zrsPOSzrsPOS — Privacy Policy
Version 1.1 · 22 October 2026 · Contact: support@zrspos.com
This policy explains what personal data zrsPOS processes, why, and how. It is written for three groups of people:
- merchants who install zrsPOS on their Shopify store, and their staff;
- their customers, whose data appears on the fiscal documents issued through zrsPOS;
- visitors to zrspos.com, including people who send us an access request.
Who we are
- Provider and controller (for the processing listed under "Data we process as controller"): [Nome], trading as zrsPOS
- Address: [morada]
- Tax number (NIF): [NIF]
- Contact: support@zrspos.com
- Data protection officer: none appointed. The law does not require one for this processing. Write to support@zrspos.com about anything to do with your data.
The Terms of Service and the Data Processing Agreement complete this policy.
What zrsPOS does
zrsPOS connects a merchant's Shopify POS to the merchant's own SAGE invoicing software. Every sale, refund and exchange at the till then produces a Portuguese fiscal document, issued by the merchant's SAGE, and zrsPOS prints it.
It can also do two optional things:
- help the merchant issue Global Blue tax-free forms for eligible travellers;
- close the till at the end of the day.
Who is responsible
For the merchant's customers' data, the merchant is the controller. The merchant decides to issue the invoices and is legally obliged to keep them. zrsPOS is the merchant's processor. It acts on the merchant's instructions under our Data Processing Agreement. If you bought from a shop that uses zrsPOS, contact that shop first about your data; we help it answer.
zrsPOS is the controller for:
- the data of the merchants and staff who install, configure and pay for the app;
- access requests sent through our website;
- support e-mails;
- the technical data our servers record when anyone visits zrspos.com or uses the app.
The merchant's customers' data (we process it for the merchant)
We receive this data from Shopify when a sale, refund or return happens. Some of it the merchant's staff capture at the till with the zrsPOS POS tiles.
| Data | Why |
|---|---|
| Name, tax number (NIF), billing address | Required content of a Portuguese invoice |
| E-mail, phone | Sending the document to the customer if the merchant chooses to; finding the document again at the POS; the customer record in the merchant's SAGE |
| Order lines, amounts, payment method, store location, refunds | Issuing and correcting the document |
| Tax Free only: traveller's first and last name, country of residence, nationality, passport (or other travel document) number, type, issuing country and expiry, date of birth, gender, the passport's machine-readable zone (MRZ), and an optional e-mail and phone | Preparing the Global Blue tax-free form the traveller asks for |
How Tax Free capture works.
- At the till, the zrsPOS Tax Free tile saves the traveller's name, country and document number on the Shopify order, as order attributes.
- At the counter, the tablet running the zrsTaxFree app photographs the passport's machine-readable zone and sends the image to our server.
- Our server reads the image with text recognition, in memory, and returns the fields for the staff to confirm. The image is not stored.
- The fields above are sent to Global Blue to issue the form.
The merchant's staff. When staff close the till, archive an incident or switch the shop live, we record their Shopify staff identifier, and their e-mail when Shopify provides it, so the merchant can see who did what. We do this for the merchant too.
Where this data goes, on the merchant's instruction:
- The merchant's own SAGE, which issues the certified document. zrsPOS looks the customer up there by NIF or e-mail. If the customer is not found, zrsPOS creates a customer record with their name, NIF, e-mail, phone and address.
- The merchant's Shopify store. The issued document's reference is written to the order. A NIF captured at the till is saved on the order. When a customer is attached to the sale, it is also saved on that Shopify customer's profile. Tax Free traveller details are saved on the order.
- The merchant's receipt printer, which prints the receipt.
- Global Blue, only for tax-free forms the merchant issues with its own Global Blue account.
- Our e-mail provider (Resend), when the merchant e-mails a document to a customer. The e-mail is sent in the shop's name. It comes from zrsPOS's address, or from the shop's own address once the shop has verified its domain with us.
Data we process as controller, and our legal bases
| Data | Purpose | Legal basis (GDPR art. 6(1)) |
|---|---|---|
| The merchant's account: Shopify store domain, the app's access to the store, the configuration entered (SAGE address and key, printers, devices, Global Blue login, document layouts, the shop's sending address, the e-mail addresses chosen to receive till-close summaries and online-return alerts), the organisation's name, NIF and billing e-mail | Providing the service the merchant subscribed to | (b) contract |
| Subscription and usage (plan, locations, documents counted), billing and service notices to the billing e-mail | Charging through Shopify Billing and telling the merchant about its account | (b) contract; (c) legal obligation for our accounting records |
| Access requests from the website form: company, NIF, contact name, e-mail, phone, Shopify domain, number of locations, SAGE version, chosen plan, message, and the IP address the form was sent from | Answering the request and setting up the merchant | (b) steps at your request before a contract; (f) legitimate interest in keeping the form free of abuse (the IP address) |
| Support e-mails to support@zrspos.com | Answering you | (b) contract or pre-contract; (f) legitimate interest when you are not a customer |
| Server request logs (IP address, time, address requested), and alerts to our team about failures | Running, securing and fixing the service | (f) legitimate interest in a secure, working service |
| Records of data requests and erasures received from Shopify | Showing that we handled them | (c) legal obligation (GDPR accountability) |
Merchant credentials (SAGE key, Shopify access, Global Blue login) are encrypted with a key unique to the store.
We do not process payment card data. Payments for zrsPOS are handled by Shopify. We do not use personal data for marketing, profiling or automated decisions, and we never sell it.
Cookies and storage in your browser
- zrspos.com (the website, the manual and these pages) sets no cookies and uses no analytics or advertising trackers. Its pages load their typeface from Google Fonts, so your browser connects to Google when you open them.
- The zrsPOS admin runs inside the Shopify admin and loads Shopify's own App Bridge scripts. Shopify's cookies are governed by Shopify's policies. zrsPOS itself keeps only the interface language, in the browser's session storage for that tab.
- The zrsTaxFree tablet app keeps the following in the tablet's local storage, so the tablet
stays paired and in the language and theme chosen:
- its pairing token;
- the shop's address;
- the language and theme chosen.
All of this is strictly necessary for the service you asked for, so no consent banner is needed.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Railway Corp. | Hosting the application | EU (europe-west4, Netherlands); US company |
| Supabase Inc. | Database and backups | EU (eu-west-1, Ireland); US company |
| Resend (Plus Five Five, Inc.) | Sending e-mail: documents to customers on the merchant's behalf, till-close summaries and alerts the merchant set up, billing and service notices to merchants, alerts to our team. A shop that uses its own sending address has its domain registered in our Resend account | US company |
| Our support mailbox (Google Workspace); the website's typeface (Google Fonts) | US company |
Cloudflare provides our domain's DNS only. It does not carry our web traffic or our e-mail.
Shopify, Global Blue and the merchant's SAGE are not our providers. They are the merchant's own platform, Tax Free provider and invoicing software, and they receive data because the merchant uses them.
International transfers
Our hosting and database run in the European Union. However, Railway, Supabase, Resend and Google are US companies, and Resend and Google may process data in the United States.
For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it. Otherwise we rely on the European Commission's Standard Contractual Clauses in the provider's data processing terms. You can ask us for a copy of the relevant safeguards at support@zrspos.com.
How long we keep it
While the app is installed:
| Data | Kept |
|---|---|
| Raw order and refund events received from Shopify | 90 days in full (for retries and audit). Then cut down to a non-personal skeleton: order number, totals, lines, location, payment method |
| Records of each issuing attempt | E-mail and phone removed 90 days after the attempt finished. Name, NIF and address stay, as part of the fiscal record |
| Our copy of each issued fiscal document (name, NIF, billing address, items, totals, document number) | For the period Portuguese law requires invoices to be kept (currently 10 years). E-mail and phone are removed on request and after the uninstall |
| Receipt print jobs | The receipt's content is deleted after 30 days. For a fiscal document, a record that its receipt was printed stays, so a later print is marked as a copy |
| Till closes (totals, the counted cash, the staff identifier of whoever closed) | As business records, like the documents they summarise |
| Tax Free passport data | Removed 7 days after the Tax Free session ends |
| Image of the passport's machine-readable zone | Not stored |
| Our copy of an issued Tax Free form (for reprints) | Until a redaction request for that order, or the uninstall |
| Website access requests | Deleted after 24 months |
| The merchant's organisation, subscription and billing records | For as long as our accounting and tax obligations require (up to 10 years) |
| Server request logs | For a short period, by our hosting provider |
Deleted data can remain in our database provider's encrypted backups until those backups roll over.
After the merchant uninstalls zrsPOS, Shopify sends us a deletion notice 48 hours later. We then delete:
- the shop's configuration, credentials and encryption key;
- printers and devices;
- document layouts and till-close settings;
- the sending address, which is also removed from Resend;
- raw Shopify events and the content of print jobs;
- all Tax Free sessions and form copies.
Some records stay under the legal retention above, without e-mail or phone:
- our copy of the issued fiscal documents and the records that issued them;
- the till closes;
- our records of the merchant's organisation, subscription and billing.
The certified originals are in the merchant's own SAGE, which is the merchant's legal archive. We do not keep an archive or offer an export after the uninstall. Anything the merchant wants from zrsPOS (reprints, downloads) must be taken while the app is installed. If the merchant reinstalls before the notice arrives, nothing is deleted.
Records we keep after a request. When Shopify sends us a customer's data or erasure request, we record it. The record holds the customer's Shopify id, the order numbers and a one-way fingerprint of the e-mail address, never the address itself.
Your rights
You have the right to:
- access your data;
- have it rectified;
- have it erased;
- restrict its processing;
- data portability;
- object to processing based on legitimate interest.
Write to support@zrspos.com.
For data on a shop's fiscal documents, the shop is the controller, so contact the shop. Shopify passes its requests to us and we act on them:
A data request. We record it, our team is alerted, and we give the merchant the data we hold for those orders within 30 days.
An erasure request. We remove:
- the e-mail and phone everywhere we copied them (documents, issuing records, raw events, store-credit vouchers);
- the personal parts of the raw events, cutting them to their non-personal skeleton;
- the Tax Free passport data and our copy of the Tax Free form for those orders.
We cannot erase the name, NIF or address on an issued fiscal document, because Portuguese law requires the document to be kept intact. We record why, so the merchant can explain this to you. The same applies to the copy in the merchant's own SAGE, which the merchant manages.
Merchants can see and change everything they've configured inside the app. Uninstalling it triggers the deletion above.
You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. You may instead complain to the authority of the EU country where you live or work.
Security
- Isolation. Every record is bound to the store it belongs to. Automated tests prevent any store's data from being reachable by another.
- Credentials. They are encrypted per store.
- Connections. We use TLS on every connection we control.
- The connection to the merchant's SAGE uses TLS when the merchant's SAGE endpoint offers it, which we strongly recommend.
- The "Direct" printer mode, meant for demos and tests, sends receipts unencrypted to the printer's public address. The other printer modes connect to us over TLS.
- Storage. Our hosting providers encrypt storage and backups.
- Staff access. Access by zrsPOS staff is limited, logged, and protected by two-factor authentication.
Our Data Loss Prevention Strategy and Security Incident Response Policy are available to merchants on request. If a security incident affects a merchant's data, we notify that merchant within 24 hours of confirming it.
Changes and contact
We'll post changes to this policy here, and notify merchants of material changes by e-mail or in the app. Questions: support@zrspos.com.