Privacy Policy

Triada POS is a point-of-sale and management platform for retail businesses, available on the web (app.triadapos.com) and complemented by a public catalog (catalogo.triadapos.com/{slug}), link pages (links.triadapos.com) and this site (triadapos.com).

The controller of the data of people who create an account is Jensi Matos, operating under the trade name Triada Studio, based in República Dominicana. In this policy, "Triada", "we" and "our" refer to that entity.

For any privacy-related question you can write to us at soporte@triadapos.com.

Triada acts as the data controller for the data of the person who opens and manages an account: their registration, login, billing and service usage data.

When you, as a business, record information about your own customers and employees in Triada POS, your business is the data controller of that data and Triada acts as the data processor: we process it only to provide the service to you and following your instructions, that is, the actions you perform in the app. Your business is responsible for having a legal basis to collect that data and for handling requests from those individuals.

Depending on how you use the service, we process the following categories of data.

• Account data: first and last name, business name, personal and business phone numbers, email address, business email, store type and how you heard about Triada.
• Sign-in: authentication is handled by Clerk using email and password, Google or Apple. Triada never sees your password. We use Resend for email verification and transactional messages.
• Your business operating data: products, inventory, sales, payments (including images of transfer receipts), purchases, expenses, cash register sessions, accounting, CRM, discounts, combos, employee time tracking and the files or logos you upload.
• Wallet card references: only brand, last four digits, expiration date and cardholder name. We do not store full card numbers.
• Customers and employees you record: name, phone, email, address and notes of your customers; name, email, phone, compensation and app access of your employees.
• Plan billing: payment is processed by Polar as the merchant of record. Triada keeps only a summary of the subscription and orders and the customer identifier at Polar. Your card details never pass through Triada.
• Security data: sign-in events with their date and time, PIN stored in encrypted form (hash), session lock status, audit logs and technical diagnostics that contain only counts and durations. Diagnostics are deleted after 30 days.
• Support: the tickets you send us and their content.
• Artificial intelligence assistant: your conversations with the assistant, including text and images, token usage and the requests the assistant could not answer, which the Triada team may review to improve the service.
• Website: a cookie called triada_lang that remembers your language for one year, and local preferences such as the visual theme. We do not use advertising cookies or scripts.
• Product analytics and session recording: on this site and in the web app we use PostHog to understand how the service is used, measure the sign-up process and reproduce errors. It records the pages you visit, clicks and a session recording in which the content of every form field (passwords, codes and anything you type) is hidden. In the app it is linked to your account’s internal identifier, never to your email or name.
• Data collected automatically: when you use the site and the web app, our servers and providers record your IP address, browser type, operating system and device, the pages or features you use, access dates and times, and error logs. We use them to operate the service, keep it secure and detect failures.

We use only the cookies and local storage necessary for the service to work. We do not use advertising cookies or third-party cross-site tracking cookies.

• triada_lang: remembers your language for one year.
• Session and authentication cookies: set by Clerk to keep you securely signed in.
• Browser local storage: saves preferences such as the visual theme and interface settings.
• PostHog cookie and storage (ph_*): a random identifier shared between triadapos.com and app.triadapos.com to measure usage and the sign-up process for one year.

We process your data only for specific purposes and on a valid legal basis.

• Providing the service you signed up for: creating and maintaining your account, recording your operations, syncing your devices and offering you support. Basis: performance of the contract.
• Charging for and managing your subscription, and complying with accounting and tax obligations. Basis: performance of the contract and compliance with legal obligations.
• Maintaining account security, preventing fraud and abuse, and keeping audit logs. Basis: legitimate interest.
• Sending you necessary communications about your account, such as email verifications and service notices. Basis: performance of the contract.
• Providing the artificial intelligence assistant when you choose to use it and improving its quality. Basis: your consent when using the feature and our legitimate interest in improving the service.
• Handling your requests and exercising or defending legal claims. Basis: compliance with legal obligations and legitimate interest.
• Measuring use of the site and the app, detecting failures and reproducing errors to fix them. Basis: legitimate interest in improving the service.

We do not sell your data. To operate Triada POS we share only the strictly necessary information with providers that process it on our behalf and are bound by confidentiality and security obligations.

• Clerk: user authentication and identity.
• Convex: database and file storage.
• Vercel: hosting of the web app, the catalog and this site.
• Polar: payments and billing as merchant of record.
• Resend: sending of transactional and verification emails.
• PostHog: product analytics, session recording with hidden form fields and error logging, with servers in the United States.
• Anthropic, OpenAI or Google: processing for the artificial intelligence assistant, only when you use the assistant and depending on the provider we have configured. The content of the conversation is sent to that provider to generate the response.
• Google and Apple: sign-in, only when you choose those options.
• Authorities or other third parties, when required by law or a valid order.
• Meta services: if you connect Meta services (for example WhatsApp, Facebook or Instagram) to your account, we use the data Meta provides to us solely to offer you that feature. We do not sell it, we do not use it for advertising or for any other unrelated purpose, and you can request its deletion as explained on the data deletion page.

Several of our providers operate mainly in the United States, so your data may be processed and stored outside República Dominicana. When this happens, we seek to ensure that reasonable contractual and technical safeguards are in place so that your data receives adequate protection, in line with the applicable regulations (República Dominicana personal data protection rules).

The public catalog (catalogo.triadapos.com/{slug}) and the link pages (links.triadapos.com) display the information your business chooses to publish, such as products, prices, images, contact details and links. That content is visible to anyone with the link and may be indexed by search engines. Publish only what you want to be public.

We keep your data while your account is active and for as long as necessary for the purposes described. Some specific periods:

• Artificial intelligence assistant conversations: deleted after 90 days of inactivity.
• Offline operation diagnostics: deleted after 30 days.
• When an account is deleted we keep a minimal audit record (business name, email and date) for 5 years.
• Polar keeps billing records for as long as the law requires.
• Our providers' backups may retain data for up to 30 days after deletion.

We apply reasonable technical and organizational measures to protect your data: encrypted connections, authentication delegated to a specialized provider, hashed PIN storage, session locking, audit logs and access control over each business's information. No system is completely infallible; if we detect an incident affecting your personal data, we will act in accordance with the applicable regulations.

You can help too: use a PIN, do not share your credentials and sign out on devices that are not yours.

Under the personal data protection rules of República Dominicana, you may exercise the following rights over your personal data:

• Access: find out what data of yours we process.
• Rectification: correct inaccurate or incomplete data.
• Deletion: ask us to delete your data. Write to us at soporte@triadapos.com with the subject "Account deletion request"; the full procedure is on the account and data deletion page.
• Objection: object to certain processing.
• Portability: receive your data in a usable format. The web app lets you export your information to Excel.

Triada POS is intended for people who run a business and is not meant for people under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us with data, write to us at soporte@triadapos.com and we will delete it.

We may update this policy to reflect changes in the service or in regulations. The date of the last update appears at the top of this document and, when the change is significant, we will notify you in the app or by email.

To exercise your rights or resolve any question, write to us at soporte@triadapos.com. We will respond within a maximum of 30 days.