Privacy Policy
Effective date: June 14, 2026·Governed by the laws of British Columbia, Canada
LUX Solutions (“we,” “us,” or “our”) operates Luxo POS, an all-in-one business management platform for food & beverage and retail businesses in Vancouver, British Columbia. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. We comply with the BC Personal Information Protection Act(PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
1.Information We Collect
Account & Business Information
When you register or are invited to Luxo POS, we collect:
- Business name, address, and contact details
- Email address and password (hashed — we never store plain-text passwords)
- Business type, operating hours, and settings you configure
- Subscription plan and billing contact information
Transaction & Operational Data
- Point-of-sale orders, line items, totals, and payment method type (cash / card)
- Reservation details: guest name, phone, party size, date, and status
- Customer loyalty records (phone number, stamp count)
- Employee schedules, shift records, and clock-in/out times
- Menu items, pricing, and inventory configuration
What We Do NOT Store
We do not store payment card numbers, CVV codes, or full PANs. All card data is handled exclusively by Stripe, Inc. under their own PCI-DSS certification. We receive only masked card summaries (last 4 digits, brand) from Stripe.
Usage & Technical Data
- IP address, browser type, and operating system
- Pages visited, features used, and session duration
- Error logs and crash reports for service improvement
2.How We Use Your Information
- Service delivery — Operating your POS, reservations, scheduling, and analytics features
- Billing — Processing subscription payments via Stripe and issuing receipts
- SMS communications — Sending reservation confirmations and reminders you configure via Twilio
- AI features — Sending your business data to Anthropic's Claude API to power AI Insights analysis (only when you trigger the feature)
- Support — Responding to your requests and diagnosing technical issues
- Product improvement — Aggregated, anonymised analytics to improve features
- Legal compliance — Meeting our obligations under Canadian law
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
3.Third-Party Service Providers
We share data with the following sub-processors only to the extent necessary to deliver the service:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database & authentication hosting | All platform data (encrypted at rest) |
| Stripe, Inc. | Subscription billing & Connect payments | Billing contact, plan, Stripe tokens |
| Twilio Inc. | SMS reminders & notifications | Customer phone numbers, message content |
| Anthropic | AI Insights analysis (opt-in feature) | Business analytics data you submit for analysis |
| Vercel | Application hosting & CDN | Request logs (IP, path, timestamp) |
Each provider has its own privacy policy and data processing agreement. Supabase and Vercel infrastructure is hosted in the United States. By using Luxo POS you consent to this cross-border transfer.
4.Data Retention
- Active accounts — Data is retained for the duration of your subscription
- After termination — We retain transaction and financial records for 7 years to comply with CRA tax regulations; all other data is deleted within 90 days of account closure
- Backup copies — Encrypted backups are purged within 30 days of the primary deletion cycle
5.Cookies & Tracking
Luxo POS uses session cookies only — strictly necessary for authentication and maintaining your logged-in state. We do not use advertising cookies, cross-site tracking, or third-party analytics scripts that track individual users across the web.
Your locale preference is stored in a cookie to remember your language setting (English or Korean). This cookie contains no personal data.
6.Security
We implement industry-standard safeguards including:
- TLS 1.2+ encryption for all data in transit
- AES-256 encryption for data at rest (Supabase)
- Row-Level Security (RLS) — each tenant's data is isolated at the database level
- Scrypt hashing for employee PINs; bcrypt for account passwords
- Role-based access control (Owner / Manager / Staff / Viewer)
- Periodic security reviews and penetration testing
No method of transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify you within 72 hours as required by PIPEDA.
7.Your Rights (PIPEDA / BC PIPA)
As a user or data subject, you have the right to:
- Access — Request a copy of the personal information we hold about you
- Correction — Ask us to correct inaccurate or incomplete information
- Withdrawal of consent — Withdraw consent for non-essential data uses (this may limit certain features)
- Deletion — Request deletion of your personal data, subject to our legal retention obligations
- Complaint — Lodge a complaint with the Office of the Information & Privacy Commissioner for BC
To exercise any of these rights, email us at privacy@luxopos.com. We will respond within 30 days.
8.Children's Privacy
Luxo POS is a business-to-business platform and is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors.
9.Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to the account owner at least 14 days before they take effect. Continued use of the platform after the effective date constitutes acceptance of the revised policy.
10.Contact Us
Questions, requests, or concerns about this Privacy Policy should be directed to:
© 2026 LUX Solutions. All rights reserved.