Account and staff information. This can include names, email addresses, phone numbers, authentication information, employee profiles, job information, roles, permissions, schedules, time records, and account preferences.

Business and operational information.Storey handles information entered or generated while running a business, including company and location details, catalogs, inventory, customers and contacts, bookings, invoices, estimates, orders, transactions, refunds, tips, gift cards, loyalty activity, shipping and fulfillment records, communications, uploaded images or documents, and hardware or station configurations.

Payment information. Card numbers and card security codes are collected and handled through Valor or another applicable payment processor using a payment terminal or processor-hosted entry flow. Storey is designed not to store raw card numbers or card security codes. Storey may retain the processor’s transaction identifiers or tokens, payment status and amounts, and limited card descriptors such as card brand and last four digits when supplied by the processor.

Technical and operational information.Storey may handle device, browser, application, network, session, diagnostic, and error information needed to secure, operate, troubleshoot, and improve the service. We found no advertising-tracking or third-party behavioral-analytics implementation in the current product. If those practices change, this policy must be updated before they are used.

We use information to provide and secure Storey, authenticate users, enforce company roles and permissions, process and record business activity, connect enabled services and hardware, provide support, prevent misuse, troubleshoot failures, and administer the platform.

Merchants and authorized users determine much of the business and customer information entered into Storey and how it is used in their operations. They are responsible for providing appropriate notices and obtaining any consent required for information they collect from customers or employees.

A user can access their own account information and company or business information made available to them because they are listed as an employee or staff member of that company, subject to their assigned roles and permissions. Access controls are enforced by the service, not only by what the screen displays.

Authorized Paynetic Technologies LLC staff may access account or business information for legitimate purposes such as customer support, security, and platform administration. This access uses a server-enforced internal mechanism. Support visits are time-limited and recorded, and the service continues to identify the actual Storey staff account rather than logging that person in as the customer.

Authorized partner administrators may also receive server-limited access to the businesses in their own managed portfolio. They do not receive platform-wide access through that role.

Storey uses Lovable Cloud for hosted database, authentication, file storage, and related application infrastructure. Valor and other applicable payment processors handle card payment processing. We disclose information to these providers only as needed to deliver the service, process a requested transaction, maintain security, or meet legal obligations.

A merchant may choose to connect optional services for email delivery, calendars, marketing, accounting, shipping, and AI-assisted product content. Current integrations include services such as Resend, Google Calendar, Mailchimp, Kit, QuickBooks, Shippo, and Anthropic. Information is sent to an optional service only when the corresponding feature is enabled or used. The connected provider’s own privacy terms also apply.

We may disclose information when required by law, to protect people or the service, in connection with a corporate transaction, or with the merchant’s or user’s direction or consent. We do not state that Storey sells personal information, and no advertising-data sale mechanism was found in the current product.

The Storey apps use internet access. The Android application may also use notifications. When a merchant configures compatible equipment in the Android or Windows applications, they can communicate with USB devices, paired Bluetooth devices, and devices on the local network, including printers, scales, card readers, and external barcode scanners. The iPad and iPhone application does not currently connect to printers, scales, or card readers; Bluetooth barcode scanners that behave like a keyboard type into the app like any keyboard.

Camera. If a user chooses to scan a barcode or a driver license barcode for an age check, the app asks for permission to use the device camera. Images from the camera are read on the device to decode the barcode and are not saved or uploaded by Storey. A completed age check records the outcome (passed or failed), the required age, the time, and which staff member performed it, not the contents of the license. You can withdraw camera permission at any time in your device settings.

To keep business workflows available during temporary connectivity problems, the app can store functional data on the device, including authentication session information, preferences, catalog or stock cache data, and queued offline sales. Anyone controlling the device may be able to affect access to locally stored information, so merchants should use device locks and restrict physical access to point-of-sale devices.

We use technical and organizational safeguards intended to protect information, including authenticated access, company membership and permission checks, server-enforced support access, and processor-hosted card-entry paths. No system can guarantee absolute security.

Storey retains information for as long as needed to provide the service, preserve legitimate business and transaction records, resolve disputes, maintain security, and meet legal obligations. A single fixed retention period has not yet been established for every category of information; this policy should be updated when formal category-specific periods are adopted.

Users can update some account and business information in Storey, control optional integrations, and manage device permissions, including camera and notifications, in the device settings. Merchants may have legal obligations to respond to requests involving customer or employee information they control.

Storey currently provides limited CSV exports in specific parts of the product, including employee and workforce records and accounting transactions. It does not provide one complete, account-wide data export.

You can delete your own account at any time from the app or the website: open your profile (on the Floor, Settings, then Account) and choose Delete my account. An owner or administrator with the right permission can also remove other people from their business under Team. Deleting an account removes the person's login, name, contact details, photo, PIN and access. Business records such as sales, time and payroll history are kept for the business and legal, security, dispute-resolution, and transaction-record purposes, and show the person only as "Former team member". You can also send privacy and account requests to support@storeypos.com, and Storey will process them after verifying the requester's identity and authority.

Rights vary by location. We will evaluate requests under the laws that apply to the requester and the information, and may need to verify identity and authority before acting.

Storey is a business service and is not directed to children. We may revise this policy when the product, providers, or legal requirements change. The effective date above will identify the latest version, and material changes may also be communicated through the service or another appropriate channel.

Storey POS is operated by Paynetic Technologies LLC. Privacy and account requests can be sent to Storey's support email at support@storeypos.com.