MazalPOS Staff and Register apps

Privacy Policy

Effective October 12, 2026

MazalPOS is point-of-sale software for beauty and spa businesses, made and operated by Maor Investments Group, doing business as BH Maor Solutions ("we", "us"). MazalPOS Staff is the phone app for the employees and managers of stores that use MazalPOS. MazalPOS Register is the tablet app (iPad or Android tablet) a store uses at its counter. This policy explains what the two apps do with information about you. Where it says "the app", it means MazalPOS Staff; the Register has its own section below. It doesn't cover a store's website, or what a store does with its customers' details outside MazalPOS.

Who is responsible

The store that employs you decides which records it keeps about you (for scheduling, sales and payroll) and is responsible for them. BH Maor Solutions, which makes and operates MazalPOS, provides and hosts the system and is responsible for the app and the information it handles, which it handles on the store's behalf and on its instructions. Questions about this app or this policy can come to us at support@mazalpos.com. Questions about your job, pay or records should go to your store first.

What the app handles

Your account

• Your username and 4-digit PIN, both issued by your store. The PIN is stored only in scrambled (hashed) form, never as the digits themselves.
• Whether you are an employee or a manager.
• A sign-in token saved in the app on your phone, so you stay signed in. It expires after 30 days, and signing out removes it from the phone.

Details you can add or change

• Your display name, phone number and home address, under Account.
• A profile photo, only if you choose one. The app asks for access to your photo library, reads only the photo you pick, shrinks it to a small square, and saves it with your account. Managers see it when they plan shifts.
• Your email address is shown but can only be changed by your store.

Your work records

• Your shifts and schedule, and the time-off requests you send (dates, times and any note you write).
• Hours worked, recorded when you clock in and out at the store's register.
• Sales credited to you: receipt numbers, dates and amounts, and the names of coworkers who share a sale with you.
• Your hourly wage, salary group, commission, bonuses and estimated pay.

Notifications

If you allow notifications, your phone gives the app a push token, a code that lets a message reach this device. We store it with your account and use it to send things like schedule updates, team messages, bonuses and, for managers, sale alerts and approval requests. The text of each notification passes through Expo's push service and Apple's (on Android, Google's) notification service on its way to your phone. You can turn notifications off at any time in your phone's Settings.

If you are a manager

Managers use the app to run the store, so it shows and saves store records, including:

• sales, receipts, refunds and edits, payment links and website orders, which can include customers' names, email addresses and phone numbers;
• reports on sales, payments, products, stock and staff costs;
• the product catalog, including product photos picked from the photo library;
• employee records: name, contact details and address, pay settings, hire and release dates, and, where the store keeps them, date of birth, gender, Social Security number and driver's license or other ID number.

A manager can also email a receipt to a customer at an address they type in, and send a short message to employees. Team messages are delivered as notifications and are not stored.

If you are an employee: your manager can see your employee record, including any sensitive details the store keeps for hiring and payroll. Those are entered by the store. The employee side of the app doesn't show them to you or anyone else, and you can't change them there.

Technical information

• Our servers see your IP address when the app connects. We use it to block repeated wrong PIN attempts, and it appears in short-lived server logs.
• A device identifier (on Apple devices, Apple's identifier for this app's maker; on Android, the Android ID). The app sends it when a register is signed in, and with each sale so a sale sent twice over a bad connection is only recorded once. It isn't used for ads or to track you.
• The app checks for updates through Expo's update service. That check sends the app version, the phone's platform and a random installation ID. It doesn't include your name or account.

The MazalPOS Register app

MazalPOS Register is the same system on a tablet (an iPad or an Android tablet) the store keeps at its counter. What this policy says about your account, PIN, work records and notifications applies there too. This section adds what is particular to the till.

• The tablet. The store signs the tablet in once. Our server then gives that tablet its own sign-in token and store location, saved on the tablet. The store can switch it off from the back office at any time.
• Signing in at the till. Employees sign in with their username and PIN to open the day, clock in and out, and ring up sales. Each sale is credited to the person who rang it. Employees and managers can also open their own pages and the manager area on the till, which work as described above.
• Customers. A cashier can look a customer up or add one, with the name, email address and phone number the customer gives, and attach them to a sale or a booking. The till shows that customer's past receipts at the store.
• Payments. The tablet never reads a card. Cash and card payments are recorded as amounts; cards are taken on the store's own card terminal. If the store sends a customer a payment link, the customer pays on Stripe's page, and we receive only whether it was paid and how (card or Affirm).
• Receipts. A receipt can be printed, and a manager can email it to an address the customer gives.
• Photos. The photo library opens only when someone chooses a profile or product photo, and only the photo they pick is read.

If you are a customer of a store: the details the till records about you belong to that store, which decides how it uses them. Ask the store, or email us, to see, correct or delete them.

What we don't do

• We don't show ads or use advertising, analytics or crash-tracking tools in either app.
• We don't track you across other apps or websites, and we don't sell or rent your information.
• Neither app uses your location, contacts, camera or microphone, and neither reads a payment card.

How the information is used

• To sign you in and show you your own schedule, requests, sales and pay.
• To let managers schedule, approve, correct sales and run payroll.
• To send the notifications you've allowed.
• To keep the system secure and working, for example stopping someone from guessing a PIN.

Who can see it

• Your store. Its owner and managers, through this app and the MazalPOS back office.
• Coworkers, a little. Your display name appears on sales you share and on schedules managers see.
• Companies that run parts of the service for us, only to provide it: Render and Railway (hosting and databases, in the United States), Stripe (payment links a store sends a customer), Expo (app updates and notification delivery), Apple and Google (notification delivery to the phone) and Resend (email delivery, for example a time-off request emailed to a manager or a receipt emailed to a customer).
• Authorities, only when the law requires it.

How long it's kept

Your account and work records are kept while your store uses MazalPOS. When you leave, the store switches your account off and you can no longer sign in. Sales, hours and pay records stay with the store after that, because employers must keep payroll and sales records for several years. The same is true if you delete your account yourself: your personal details are erased, and those records stay under your first name and last initial. A device's push token is deleted when you sign out, when you delete your account, or once the notification service reports the app is gone from that phone. Backups made by our hosting provider are kept for a limited time and then deleted.

Your choices and rights

• See and edit your profile in the app under Account, and change your PIN there.
• Turn notifications or photo access off in your phone's Settings.
• Delete your account in the app, under Account → Delete my account (see below).
• Ask for a copy of your information, or for it to be corrected or deleted, through your store manager or by emailing support@mazalpos.com. We work with your store to answer, and aim to reply within 30 days.

Depending on where you live, you may have other rights, such as those under California law. We'll honor them, and we won't treat you differently for using them.

Deleting your account

You can delete your account in the app at any time. Employees tap Account in the bottom bar, then Delete my account. Managers tap Log out at the end of the bottom bar, then Delete my account. The app asks for your PIN to confirm. Deleting your account:

• closes it straight away: you are signed out, and your username and PIN stop working in the app and at the store's register;
• erases your personal details: your phone numbers, address, photo, email, and the date of birth, gender, Social Security number and ID number on your employee record;
• deletes your push tokens and notification settings, so no more notifications reach your phone;
• keeps the records the store must keep by law, such as sales, hours and pay, for as long as that law requires. They stay under your first name and last initial.

Your store's managers are told that the account was deleted. It can't be undone; if you work there again, the store creates a new account for you. The account the business itself signs in with (the owner's) can't be deleted in the app, so the store never loses access to its own system: email support@mazalpos.com for that. You can also ask your store manager or email us to delete your account for you.

Security

Everything between the app and our servers travels over an encrypted (HTTPS) connection. PINs are stored hashed, sign-in pauses after repeated wrong attempts, and the manager area only opens for people the store has marked as managers. Anyone holding your unlocked phone can open the app, so sign out if you share a phone. No system is perfectly secure; if we learn of a breach that affects you, we'll tell your store and you as the law requires.

Children

MazalPOS Staff and MazalPOS Register are workplace apps. They are not meant to be used by anyone under 16, and we don't knowingly collect information from children under 13. If you think a child's information was entered, email us and we'll delete it.

Where the information is stored

On servers in the United States. If you use the app from another country, your information is transferred to and handled in the United States.

Our website

This policy is about the apps. Our own website, mazalpos.com, uses Google Analytics to count visits and see which pages people read, so we can improve it. Google Analytics sets cookies and receives your browser's details and an approximate location; we don't send it your name, email or phone number. You can block it with your browser's cookie or tracking settings, or with Google's opt-out add-on at tools.google.com/dlpage/gaoptout. When you send the trial or demo form, the details you type go to us, so we can contact you.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. If a change matters to how your information is used, we'll let you know in the app or through your store before it takes effect.