Privacy Policy

Account and profile information

• name
• email address
• phone number, if provided
• password authentication data stored as a hash
• email verification and password reset records
• account settings such as language, country, onboarding status, and timestamps

Business and team information

• business profile details such as name, slug, logo, gallery, description, email, phone, address, website, timezone, currency, working days/hours, theme, and public channel settings
• team membership, roles, appointment roles, permissions, location access, availability, and invitations
• OAuth connection settings and access scopes for approved external applications

Catalog, customer, appointment, order, and transaction information

• categories, products, services, SKUs, prices, costs, descriptions, images, colors, variations, tax rates, stock settings, and stock quantities
• business locations, address fields, contact details, and location availability settings
• customers, appointments, status history, transactions, line items, receipts, online orders, pickup details, customer contact details, notes, totals, payment methods, and payment proof URLs

Payment configuration information

PointUp is not a card processor. Businesses may store payment configuration and payment references such as:

• enabled payment methods
• linked bank account details such as account holder name, account number, bank address, branch name/code, mobile number, QR code, and timestamps
• Interac e-Transfer recipient names and emails, BLIK phone numbers, Revolut usernames, and Wise payment links for online payments
• payment references, payment comments, and uploaded payment confirmation files

When a business takes online card payments through its own Revolut merchant account, PointUp sends Revolut the order amount, reference and items and the customer’s name, phone number and email address to create the checkout, and stores the Revolut order ID, checkout link and payment status. Customers enter card details on Revolut’s page; they never reach PointUp.

Uploaded files

Uploaded files can include item images, business logos, business gallery images, and online-order payment confirmation files. Uploaded files are stored by our file storage provider. Payment confirmation files are stored privately and can be opened only by the business’s authorized team members; other uploaded files may be accessible through public URLs when the application stores or displays those URLs.

Device, usage, analytics, and log information

• session tokens, IP address, user agent, request metadata, and timestamps
• device category associated with newly created appointments, online orders, and checkout transactions
• product analytics events and error details
• frontend pageviews, pageleave events, autocapture/session recording, console/error data, and stack traces through PostHog when analytics consent is granted
• push notification endpoint URLs and browser subscription keys when push notifications are enabled

Cookies and browser storage

PointUp uses cookies and local browser storage for authentication and preferences, including authentication/session cookies, selected location IDs, sidebar state, theme, locale, selected locales, country, currency, dashboard layout, checkout stage, cart panel width, item view mode, and analytics consent preference.

Analytics cookies, PostHog autocapture, and PostHog session recording are optional and are used only after consent is granted. Necessary cookies and local storage are used to provide login, security, routing, and preference features.

Spreadsheet import and AI-assisted processing

When a spreadsheet is uploaded for item import, PointUp parses it during the request. Parsed item data is stored only if the user confirms/imports it. If AI-assisted spreadsheet import is enabled, sanitized headers, mapping context, limited sample rows, and limited invalid-row samples may be sent to Google Gemini or a configured AI gateway to suggest mappings.

We use information to:

• provide, operate, and maintain PointUp
• create and authenticate accounts
• manage businesses, teams, permissions, locations, catalogs, inventory, taxes, checkouts, appointments, online stores, orders, and reports
• send verification, password reset, invitation, appointment, order, receipt, and notification messages
• support integrations such as Telegram, web push, OAuth connectors, and AI-assisted imports
• detect, debug, prevent, and respond to errors, abuse, security issues, and service reliability problems
• analyze usage and improve the product
• comply with legal, accounting, tax, security, or operational obligations where applicable

For Poland and the European Union, our legal bases may include performance of a contract or taking steps before a contract, legal obligations, legitimate interests such as security, fraud prevention, service reliability, support, and product improvement, and consent where required, including for optional analytics/session recording, push notifications, and some integrations.

We do not sell personal information. We share information only as needed to operate PointUp, provide requested features, or comply with obligations.

Business owners, admins, and authorized team members can access business records according to their permissions. If a business enables public storefront or appointment pages, selected business, catalog, service, location, availability, payment, and order/payment-flow information may be shown to public visitors or customers.

If a user authorizes an OAuth connector, PointUp may provide the approved external application access to the scopes selected for that connection. OAuth authorization codes, access tokens, and refresh tokens are stored as hashes in PointUp.

We may disclose information if necessary to comply with law, enforce agreements, protect rights, investigate abuse, protect users or the public, or maintain the security and integrity of the service.

We keep information for as long as needed to provide PointUp, maintain business records, support security and debugging, comply with obligations, and resolve disputes.

• account sessions expire after approximately 7 days and may be refreshed during use
• email verification tokens expire according to the relevant flow; password reset tokens expire after approximately 1 hour
• business, customer, transaction, appointment, order, catalog, and location records remain until deleted by an authorized user or through applicable data-deletion processes
• administrator-only account deactivation revokes access but retains the account and business records; for data-deletion requests, contact hello@pointup.sale
• uploaded files are not currently deleted automatically when a database record or URL reference is removed
• third-party providers may retain delivery logs, analytics data, platform logs, or integration records according to their own systems and configurations

We use technical and organizational measures intended to protect information, including authenticated API access, permission checks, hashed passwords, hashed OAuth tokens, secure cookies in production, encrypted web push payloads, and managed infrastructure providers.

No system can be guaranteed completely secure. Users should protect account credentials, limit team permissions, and avoid uploading unnecessary sensitive information.

PointUp and its providers may process and store information in countries other than where a user is located. PostHog is configured to use EU infrastructure, while our other infrastructure, database, email, messaging, AI, and browser push providers may process data through their own regional or global infrastructure.

Depending on your relationship with PointUp and the relevant business, you may be able to:

• update account profile details in PointUp
• update or delete business, catalog, customer, appointment, order, location, team, and payment settings if you have permission
• disconnect Telegram integrations
• revoke OAuth connections
• unsubscribe from push notifications in the browser or PointUp UI
• request account deletion
• clear local browser storage or cookies, noting that this may sign you out or reset preferences
• choose necessary-only cookies or accept optional analytics cookies

Depending on applicable law, including the GDPR/RODO, you may have rights to access, correct, delete, restrict, object to processing, receive a copy of your data, withdraw consent where processing is based on consent, and lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

Requests can be sent to hello@pointup.sale. If you are a customer of a business using PointUp, we may direct you to that business for requests about records controlled by that business.

PointUp is intended for businesses and their customers. It is not intended for children to create business accounts. Businesses should not knowingly enter children's information unless they have an appropriate reason and authority to do so.

We may update this Privacy Policy as PointUp changes. The latest version will show the updated date at the top. Significant changes may be communicated through the site, app, or email when appropriate.

For privacy questions or requests, contact hello@pointup.sale.