Privacy Policy

Inventrixo is a point-of-sale, inventory and repair-tracking service for retail and device-repair shops. It is offered as a web application and as a desktop application that runs on the shop's own computer.

The service is operated by Inventrixo. For anything in this policy you can reach us at privacy@inventrixo.com.

Under UK and EU data-protection law there is an important distinction between deciding how personal data is used (a controller) and merely handling it on someone else's instructions (a processor). Inventrixo is both, depending on whose data is in question.

So if you are a customer of a shop that uses Inventrixo and you want your data corrected or erased, the shop is who to ask — they control it, and they can do both from within the product. If they need our help to action your request, we will provide it.

Shops acting as controllers need a written processor agreement from us. That is our Data Processing Agreement, which forms part of our terms.

We collect only what the service needs in order to work. Specifically:

We do not use analytics, advertising or tracking software of any kind. There is no Google Analytics, no advertising pixel, no session recording, and no third-party script that profiles you. We do not sell personal data, and we do not share it for advertising.

Inventrixo sets only the cookies needed to keep you signed in and to protect sign-in forms against cross-site request forgery. These are strictly necessary to deliver a service you have asked for, so under the UK PECR and the EU ePrivacy Directive they do not require consent — which is why you are not asked to accept cookies here.

We set no analytics, advertising or preference cookies. If that ever changes we will ask for your consent before setting them, and update this policy first.

The desktop application is local-first by design. Your shop's records — products, sales, customers and repairs — are stored in an encrypted database file on your own computer and are not uploaded to us.

That file is encrypted with AES-256-GCM, with the key strengthened using PBKDF2-SHA256 at 210,000 iterations. You can optionally add a passphrase of your own. You can export everything, or erase everything, at any time from Settings › Privacy & data.

The desktop app contacts our servers only for these things, and nothing else:

• Checking your licence or subscription status
• Registering the start of a free trial, to prevent trial abuse
• Answering an AI request, if and when you invoke an AI feature
• Checking for and downloading application updates

If you use the web application instead, your records are stored on our servers as described below. Which of the two you use is your choice.

This section matters most if you are in the UK or the EU, so we will be direct about it: our servers and database are located in the United States (AWS US East, Northern Virginia).

If you are in the UK or the EU, using the web application therefore involves transferring your personal data outside your own jurisdiction. The United States does not have a general adequacy decision, so such transfers rely on a safeguard mechanism — the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses, together with an assessment of the transfer. Those safeguards are set out in our Data Processing Agreement.

If you would prefer your shop's data never to leave your premises at all, use the desktop application. It stores everything locally, as described above, and it is the option we would point a privacy-conscious shop towards.

We do not currently offer a UK or EU hosting region for the web application. If that changes we will say so here, and tell existing customers before it takes effect.

We use a small number of service providers to run Inventrixo. Each is bound by contract to process data only on our instructions. This is the complete list — we do not add one without updating this page.

On AI features specifically: a request is sent only when a user actively invokes one, and it carries the question plus the shop context needed to answer it. Our AI provider processes it to produce a response and does not use it to train their models. If you would rather no data reached an AI provider at all, do not use the AI features — every other part of the product works without them.

On payments: card details are entered on our payment provider's own hosted page and are handled by them as merchant of record. We never see or store your card number.

You can delete your shop's records yourself at any time — in the desktop app from Settings › Privacy & data, and in the web app by asking us to close your account. Deletion is permanent.

• Passwords are stored only as salted hashes. Nobody at Inventrixo can read your password.
• Two-factor authentication is available on web accounts, and we recommend enabling it.
• All traffic to and from the service is encrypted in transit (TLS).
• The desktop database is encrypted at rest with AES-256-GCM, and a tampered file is detected rather than silently accepted.
• Access to production systems is limited to those who need it to operate the service.
• Staff accounts within your shop have roles, so you can limit what each employee can see and do.

No system is perfectly secure, and we would rather say so than imply otherwise. If we discover a breach affecting your personal data, we will notify the relevant supervisory authority within 72 hours where the law requires it, and tell you directly where there is a risk to you.

If you are in the UK or the EU you have the rights below. We honour them for everyone, wherever they are, because drawing that line by geography would be mean-spirited.

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate.
• Erasure — deletion, where we have no overriding obligation to keep it.
• Portability — your data in a structured, machine-readable format. The desktop app does this for you in one click, as JSON plus a spreadsheet per table.
• Restriction and objection — to limit or object to particular processing.
• Withdrawing consent — where we relied on consent, at any time.

Write to privacy@inventrixo.com and we will respond within one month. We will not charge you, and we will not ask why.

You also have the right to complain to a data-protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the authority for your country. We would appreciate the chance to put things right first, but that is your choice, not a precondition.

Inventrixo is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, tell us and we will delete it.

If we change how we handle personal data we will update this page and change the date at the top. Where a change materially affects you — a new sub-processor, a new purpose, a new data location — we will tell account holders by email before it takes effect, rather than relying on you to re-read this page.