Pcnaid Inc. operates POS True Retail Operations for Shopify merchants. Questions and privacy requests can be sent to support@pcnaid.com.

• Store domain, installation scopes, encrypted Shopify access tokens, and subscription status needed to authenticate the app and enforce its plan.
• Shopify location, staff, customer, order, transaction, product, and variant identifiers used to perform and audit merchant-requested operations.
• Per-location feature settings, retail configuration, idempotency/replay keys, and audit details such as amount, currency, quantity, reason, and timestamp.
• Technical request, error, release, and performance information. Structured logs redact tokens, email addresses, and sensitive query values.

We do not store payment-card details. A customer email can appear transiently in a signed Shopify data-request webhook, but this app does not persist or log that email and does not send email.

We process this data to provide register operations, merchant configuration, billing, security, audit/export, support, abuse prevention, and legal-compliance functions requested by the merchant. Shopify supplies the commerce data and remains the source of truth for products, orders, customers, staff permissions, and current app subscriptions.

Data is shared only as needed with Shopify and infrastructure/observability processors used to operate the app: Cloudflare, Sentry, and PostHog. An optional authenticated acceptance probe can send a synthetic marker to Datadog; merchant payloads are not used as probe markers. We do not sell personal data or use it for targeted advertising.

• Mutation idempotency records expire after seven days; webhook replay receipts expire after 30 days; rate-limit buckets and expired sessions are removed by a daily cleanup.
• Settings, audit/inventory history, and durable once-per-shop trial history are retained while needed to provide the service, prevent repeated-trial abuse, or meet merchant/legal obligations.
• Uninstall removes access sessions, subscription projections, and KV settings. Shopify’s mandatory customer/shop redaction webhooks delete matching customer records or every remaining shop-scoped record.
• Backup copies age out under the infrastructure retention schedule and are not used to resume normal processing after a valid deletion request.

The app does not offer a merchant-selectable data-residency region. Shopify, Cloudflare, Sentry, PostHog, and the optional Datadog probe may process data in countries where they or their subprocessors operate, including outside the merchant’s or individual’s country. Applicable transfer safeguards and processing terms depend on the deployment and jurisdiction. Contact the privacy address above for current information relevant to a request.

Depending on location, merchants and individuals may request access, correction, deletion, restriction, objection, or a portable copy of covered personal data. Send the store domain, request type, and a safe way to verify authority to the support address above. Do not email access tokens, passwords, payment data, or full customer records. Merchants can also uninstall the app and Shopify will send the mandatory redaction requests.

We may update this notice as the product or legal requirements change. The effective date above identifies the current version. Material changes will be presented through an appropriate merchant-facing channel.