Effective date: October 2, 2026 (revised) · Last updated: October 2, 2026

OrderPOS (the "App") is a business tool for cafe and store operators to receive, prepare, and hand over customer orders and to manage store operations data. It is not a consumer app; its users are operators (owners) registered with a store.

SangLimSoft (the "Company") complies with the Personal Information Protection Act of Korea and related laws.

1. Personal information processed
The App handles several different kinds of information, and the Company's role differs for each.

a. Information about App users (store operators) — processed by the Company as the processor
- Account information: email address, authentication session token
- Profile information: display name, account active status
- Store membership: store identifier, store role (owner), membership active status
- Device information: push notification token (FCM), app name, platform, token active status
- Operational records: POS connectivity check records, the operator identifier on order status change history

b. Information about the store's customers — held by the store and processed by the Company on the store's behalf
The App displays the information below in order to process orders the store has received. The data subject is the store's customer and the collecting party is the store. The Company only stores and delivers this information on the store's behalf.
- Information the customer entered when ordering: name (or nickname), phone number, request note
- Order details: order number, ordered items and options, amount, order status and timestamps

c. Information about a supplier's contact person — third-party information entered by the user
When a user enters contact details on the suppliers screen, they are stored as entered on the Company's servers and shown to other users of the same store. The data subject is not the user but the supplier's contact person.
- Contact person's name, phone number, email address, and address
The store enters this information at its own discretion in order to contact the supplier, and the collecting party is the store. The Company only stores and displays it on the store's behalf and does not use it beyond store operations or provide it to third parties. Users must enter only contact details the supplier has provided, and for a supplier they no longer trade with they can turn off the "active" status or save the contact fields empty.

d. App usage statistics and error information — collected by the Company directly
The Company sends information about app usage to a collection server operated by the Company, in order to improve the service and fix errors. The types of information collected are as follows.
- App usage records such as launch, exit, install and update
- The identifier of the screen you moved to within the app
- Records of key actions performed in the app (order handed over, order processing failure, refund processing, login failure)
- If the same spot is tapped several times in quick succession: that fact, the on-screen coordinates of the tap, and the structure of the element tapped
- Technical information about errors and abnormal terminations
- Environment information such as device type, OS version, app version and language setting
- An anonymous identifier used to group these records into a single installation
- An account identifier used to distinguish signed-in users
- Notification settings and records of opening the app from a notification
Because these records are linked to the identifier of the signed-in account, they show which account did what, on which screen, and when.
Error information includes the error type, the error message and the execution path leading up to the error. Because of how the app is built for release, the execution path does not reveal source file names or locations. The error message may, however, contain part of the value being processed when the error occurred.

e. Information the App does not collect
The App does not collect location data, contacts from the device address book, photos, advertising identifiers (IDFA), or cookies, and it does not embed advertising SDKs. The usage statistics in item d are used only to improve the service and fix errors; they are not used for advertising or marketing purposes and are not provided to third parties.
The following are excluded from the collection described in item d.
- Screen recordings and the content shown on screen
- Customers' names and phone numbers and what they ordered
- Order amounts, refund amounts, and sales figures
- Users' login IDs and passwords

e. Website usage information
The App's information and support pages (orderpos.sanglimsoft.com) and this policy page are hosted on Cloudflare. For service delivery and security, the hosting provider may technically process standard access information such as IP address, browser information, and request time. The Company does not install visitor analytics or advertising tracking scripts on the website and does not use cookies.

f. Information processed through inquiries
Only when you contact us through the support page form or by email do we receive the request type, your email address, and the content of your inquiry. This information is used only to respond to inquiries and handle deletion requests. Form submissions are stored in SangLimSoft's shared inquiry intake store (Supabase) together with the app name and the connecting IP address (saved automatically by the server when the form is submitted, to prevent abuse), and a notice of receipt (app name, inquiry type, reply email address, first 300 characters of the inquiry content) is sent to the Company's internal notification channel (Slack). Emails sent to support@sanglimsoft.com are forwarded through Cloudflare to the Company's Microsoft Outlook.com mailbox, where they are kept and used to reply.

2. Purpose of processing
- Identifying users and maintaining login state
- Providing store operations features such as accepting, preparing, handing over, cancelling, and refunding orders
- Sending a push notification when a new order arrives
- Managing store operations data such as inventory, suppliers, and sales
- Checking POS device connectivity and reporting outages
- Reviewing usage statistics to analyse errors and improve the app

3. Retention and use period
- Account information: until the operator's use at the store ends
- Push notification token: deactivated immediately on logout; tokens that are no longer valid (for example after the app is deleted) are deactivated automatically at send time
- Supplier contact information: retained until the user saves the fields empty or asks the Company to delete them. The App has no feature for deleting a supplier record itself
- Information stored on the device (notification sound setting, order commands queued for sending): deleted when the app is deleted. A queued command contains only the order identifier and the target status, and includes no customer personal information
- App usage statistics and error information: retained on the Company's collection server while used to improve the service and analyse errors. No automatic deletion cycle is currently applied to the raw records, and recovery backups are deleted automatically 30 days after they are created
- Store customers' order information: follows the store's retention policy and the periods required by law (under the Act on Consumer Protection in Electronic Commerce: records of contracts and withdrawal of subscription 5 years, records of payment and supply of goods 5 years, records of consumer complaints and dispute handling 3 years)
- Information received through inquiries (Article 1.f): destroyed without delay once the purpose of handling the inquiry is achieved, or deleted without delay on request, unless retention is required by law
- Website access information: handled under the hosting provider's policy

4. Outsourcing of personal information processing
The Company outsources processing as follows in order to operate the service. Processors may not process personal information for any purpose beyond the outsourced purpose under their contracts.
- Supabase, Inc. (United States): database and authentication infrastructure
- Google LLC (United States): push notification delivery
- Apple Inc. (United States): push notification delivery to iOS devices
- Oracle Corporation (United States): cloud infrastructure hosting the app usage statistics and error information collection server and its backups
- Cloudflare, Inc. (United States): delivery and protection of the traffic from the App to the collection server
- Slack Technologies, LLC (a Salesforce, Inc. company) (United States): internal notification to the operator that an inquiry form was received (app name, inquiry type, reply email address, first 300 characters of the inquiry content)
- Microsoft Corporation (United States, Outlook.com): receiving and storing inquiry emails and sending replies

5. Transfer of personal information overseas
The collection server that receives app usage statistics and error information is operated by the Company itself and is located in the United States. All processors above also operate servers in the United States.
- Supabase, Inc. (United States): user account information, store operations data, supplier contact information, order information — for database and authentication purposes — retained per Section 3
- Google LLC (United States): push notification token, notification title and body (order number, customer name, item count, amount) — for push delivery — not retained after delivery
- Apple Inc. (United States): push notification token, notification title and body — for delivery to iOS devices — not retained after delivery
- Oracle Corporation (United States): the app usage statistics and error information, anonymous identifier and account identifier described in Section 1 item d — for operating the collection server and storing its backups — retained per Section 3
- Cloudflare, Inc. (United States): the transmission path taken by the information in Section 1 item d on its way to the collection server — for delivering and protecting that traffic
If you do not wish your information to be transferred, you may contact us at the address in Section 12. These transfers are, however, necessary to provide the service, so refusing them may limit your use of the corresponding features.
- Supabase, Inc. · Slack Technologies, LLC · Microsoft Corporation (United States): inquiry information in Article 1.f — for inquiry intake, notification, mail storage and replies — retained as described in Article 3

6. Provision to third parties
The Company does not provide or sell personal information to third parties without the user's consent, except where required by law.

7. Destruction
When the retention period expires or the purpose of processing is achieved, information is destroyed without delay; electronic files are deleted by means that make recovery impossible. App usage statistics and error information may, however, remain in recovery backups for up to 30 days, after which they are deleted automatically.

8. Rights of users and how to exercise them
Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal information. Requests sent to the contact below are answered within 10 business days. The usage statistics and error information described in Section 1 item d may also be accessed or deleted on request, using the account identifier.
If a store's customer wishes to exercise rights over their order information, the controller of that information is the store that received the order, so please contact that store first. Likewise, if a supplier's contact person wishes to exercise rights over their contact details, the store that entered them is the controller, so please contact that store first. The Company supports any measures the store requests.

9. App permissions
- Notifications (optional): used to alert operators when a new order arrives. If denied, every other feature of the App remains usable and the order list still refreshes in real time while the App is open.

10. Security measures
- All communication is encrypted with HTTPS/TLS
- Row Level Security is applied in the database so each user can access only the data of the store they belong to
- Processing that crosses a trust boundary — order status transitions, refunds, inventory changes — is re-verified on the server rather than trusting client-supplied values
- Server-only credentials are never bundled into the App
- A push notification token can be registered or removed only by its own account
- The collection server exposes no port for direct inbound connections and receives traffic only through a dedicated tunnel

11. Children under 14
The App is a business tool for store operators and is not directed at children under the age of 14.

12. Personal information protection officer
- Officer: SangLimSoft Personal Information Protection Officer
- Email: support@sanglimsoft.com
- Hours: weekdays 09:00 – 18:00 (excluding public holidays)
Reports and consultations regarding personal information infringement may be directed to the following Korean agencies.
- Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
- Personal Information Dispute Mediation Committee: kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: spo.go.kr / 1301
- National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182

13. Changes to this policy
This policy may be revised in line with changes to laws or the service. Any change will be announced on the App's settings screen and on this page.
- September 3, 2026 (first effective date): corrected the store role wording that did not match the implementation (three levels of owner/manager/staff to a single owner role), stated the profile information collected (display name), and removed an item that is not actually collected (app version).
- September 22, 2026: corrected a statement that did not match the facts — the policy said the App "does not collect behavioral data and does not embed user behavior analytics SDKs" even though the App collects usage statistics and error information. Added the items collected and the location of the collection server (United States) to Section 1 item d, Section 4 and Section 5, and added the supplier contact information that had been missing to Section 1 item c.
- September 26, 2026: added website usage information (Article 1.e), information processed through inquiries (Article 1.f), the providers used for inquiries (Slack, Microsoft), and their retention.
- October 2, 2026: corrected the inquiry-notification tool to Slack, and added the access IP address that is stored when the contact form is submitted.

This policy takes effect on October 2, 2026.