Data processing addendum
Status: Draft, pending legal review. Version 1.0. This page will show an effective date and a “What changed” note once it is final. Our disclaimers page explains what a draft means.
What this addendum covers
This addendum is part of the merchant agreement between Amyn and your business. It explains how we handle the personal data you bring into Amyn about your customers, your staff and your other contacts. It applies for as long as we hold that personal data.
When you accept the merchant agreement, we record the version of this addendum you accepted, the time, your IP address and your browser (user agent).
Words we use
The website and account terms define the words we use in every policy. In this addendum:
- “Amyn”, “we” and “us” mean the company that runs amynpos.com and is building the Amyn point of sale.
- “You” means the merchant that holds an Amyn account and has accepted the merchant agreement.
- “Personal data” has the meaning in the terms. In this addendum it refers to personal data about your customers, your staff and your other contacts: what you enter into the service and what the service records for you while you run your business.
- “Your customers” means the people who buy from you, including people who order, pay, book, or join a customer list.
- “Sub-processor” means a company we use to help us store or process personal data for you.
- “Aggregate figures” means counts and totals that cannot be traced back to any person or any one business.
- “The merchant agreement” means the agreement at /merchant-agreement.
Who is responsible for what
The personal data you bring into Amyn is yours. You decide why it is collected and how it is used. For that personal data, we act only on your instructions. In privacy-law terms, you are the controller (or “business”) and we are the processor (or “service provider”).
We use that personal data for our own purposes only where the law lets a processor or service provider do so, and only for:
- keeping Amyn secure;
- detecting and preventing fraud;
- producing aggregate figures to improve the service;
- meeting our own legal duties, such as record-keeping the law requires.
These uses stay inside this addendum and its restrictions. They do not make us a controller of your customers’ or staff’s personal data.
Some records are ours, not yours, and for those we are the controller: your account details, the record of who accepted which agreement and when, billing records and our support correspondence with you. Data from the website itself, including the waitlist and contact forms, is also ours. The privacy notice covers both, not this addendum.
| What | Why we process it | Our role | Who answers privacy requests |
|---|---|---|---|
| Your customers’, staff’s and contacts’ records in your account | To run the service for you, on your instructions | Processor (service provider) | You. We help, as “Helping with privacy requests” describes. |
| Your account, acceptance, billing and support records | To run our relationship with you | Controller (business) | Us, under the privacy notice |
| Website visitors, the waitlist and the contact form | To run the website | Controller (business) | Us, under the privacy notice |
We never use personal data to advertise to anyone. We never sell it, and we never share it for advertising. Once we have turned personal data into aggregate figures, we do not try to work out who is behind them.
Counsel: confirm these roles against the CCPA regulations (sections 7050 and 7051) and the processor terms of other state privacy laws, including whether the security, fraud and legal-duty uses sit inside the service-provider role or need a separate controller role, and whether any further contract terms are required.
Whose data, and what kinds
The people whose personal data we process for you are:
- your customers;
- your staff, including owners, managers, cashiers and anyone else you give a login;
- suppliers and other contacts you store in the service.
The kinds of personal data are what a point of sale needs. For your customers: names, contact details, order and purchase history, bookings, receipts, refunds and any notes you add to a record. For your staff: names, roles, timecards, tips and login events.
Amyn is designed to keep full card numbers out of its systems; the point of sale is built to hold only the last four digits and the card type. Card data, payouts and the identity checks the law requires will be handled by a payment processor. We have not chosen one yet. When we do, we will name it under “Companies that help us” below and say which of its work this addendum covers and which its own agreement with you covers.
Amyn is not built to hold government ID numbers, health records or similar sensitive personal data. Please do not put them in notes or customer records. Amyn is for businesses and is not directed at anyone under 18.
If you run a clinic or another health business, Amyn supports what a front desk needs: a customer’s name and contact details, the date and time of an appointment, the item or service sold and its price, and the payment. It is not built for diagnoses, treatment notes, prescriptions, test results or any other identifiable health information. Until we publish health-data terms, identifiable health information must not be stored anywhere in the service, including in booking names, receipt lines and notes. A service name can itself reveal health information, so keep those general until then. Counsel: whether any clinic use brings HIPAA business-associate duties or state consumer-health-data laws, such as Washington’s, and what health-data terms and product controls are needed before a clinic can use Amyn.
We follow your instructions
We process personal data only to run the service for you, to support you, and as this addendum and the merchant agreement describe. Your settings, the features you turn on and the requests you send us count as your instructions. We take instructions from your owner and admin accounts, and from anyone you tell us in writing may speak for your business.
Sometimes a law may require us to handle personal data in a way you did not ask for. If so, we will tell you before we do it, unless that law stops us from telling you. If we think one of your instructions would break the law, we will say so. We will then wait for you to confirm it or change it.
We do not train AI models on personal data, and we do not let anyone else do so.
Our people keep it confidential
Every Amyn team member who can see personal data has signed a confidentiality agreement with us. Only people who need access for their job have it. Our staff do not open your live data without a recorded reason, such as a support request from you or a security investigation.
How we protect personal data
We protect personal data with these measures:
- Separation by business. Each record carries the identifier of the business it belongs to, and database access rules are designed to let a business reach only its own records. We test those rules before we release changes to them, and we treat any gap we find as a security issue.
- Encryption. Data is encrypted in transit (HTTPS) and at rest.
- Access limits. Each login has a role that sees only what it needs. Owner and admin accounts will be required to use two-step sign-in, and so will the Amyn team accounts that administer our systems.
- Logging. Sign-ins, new devices, permission changes and sensitive actions are recorded, so both you and we can see who did what and when.
- Private storage. Uploaded images are stored privately and served through short-lived links.
If you find a security problem, our responsible disclosure policy explains how to tell us.
Companies that help us (sub-processors)
We use a few companies to run Amyn. Each company named below has data-processing terms in place with us. Those terms limit it to providing its service to us and require it to protect personal data. We check those terms before we add a company and when they change. We stay responsible to you for their work. Today our sub-processor for the personal data in your account is:
- Supabase, Inc. Database, sign-in, file storage and server functions. United States.
One more company handles data we control, not the personal data in your account, so it is not a sub-processor under this addendum. We list it so you can see every company we use:
- Netlify, Inc. Hosts the website and receives the waitlist and contact forms. United States. The privacy notice covers that data.
The payment processor has not been selected. It is not a sub-processor today, and no agreement with one exists. Before payment onboarding begins, we will name it here with its location, explain its role in each thing it does (card processing, payouts and the identity checks the law requires), say which of that work it does as our sub-processor and which under its own agreement with you, and link to the agreements that apply.
The help assistant on the website is provided by Anthropic (model: Claude). It is not a sub-processor of the personal data in your account. It receives only what a person types into the chat, and it cannot reach your account or the personal data in it. Chats are kept briefly, and Amyn never uses them to train AI models. Please do not type card numbers, passwords or sensitive personal data into it. Our AI notice says more.
We keep this list current here, and the privacy notice names the same companies. If we plan to add or replace a sub-processor, we will email account holders at least 30 days before the change. If you object on data-protection grounds and we cannot resolve it, you may end the merchant agreement before the change takes effect.
Helping with privacy requests
Your customers and staff may ask to see, correct, delete or receive a copy of their personal data. Those requests are yours to answer. We help in two ways:
- Amyn will give you tools to find, export, correct and delete a person’s record yourself. We will describe them before launch.
- If a request reaches us instead, we pass it to you promptly. We answer it ourselves only if you ask us to or the law requires it.
You may need to assess the privacy risk of using Amyn, or a regulator may ask you about it. In either case, we will give you the information we hold about how Amyn processes personal data.
How long we keep personal data
While you use the service, personal data stays under your control. A customer record with no activity for 24 months is flagged for your review. Activity means a sale, a booking, a payment, a refund or an edit to the record. When a record is flagged, we tell the account owner by email and in the service, and a review period runs before anything happens. If you choose to keep the record during that period, we keep it. If you do not, we anonymise it when the period ends. Anonymised means it no longer identifies the person, and it cannot be undone. We will publish the length of the review period and exact retention periods before launch.
Checking our security (audits)
Once a year, on request, we will give you a written summary of our security measures and any independent review we have had. You may also send us one reasonable security questionnaire a year, and we will answer it. Both are confidential. These are the reasonable steps you can take to check that we handle personal data as this addendum and the law allow. If the law gives you a right to assess or audit us beyond this, or a regulator requires more, we will agree a reasonable plan with you that does not expose other merchants’ data. Counsel: confirm this meets the assessment and audit rights that state privacy laws give a controller over its processor.
If there is a breach
A breach means someone accessed, took, changed or lost personal data without permission. If we discover, or have reason to believe, that a breach affects personal data we process for you, we will tell you without undue delay, never later than 72 hours after we become aware of it, and sooner where the law sets an earlier deadline. We will tell you what we know first and update you as the investigation continues: what happened, what data was involved, what we have done, and what we suggest you do. Counsel: the 72-hour clock to be settled against state breach-notice laws, some of which start the clock when a service provider has reason to believe a breach occurred, and against the requirements of the payment processor we choose.
Each of us makes the notifications the law requires of it. Telling the affected people or a regulator about your customers’ and staff’s data is normally your decision, and we will give you what you need to make it. Where the law puts a duty to notify on us, we will meet it, and we will coordinate with you where the law allows.
When the agreement ends
When the merchant agreement ends, you can export your personal data records in a common readable format for 60 days. This is the same export window the merchant agreement gives you for the rest of your data. When those 60 days end, we delete personal data from our active systems. The only exceptions are data we must keep for a legal duty, an open dispute or fraud prevention. We keep that data for that purpose only, limit who can reach it, and delete it when the duty ends, the dispute closes or the fraud risk has passed. Data we keep for those reasons stays under this addendum until we delete it.
Backups work differently. A copy of deleted data can remain in our backups until those backups are overwritten on their normal cycle. We do not use a backup to bring deleted personal data back into use, except to recover from a failure, and then we delete it again. We will publish the backup cycle before launch.
Apart from those exceptions and backup copies, what we keep after you leave is aggregate figures, which identify neither a person nor your business. We do not keep using your sales data in any form that identifies a person or your business. If you ask, we will confirm the deletion in writing.
Our promises under California law
For personal data about California residents, we are your service provider and promise that we:
- do not sell personal data;
- do not share it for targeted advertising (what California law calls cross-context behavioural advertising);
- do not keep, use or disclose it for any purpose outside the merchant agreement, except the uses listed under “Who is responsible for what” and as the law allows;
- do not use it outside our direct business relationship with you;
- do not combine it with personal data from anyone else, except as the law allows for security, fraud prevention and aggregate service improvement;
- give it the same level of protection that California law requires of you;
- tell you before we add a sub-processor, and bind each one in writing to the same promises;
- let you take reasonable steps, as “Checking our security” describes, to check that we use it as this addendum allows;
- will tell you if we can no longer meet these promises;
- will stop and fix any use of personal data that you reasonably believe is not allowed.
We make the same promises for residents of every other US state.
Counsel: service-provider wording to be settled against the CCPA and its regulations, including the same-level-of-protection, sub-processor and assessment terms, and the processor-contract terms of other state privacy laws.
Your own duties
You agree that you:
- have a lawful reason to collect the personal data you put into Amyn, and give people the notices the law requires, including your own privacy notice;
- obtain any consent the law requires, for example before you send marketing texts;
- give logins only to people who need them, and remove access when someone leaves;
- keep your account secure, and tell us at once if you suspect misuse;
- follow the rules of the payment processor we choose, and the card networks’ rules, for any card data you handle yourself;
- follow our acceptable use policy.
Where personal data is processed
The database that holds the personal data in your account runs in a Supabase region in the United States. That is what we have verified so far. We have not yet confirmed the location of every related activity: backups, logs, support access and the companies our providers use in turn. Before launch we will publish the processing location for each provider and each activity, and we will only say “United States only” once the whole chain supports it. If a location changes after that, we will tell you at least 30 days in advance, as for a sub-processor change.
How this addendum fits with the merchant agreement
If this addendum and the merchant agreement say different things about personal data, this addendum wins. For everything else, the merchant agreement wins. The merchant agreement’s governing law applies to this addendum too. So does its liability cap: the fees you paid to Amyn itself in the 12 months before the claim, or the minimum cap the merchant agreement sets if you paid us none. Counsel: governing law (Amyn’s home state) and the liability cap to be settled with counsel; confirm both cover this addendum. For the cap, define the fee base (fees paid to Amyn, not charges paid to a payment processor), decide a fallback for a merchant who has paid us no fees in those 12 months, and decide whether breach and confidentiality claims under this addendum sit inside or outside the cap.
How to contact us
Email info@amynpos.com or use the contact form on the website. Put “Data processing” in the subject line so we can route it. If you need this document in another format, ask us; our accessibility statement explains how we help. We will publish our mailing address here before launch. Every policy, with its version and effective date, is listed at /policies.
If you are a customer of a business that uses Amyn, please contact that business first; it controls your personal data. If you write to us instead, we will pass your request to the business. Any request we must answer ourselves, we answer within 45 days, with one extension where the law allows, as the privacy notice explains.
Changes to this document
Every version of this document carries a version number, an effective date and a “What changed” note. Earlier versions stay in an archive linked from /policies. If we make a material change, we email account holders at least 30 days before it takes effect. Smaller changes, such as fixing a typo or a link, take effect when posted. This is version 1.0, and no earlier version exists.
A material change to this addendum is one such as a new sub-processor, a new purpose for personal data or a change to where it is processed.