Privacy policy

CEMAC POS is published by Opesware SARL, a company incorporated in Cameroon.

Two roles need distinguishing. For your user account data (name, email, password), Opesware SARL is the data controller. For the data you record about your own customers, your shop is the controller: we act as a processor, on your instructions, and never use it for our own purposes.

User account: name, email address, phone number, preferred language. Passwords are never stored in readable form — only an irreversible cryptographic hash is kept.

Your shop data: products, prices, stock, sales, payments, accounting entries, employees and payslips.

Your customers' data, entered by you: name, phone, WhatsApp, email, address, taxpayer number, loyalty card number and free-text notes.

Audit log: the action taken, the user, IP address, device identifier and timestamp. This log is required for OHADA accounting traceability and is tamper-evident.

Devices: platform (Android, iOS, browser, desktop), app version and last sign-in date. The device identifier is a hash, not your device itself.

Crash reports: error message, technical trace, the screen involved, platform and version. Used solely to fix faults.

We use no advertising trackers, no third-party analytics (Google Analytics, Facebook, Firebase or similar) and no ad networks. There is not a single line of any of them in the software.

We do not collect your location, your contacts, your photos, or anything from your microphone.

The camera is used only to read a barcode or QR code. The image is processed on the device and is neither stored nor transmitted.

We do not sell or rent any data, to anyone, ever.

To provide the service: taking payment, managing stock, issuing receipts and invoices, and keeping SYSCOHADA accounts.

To meet legal obligations: Cameroonian tax and accounting rules require records to be retained and an audit trail to exist.

To keep the service secure: detecting abusive access attempts and diagnosing faults.

To bill your subscription.

Data is hosted on shared servers operated by our hosting provider. Depending on where those servers are located, it may be processed outside Cameroon.

Traffic between your device and our servers is encrypted (HTTPS). Payment credentials held by the platform are encrypted at rest.

No data is shared with third parties beyond what is strictly necessary: our hosting provider, our email service to send you a receipt or a password reset, and MTN Mobile Money and Orange Money to collect your subscription payment.

Accounting and tax records: retained for the period required by applicable regulation. Sales and accounting entries are immutable and cannot be deleted, including by us — that is what makes the books defensible.

User account: kept while the account exists, then deleted on request as described below.

Crash reports and device records: kept as long as needed to diagnose a fault, then purged.

You can view and correct your account data in the app at any time.

You can request deletion of your account — see the "Account deletion" page. Deletion cannot erase accounting entries already recorded, because the law requires them to be kept; they are dissociated from your identity so far as possible.

You can request a copy of your data by writing to pos@cemacpos.com.

If you are a customer of a shop that uses CEMAC POS, contact that shop first: they decide how your data is used.

Passwords are hashed. Authentication tokens in the mobile app are held in the operating system's secure store (Android Keystore, iOS Keychain).

Access to a shop's data is isolated: one shop cannot reach another's.

No system is perfectly secure. If a breach occurs that is likely to harm you, we will tell you.