1. Information We Collect
- Account Information: Name, email address, business name, and the name, address, phone number and time zone of your first property, provided during signup.
- Data You Enter: The records you and your staff keep in the Service. For the Ski Valet module this includes guests’ names, room numbers or other references, any contact details you record, the equipment checked in, its tag numbers, where it is stored, and when it was handed back. It also includes the staff accounts you add.
- Billing Information: The Service does not collect or store card or bank details. Fees are invoiced separately under your written agreement.
- Activity Records: A record of the changes made in your account and of each sign-in, including the IP address and browser it came from, kept with your account.
- Acceptance Records: When you accept these documents we record the version you accepted, when, and the IP address and browser you accepted from.
2. How We Use Your Information
- To operate and maintain the Service.
- To improve the Service using operational metadata — request timings, error reports and counts. We do not examine the contents of your records to improve the Service.
- To send service-related emails (confirming your address, password resets, security notices, and the messages you ask the Service to send, such as a guest’s claim ticket).
- To detect and block abuse — e.g., repeated failed sign-ins or attempts to reach accounts other than yours.
- To keep the activity records described in Section 1 and make them available to you.
3. Data Storage & Isolation
Your data is stored in a database hosted with Amazon Web Services in the United States. Every request is bound to one account, and the database itself refuses any read or write of another account’s rows, so no query — however malformed — can reach another customer’s data.
Passwords are stored only as salted hashes, and links we email (password resets, address confirmations) are stored only as hashes. All data in transit uses TLS 1.2+.
4. Messages the Service Sends on Your Behalf
The Service sends email in two kinds.
To you and your staff. Address confirmations, password resets and security notices, sent through Amazon Web Services’ email delivery.
To people you direct. Where you ask it to — a guest’s claim ticket, a receipt — the Service sends that message to the address you give it, and to nobody else. It does not write your data to any third-party system.
5. Data Sharing
We do not sell personal or identifiable customer data to third parties. Limited disclosure occurs only:
- To service providers processing data on our behalf under confidentiality agreements: Amazon Web Services (hosting, and the delivery of our transactional email) and Cloudflare (bot protection on sign-in and public pages, where it is switched on).
- For legal compliance when required by law or valid legal process.
6. Your Guests and Other People in Your Records
For the personal information you enter about your guests, customers and staff, you decide what is collected and why, and we process it on your behalf. A guest who asks about, or asks you to correct or delete, information you hold about them should be directed to you; we will help you answer such a request from the records in your account.
7. Data Retention & Deletion
Your data is retained while your account is active. If service stops, because an invoice is past due or because your agreement is cancelled, we retain your data for sixty (60) days from the day service stopped, as a grace period during which you can pay the past-due invoice or reactivate, and we will provide an export of your data on request during that time. We email the account owner before the data is deleted. After 60 days your account’s data is permanently deleted and your stored credentials are deleted. Copies may remain in backups; backups are not used to restore a deleted account. Billing records are kept. To expedite deletion before the grace period ends, contact support@theriverpos.com.
8. Your Rights
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your account and associated data.
- Request an export of your account’s data (CSV per kind of record).
- Request that we end every session of a login you suspect is compromised.
- Request a copy of the activity records associated with your account.
9. Analytics, Cookies & Local Storage
We look at how the Service runs. We don’t look at what’s inside your business.
Your records. We do not analyse, profile, aggregate, or mine the data you keep in the Service — your guests, their equipment, your sales, your staff. It is kept for one purpose: to run your account. We do not combine it with other customers’ data, we do not use it to train models, and we do not sell it. Your guests’ information is yours. It is not ours to study.
The Service uses no third-party analytics. It uses essential cookies for session authentication, and your browser’s local storage to remember things like which property a device is at.
10. Changes to Privacy Policy
We may update this Policy from time to time. When we make a material change, we will email the account holder at the address on the account, with a link to the updated Policy, and we will update the version number and effective date shown at the top of this page.
11. Contact
Questions about privacy: support@theriverpos.com