Privacy Statement

VallaPOS makes point-of-sale software for mobile and local small businesses — food trucks, barbers, salons, lawn-care crews, market vendors, and small cafés and restaurants. This statement explains what data VallaPOS collects, why, and the choices you have. Because we offer two very different products, we spell out how each one handles data.

Two editions, two very different data pictures

VallaPOS Cloud (subscription web app at vallapos.com)

VallaPOS Cloud is a multi-tenant progressive web app that runs online. When you create an account and run your business on it, we collect and store: account information (your name, email address, and a securely hashed password); your business profile and catalog (items, prices, tax settings); and the order and transaction records you enter as you make sales. Today VallaPOS Cloud records cash, QR-code, and manual/"other" tender sales; card payments via Stripe are on our roadmap and in beta. For any card sale, the business using VallaPOS is the merchant of record — not VallaPOS — and card data is handled by Stripe, not stored by us. We also keep standard technical logs (IP address, browser type, timestamps, and error diagnostics) to keep the service secure and running.

VallaPOS Offline (one-time desktop download)

VallaPOS Offline is a downloadable, single-business, cash-only desktop app unlocked by a one-time license key. It is built to be genuinely offline: all of your business, catalog, and transaction data stays local on your own device. There is no account to create, no phone-home, and no analytics. We do not receive your sales data, your catalog, or usage telemetry from the Offline edition. The only personal data associated with an Offline purchase is what Stripe collects to sell you the license and issue your key.

How we use data

We use the limited data we hold to provide and operate the service, authenticate you, process your subscription or one-time purchase, provide support, secure the platform against fraud and abuse, meet legal and tax obligations, and communicate service and account notices. We do not use your personal information for cross-context behavioral advertising, and we do not build advertising profiles.

Service providers and sub-processors

We rely on a small set of vendors who process data only on our instructions:

• Stripe — processes subscription and one-time purchase payments and, for the Cloud edition, card acceptance where enabled.
• Hosting — VallaPOS Cloud data is hosted in the United States (Postgres via Vercel/Neon).
• Email delivery — sends transactional messages such as verification, receipts, and account notices.

We do not sell your personal information

VallaPOS does not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and similar US state laws. See our Do Not Sell or Share My Personal Information notice for details.

Security

We protect data in transit with encryption (TLS). Passwords and PINs are stored only as salted hashes, never in plaintext. Cloud is multi-tenant with tenant isolation so one business cannot access another business's data. No system is perfectly secure, but we work to protect your information using reasonable technical and organizational measures.

Data retention and deletion

For Cloud, we keep account and transaction data for as long as your account is active and as needed to provide the service and meet legal, accounting, and tax requirements. You may request deletion of your account and associated personal data; some records may be retained where the law requires. For Offline, deletion is entirely in your hands — remove the app and its local data files from your device.

You are the controller of your customers' data

For the order and customer information you enter into VallaPOS Cloud, you (the merchant) are the controller and VallaPOS is a processor acting on your behalf. You are responsible for handling your own customers' information lawfully, including providing any notices and honoring any requests they make to you.

Children

VallaPOS is business software and is not directed to children, and we do not knowingly collect personal information from children.

International users

VallaPOS Cloud is operated from and hosted in the United States. If you access it from outside the US, you understand your information will be processed in the US, where privacy laws may differ from those where you live.

Your privacy rights

Depending on where you live (including California and other US states with privacy laws), you may have the right to access or know what personal information we hold, request correction, request deletion, and opt out of any sale or sharing. Because we do not sell or share, there is nothing to opt out of, but you may still submit a request. We will not discriminate against you for exercising these rights. To make a request, email legal@vallahub.com; we may need to verify your identity before acting.

Cookies and essential storage

VallaPOS Cloud uses only cookies and local/session storage that are essential to sign you in, keep your session secure, and run the app offline as a PWA. We do not use advertising or cross-site tracking cookies.

Changes to this statement

We may update this statement from time to time. Material changes will be posted here with a revised effective date, and where appropriate we will notify you.

Contact

Questions or requests: legal@vallahub.com, or write to VallaPOS, 1942 W Gray St., Unit #115, Houston, TX 77019. This statement is governed by the laws of the State of Texas, USA.

Effective date: July 15, 2026