Privacy Policy

1. Provider and scope

This Privacy Policy applies to OshiPOS, provided by Office Hasegawa. Contact us at [email protected]. The separate Office Hasegawa website privacy notice covers the corporate website itself.

2. Information we handle

• Account and organization information, including names, email addresses, authentication and session data, organization membership, roles, language, and time zone.
• Subscription and billing information, including the plan, subscription status, Stripe customer, subscription, and Checkout identifiers, selected plan and Price identifiers, and billing-period, cancellation, and payment-status information. When checkout starts, OshiPOS sends the tenant name and manager’s email address to Stripe. At signup, Stripe Checkout collects billing name and address and card details; a tax ID may be provided where applicable. Stripe Tax calculates tax using information needed for billing. Stripe processes card details, billing name and address, and tax IDs; OshiPOS does not store those details in D1. OshiPOS stores the Stripe identifiers and subscription information described above in D1.
• Usage and support information, including actions, access times, IP addresses and other network data, device and browser details, support requests, notification recipients, and audit, security, or error records.
• Business records entered by customer organizations, as described below. OshiPOS does not provide a file-upload or file-storage feature.

3. Purposes and roles

We use information to manage accounts, provide services, bill customers, provide support, maintain security, prevent abuse, investigate errors, improve services, and comply with law. When a customer enters information about its staff, performers, settlement recipients, or other people referenced in business records, the customer determines the purposes and sharing scope. Office Hasegawa processes it as needed to provide the service and follow the customer’s instructions. We may independently determine purposes for account, billing, security, and operational information. For information within a customer organization, contact the organization that entered it first.

4. Service-specific information

OshiPOS (Japan)

We handle events, products, cash sales and cash movements, staff and performer names and groups, sales allocations, commissions, deductions and settlement amounts, device synchronization, closing, and audit records. On-site sales are cash-only; the service has no feature for collecting buyers’ names or card details. Personal information may still be entered in free-text fields.

5. Providers and international processing

• Cloudflare: Application/API hosting and delivery, the D1 database, network and security services, and email delivery for email-address verification and password resets.
• Stripe: Checkout, payment, and subscription management for paid plans. When checkout starts, OshiPOS sends the tenant name and manager’s email address to Stripe. Stripe handles payment-card details, billing information, and tax IDs; OshiPOS does not store them in D1.

The Cloudflare D1 database has no jurisdiction restriction. Cloudflare may process information for the application/API, network and security services, and email delivery in multiple regions. We do not guarantee that data is stored or processed only in Japan or any single region. Stripe handles information needed for billing under its own service terms. We apply notices and safeguards for international transfers as required by applicable law.

6. Retention and deletion

We retain information while an account or subscription is active and as needed for service delivery, auditability, disputes, and legal obligations. Sales ledgers, finalized settlements, and audit records cannot be deleted through ordinary app controls and may remain after account termination where needed for legal or audit purposes. Offline transactions and the synchronization queue are stored in the browser on the device (IndexedDB); they may be unrecoverable if the device is lost or damaged, or its browser data is cleared, before synchronization completes. Send account-closure or data requests to [email protected]. We retain information required by law only as needed.

7. Cookies and security

We use cookies or browser storage needed for sign-in, request-forgery protection, and core service functions. We do not use information for advertising tracking. Reasonable safeguards include tenant separation, role-based access, encrypted connections, authenticated access to service data, and audit-record controls. No system can be guaranteed completely secure.

8. Individual rights, changes, and contact

We handle verified requests to access, correct, or delete account information as required by applicable law. For information entered by a customer organization about its employees, customers, or other contacts, contact that organization first. Additional privacy rights or notices may apply under the laws of your location, and we honor those requirements as applicable. We will notify users of material changes as required by law.