobile app.
• Product analytics via PostHog (feature-usage events that help us improve the Service), where enabled.

c. Store Customer Records (the merchant is the controller)

• Merchants may record their customers' details in their store's CRM: name, email address, mobile number, date of birth, gender, addresses (which may include map coordinates), and SMS opt-out status.
• Order, booking, and loyalty history linked to those customer records.
• Orders customers start online. Where a merchant switches on online ordering, their customers can build an order on the store's public page and submit it for staff to complete. We hold that draft order so the store's staff can pull it into their register — the items selected, any note, the contact details the customer enters (first name, and optionally last name, email address, and mobile number), a pickup or delivery address where the merchant offers those options, and any extra checkout details the merchant asks for (for example, a plate number or a claim tag). Draft orders are deleted automatically (see Section 6). No payment is taken on this page — the customer settles directly with the store.
• We process this data solely to provide the Service to the merchant. Merchants are responsible for collecting it lawfully — including any data about minors — and for responding to their customers' privacy requests.

d. Local Data on Your Devices (Fuze Store Hub)

• The Fuze Store Hub desktop app stores operational data locally on the merchant's own computer — including a local audit log of administrative actions (which records the acting user's email address), printer configuration, and kitchen-display tickets. This data stays on the merchant's premises; local audit entries are kept for up to 365 days.
• Hub also stores a shop-local TLS certificate and private key on the merchant's computer so the browser app can talk to the Hub over HTTPS. Staff can optionally install that shop's certificate in their OS so Chrome shows a lock. The private key never leaves the computer.

e. Cookies and Analytics

• Our landing and marketing website uses cookies and similar technologies. A cookie-consent banner lets you accept or reject non-essential cookies on your first visit, and you can change your choice anytime via Cookie settings in the site footer. See our Cookie Policy for full details.
• Strictly necessary cookies (sign-in, security, and core site functions) are always active.
• Analytics cookies run only with your consent — Vercel Speed Insights (aggregated performance data), Google Analytics (website traffic and sign-up measurement, with Google signals and ad personalization switched off), and Sentry (error diagnostics).
• Live chat is not cookie-gated because it is not loaded until you ask for it — the Tawk.to widget loads only when you click Chat with us, and stores nothing before that.
• The Fuze Store POS app does not use tracking cookies or advertising identifiers.

f. NFC Tags (optional add-on)

• Where a merchant enables the NFC add-on, their staff can read, write, and erase NFC tags from the app — using the device's own NFC hardware, or a USB reader connected to Fuze Store Hub. A tag holds only what the merchant writes to it: a link to their own store page, table, or product, or short text of their choosing. It is the same content a merchant can already print as a QR code.
• What we collect through NFC. Reading and writing ordinary tags happens on the merchant's own device or Hub, and nothing from them is sent to us. There are two exceptions. The first is a customer card: when a merchant issues one to a customer, we store a one-way fingerprint (hash) of the card's code and of the tag's serial number, linked to that customer's record at the store, together with when it was issued, by which staff member, and when it was last used. The card holds only a random code, with no name or contact details, and identifies the customer only to the store that issued it. A revoked card stops working, and card records are deleted with the customer record or the store. When a customer taps or scans their own customer card with their phone, it shows only that it is a customer card, unless the merchant has turned on the customer card page: then it shows the store, the customer's name shortened to initials (e.g., “K••• D.”) and their loyalty points. When the store has a mobile number or email for the customer, the page may also show, to whoever holds the card, the last 4 digits of that number or a shortened email (e.g., “m•••@g•••.com”) so the customer can choose where to get a code; the code itself only ever goes to that number or email. Nothing else about them is shown without that code. To keep that page open without leaving the card's code in the address bar, we set a cookie that holds a random session key, stored on our side only as a one-way fingerprint; it lasts 30 days, or 90 days after the customer verifies on that device, ends when the card is revoked or the customer record is erased, and is deleted from our records 30 days after it ends. When a customer asks on their card page to see their points history, we send a one-time code to the mobile number or email address the store has on file for them; typing it back shows the history on that device. The customer cannot enter a different number or address, the code and the contact details are not stored on the page, and the code expires after 5 minutes (we keep only a one-way fingerprint of it). The second is a claim tag, which a merchant can hand out at drop-off and take back at pickup to match a bag or item to its order. When a merchant uses claim tags, we store, for each tag registered, a one-way fingerprint (hash) of its serial number, the number the staff gave it, which staff member registered it and when, and when it was last tapped by staff. If a staff member marks a tag lost, or releases a missing tag so an order can be collected, we also store when that happened, which staff member did it, and the reason they gave. We keep a record of which orders the tag was put on, which staff member put it on and when, and when it came back. A claim tag holds only a link containing a random tag ID, with no customer details. Tag records are deleted with the store. When a customer taps an ordinary tag with their own phone, their phone simply opens the link; the tag does not identify them, and nothing is read from their device.

4. How We Use Information

We process collected data to:

• Provide, operate, and improve the Service.
• Manage subscriptions, billing, and account authentication.
• Send service updates, invoices, and important notifications (email, SMS, and push).
• Deliver real-time updates between your devices (order status, kitchen display, and similar features).
• Offer customer support.
• Send marketing communications (you may opt out anytime).
• Analyze usage to improve performance and user experience.
• Detect, investigate, and prevent fraud, abuse, and security incidents.

5. Data Sharing and Service Providers

We do not sell or rent personal data.
We share limited data with the following service providers, under data processing agreements, only as needed to run the Service:

• Payment Processing: Maya (PayMaya Philippines, Inc.) — subscription and add-on billing, and prepaid wallet top-ups.
• Email Delivery: Amazon Web Services (Amazon SES) — transactional and account emails.
• SMS Delivery: Movider — order, booking, and queue text notifications sent on a store's behalf, and the one-time codes for customer card pages. Message logs retain only the last 4 digits of the recipient's number.
• Push Notifications: Expo push notification service — delivery of mobile push notifications via device push tokens.
• Hosting & Storage: Amazon Web Services (application servers, and file/receipt storage in access-controlled private buckets) and Vercel (website hosting). Our domain is registered with GoDaddy, which does not process personal data.
• Real-Time Messaging: Pusher-protocol websockets — real-time sync of orders and store events between your devices.
• Error Diagnostics: Sentry — crash and error reporting across our apps, website, and servers. Internal error alerts may also be routed to our team's Slack workspace; these alerts contain technical error context, not customer records.
• Product Analytics: PostHog — aggregated feature-usage analytics, where enabled.
• Website Analytics & Diagnostics: Vercel Speed Insights, Google Analytics (Google LLC), and Sentry on our website — subject to your cookie choices.
• Live Chat: Tawk.to (customer support chat widget) — loaded only when you open the chat.
• Other trusted vendors assisting in secure operations under data processing agreements.

We may also disclose data when required by law, court order, or lawful government request, or to protect the rights, safety, and security of Fuze Store and its users.

Optional public features (merchant-controlled)

• Store directory: merchants may choose to list their store profile and menu in our public store directory. This is on by default for new stores and can be turned off anytime in store preferences; a hidden store is not publicly discoverable.
• Order-status pages: printed receipts and claim stubs may carry a QR code that opens a public order-status page. That page shows order progress and a masked first name only (e.g., “J***”) — never contact details or payment information. Tapping a claim tag with a phone opens the same order-status page while the tag is on an order; otherwise it shows only that the tag is not in use or no longer active, and never an earlier order. Merchants can disable these features in store preferences.
• Store contact details and links: merchants may add their store's contact details (phone numbers, email) and links (website, social profiles) to their store record. These appear on the store's public page. Showing contact details and showing links are on by default and can each be turned off — either as a whole or per entry — anytime in store preferences. Only add details you are willing to publish: anything left switched on is visible to anyone who opens the store's public page.
• Online ordering: merchants may switch on online ordering so their customers can submit an order from the store's public page. This is off by default and can be turned on or off anytime in store preferences. After checkout the customer receives a link or QR code for their draft order to show to staff; that page shows the order's progress with a masked name and phone number only (e.g., “M*** · **** 4567”) — never the customer's full contact details. Where the merchant has chosen to publish a payment method, that page shows the store's account details so the customer can pay; no customer payment information is collected.
• Customer card page: merchants who give customers an NFC or QR customer card may let those customers see their loyalty points on their own phone. This is off by default and can be turned on or off anytime in store preferences. When it is on, tapping or scanning the card opens a page with the store's name, the customer's name shortened to initials (e.g., “K••• D.”) and their points, tier and expiry date, and, when the store has a mobile number or email for them, may also show the last 4 digits of that number or a shortened email, so the customer can ask for a code; never their full name or full contact details. To see their points history, the customer asks for a one-time code, which we send by text or email only to the mobile number or email address the store has on file for them; once they enter it, that device shows the history for 90 days, or until they choose Forget this device. The history lists each points change with its order or refund number and time, never staff, items or amounts paid. Anyone who holds the card or its link can see the points page, so a lost card should be revoked; the page then stops working the next time it loads.
• Payment details on the store page: merchants may mark a payment method as shown on their store page, so a customer who has placed an online order can see the store's account name, account number and payment QR. This is off by default for every payment method and can be switched on or off per method anytime. Only mark an account public if you are willing to publish it: it is visible to anyone who holds a link to an order placed with your store.

6. Data Retention

• Account and store data are retained as long as the account remains active.
• When you delete your account, it is deactivated with a 30-day grace period during which you can restore it by logging back in; after that it is permanently deleted. An account that was ever billed is not erased: its invoices are tax records, so we remove your personal details from it instead and keep only the invoices and the wallet ledger. A deleted store's data, its orders included, is likewise erased about 1 month after deletion, apart from its sales-records file (next point). A store is deleted on its own schedule rather than with your account, and a store keeps the staff record it holds for you with your account link removed — see the Data Deletion page for the full breakdown of what is and is not removed.
• Sales records of a deleted store. When a store is deleted, its operational data is erased about 30 days later. Before that, we save one sales-records file for it: its orders, order lines, payments, refunds and cash sessions. Customers appear only by the name written on each order, with no email, phone number or address. Staff appear by name, and the file records the store owner's name and email as they were on the day it was made; that record stays in the file even if the owner later deletes their account. The file is kept in private storage until 31 December of the sixth year after the store's last record, to meet Philippine record-keeping rules, and then deleted. The store owner can download it from their account (Account → Store records), and we also email the owner a copy of the file when it is made, to their verified email address, so they keep the books even after deleting their account.
• Certain financial records (invoices, official receipts, and payroll an organization approved) may be retained longer where required by law (e.g., Philippine tax regulations), with your account link or personal details removed.
• Operational records are automatically pruned on a schedule:

7. Data Security

We implement industry-standard security measures, including:

• Encrypted communication (HTTPS, SSL/TLS).
• Token-based authentication using JWT, with optional two-factor authentication.
• Hashed passwords, encrypted two-factor secrets, and encrypted staff payout account numbers.
• Private, access-controlled file storage with short-lived signed download links.
• Access controls and regular system audits.
  Despite these measures, no system is completely secure; users share data at their own risk.

8. International Data Transfers

Your data may be processed in Singapore or other regions where our servers and service providers operate.
We ensure appropriate safeguards consistent with international standards.

9. Your Rights

Under the Data Privacy Act of 2012 (RA 10173) — and, where applicable, GDPR/CCPA — you have the right to:

• Be informed about how your personal data is collected and processed.
• Access a copy of the personal data we hold about you.
• Rectify (correct) inaccurate or outdated data.
• Erasure or blocking — request that we delete your personal data, subject to any records we must keep by law (see Data Retention). You can delete your account directly in the app (Account → Details → Delete Account) or on the web dashboard — see our Data Deletion page.
• Data portability — request a copy of your data in a portable format by emailing support@fuze-store.com; we fulfill export requests within 30 days.
• Object to processing or withdraw consent at any time.
• Damages — be indemnified for harm caused by inaccurate, unlawfully obtained, or unauthorized use of your data.

To exercise any of these rights, email support@fuze-store.com or our Data Protection Officer (see Contact Us). We respond within the period required by law. If you believe your rights have been violated, you may also file a complaint with the Philippine National Privacy Commission (NPC) at privacy.gov.ph.

If you are a customer of a store that uses Fuze Store, the store is the controller of your record — please direct requests to the store; we will assist them in fulfilling your request. A store can delete your customer record and, at the same time, erase your personal details: your name is replaced with "Erased customer" on the store's past orders and bookings, and your email address, mobile number, birthday and addresses are removed. The amounts on those orders are kept, because the store needs them for its books.

10. Children's Privacy

Fuze Store accounts may only be created by individuals 18 years or older, and we do not knowingly collect account data from anyone under 18. If we become aware of such an account, we will delete it promptly.
Merchant-entered customer records (Section 3c) may lawfully include data about minors (for example, a booking for a child); the merchant, as controller, is responsible for collecting and handling such data appropriately.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The latest version will always be posted at www.fuze-store.com/privacy-policy.
Significant changes will be communicated via email or in-app notification.

12. Contact Us

Fuze-Store IT Solutions
Email: support@fuze-store.com
Talk to Us: Use the chat feature on our website
Address: 1076 A. Bonifacio, Balingasa, Quezon City, 1115, Philippines

Data Protection Officer (DPO) — for privacy questions, data-subject requests, or concerns under the Data Privacy Act of 2012, contact our DPO at support@fuze-store.com (subject line: "Attn: Data Protection Officer").

Last Updated: October 22, 2026
Effective Date: October 22, 2025