Privacy Policy

SPA (SENTRY POS Analytics) version 0.9.6 · Effective 9 November 2026 · Applies to SPA on the shop's computer, its dashboard, the owner phone link and the OPEROS cloud copy SPA sends to.

Contents

1. Who we are and our role
2. What data SPA handles
3. What stays on the shop computer
4. What leaves the computer, and when
5. Why we process it (legal bases)
6. Cashiers and staff
7. Shop customers
8. SENTRY camera alerts
9. Where data is stored and transfers abroad
10. How we protect it
11. How long we keep it
12. Who we share it with
13. Your rights
14. If something goes wrong
15. Children
16. Changes to this policy
17. Contact

1. Who we are and our role

SPA is software made by OPEROS (operos.info). "We", "us" and "OPEROS" mean the OPEROS team. "You" and "the shop" mean the business that installs SPA and the people it lets sign in.

Under Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations:

• The shop is the controller of the data inside SPA and inside its POS: it decides why the data exists and who sees it. That includes cashier codes and names and anything the POS records about customers.
• OPEROS is a processor for the summary copy SPA sends to the OPEROS cloud on the shop's behalf, and processes it only to show it to the shop's owner and to run the service.
• OPEROS is a controller for the owner's OPEROS account (covered by the OPEROS app privacy policy) and for feedback you send to us.

2. What data SPA handles

SPA does not read or store card numbers, bank details, customer passwords, contacts, browsing history or precise location, and it has no advertising or analytics trackers.

3. What stays on the shop computer

Everything in the table above is kept in SPA's database on the shop computer and in the backups SPA makes on that computer. The dashboard is served only to that computer (address 127.0.0.1). On the shop network SPA answers only the owner's paired phone and the shop's SENTRY cameras. Nobody at OPEROS can see this local data unless you share it with us (for example, by sending us a backup to fix a problem, which we will ask you about first).

4. What leaves the computer, and when

4.1 The owner's cloud copy (only after you link the shop)

If the owner links the shop to the OPEROS app, SPA sends a summary every 20 seconds over an encrypted connection (HTTPS). It contains:

• sales totals and hourly sales for today, yesterday and the day before;
• best and least selling products, payment mix and sales by category;
• tills, with the code and (if you typed one) name of the last cashier on each;
• gross profit figures, if you entered item costs;
• the latest SENTRY alerts as text (time, camera, description, your decision and note), and only a yes/no saying whether a picture exists. Pictures are never uploaded.

Each send replaces the previous copy; it does not build up a history in the cloud. Deleting the owner account in the app deletes the cloud copy and the shop's link, after which the cloud refuses anything SPA sends. To stop sending without deleting the account, write to support and we will remove the link.

4.2 Feedback

Feedback you send from Help & feedback is stored in SPA first, then sent with the next cloud send, together with the shop name. If the shop is not linked, it waits on the computer until it is, and you can email us instead.

4.3 Security notices

If SPA sees repeated wrong pairing codes from a device on the shop network, it sends a short notice (time and what happened) so we can warn the owner.

4.4 Nothing else

SPA does not send receipts, line items, cashier activity logs, user accounts, passwords, settings or backups anywhere. Links to operos.info in SPA open in your browser only when you click them.

5. Why we process it (legal bases)

• To provide the service you asked for (contract): showing your shop on the dashboard and, if linked, on the owner's phone.
• Your consent: linking the shop to the cloud, typing cashier names, and sending feedback with device details are all choices you make. You can undo them: remove names in SPA, and end the cloud link by deleting the owner account or asking support.
• Legitimate interests: keeping SPA secure, detecting misuse of pairing, and fixing faults you report, in ways you would reasonably expect.
• Legal obligations: where a law or a competent authority in Egypt requires it.

6. Cashiers and staff

Cashier codes come from the POS. SPA shows sales, average basket and void rates per cashier so the owner can run the shop. These numbers are not proof of wrongdoing: a high void rate can have many innocent causes, and SPA says so on screen. As controller, the shop should tell its staff that sales are recorded per cashier and reviewed in SPA, and should not take action against anyone based on SPA figures alone. Cashier names are optional and can be removed at any time in Staff › Cashier names.

7. Shop customers

SPA is about sales, not people. It does not need customer names or phone numbers. If your POS stores customer details on a receipt, SPA may read them as part of that receipt and keep them only on the shop computer; they are not sent to the cloud. If a customer asks the shop about their data, the shop answers as controller and we will help on request.

8. SENTRY camera alerts

SENTRY cameras are separate OPEROS devices installed by the shop. SPA receives their alerts so a person can review them next to the matching sale. Alerts are prompts for a human to look, never automatic decisions about a person. The shop is responsible for lawful camera use, including visible signs that cameras are in use and respecting staff and customer privacy. Still pictures stay on the shop computer.

9. Where data is stored and transfers abroad

Local data stays on the shop computer in Egypt. The cloud copy and feedback are stored with our hosting provider Supabase, on servers in the European Union (Ireland), which means personal data in them (cashier codes and names, the owner's notes) leaves Egypt. We do this only for the purposes above, with encryption in transit, strict access rules (each owner reads only their own shops; SPA uses a secret only it holds and has no database key), and with the permits and safeguards Egyptian law requires for transfers abroad. If you do not want any data to leave Egypt, do not link the shop to the cloud (and do not send feedback through SPA; email us instead): SPA and the phone on shop Wi-Fi keep working without it.

10. How we protect it

• The dashboard is reachable only from the shop computer; the phone and SENTRY must be paired before SPA answers them.
• Passwords are stored as salted hashes; sessions end after 30 minutes without use; important actions ask for the password again.
• Every form is protected against cross-site requests, and the dashboard blocks outside scripts and content.
• All cloud traffic uses HTTPS. The link secret is stored on the cloud only as a hash.
• SPA reads the POS with read-only access.
• SPA keeps local backups so a damaged database can be restored.

The shop is responsible for the computer itself: a Windows password, updates, antivirus, physical security and who knows the SPA passwords.

11. How long we keep it

12. Who we share it with

We never sell data or use it for advertising. We share it only with:

• Supabase (hosting and database, EU), as our sub-processor under a data processing agreement;
• Resend (email delivery) only for the owner's sign-in and account emails, never for SPA data;
• authorities when Egyptian law or a valid order requires it, and only what is required;
• a buyer or successor of OPEROS, if the business changes hands, under the same promises.

13. Your rights

Under Law No. 151 of 2020 a person whose data is processed can ask to know what data is held about them and get a copy, have it corrected or completed, have it deleted or its processing restricted, withdraw consent they gave, object to processing, and be told about a breach that affects them. They can also complain to Egypt's Personal Data Protection Center.

• For data inside SPA, the shop can act directly (rename or remove a cashier name, delete users, unpair a phone). Staff and customers should ask the shop first.
• For the cloud copy and feedback, write to privacy@operos.info. We confirm receipt and answer within the time the law sets, and in any case within 30 days. We may ask you to prove who you are.

14. If something goes wrong

If we learn of a breach affecting data in the OPEROS cloud, we will contain it, notify the Personal Data Protection Center within the deadline the law sets (72 hours), and tell affected shops promptly with what happened and what to do. If a shop's own computer is affected, we will help the shop with its own notification duties.

15. Children

SPA is a business tool for shop owners and staff of working age. It is not meant for children, and we do not knowingly process children's data.

16. Changes to this policy

When we change this policy we update the effective date and ship the new text with SPA. For important changes (for example, sending new kinds of data), we will tell the owner in SPA or the app before they apply, and ask again where consent is needed.

17. Contact

Privacy questions and requests: privacy@operos.info
Help with SPA: support@operos.info or Help & feedback inside SPA
Website: operos.info

An Arabic version is available on request. This policy is a plain-language description of how SPA works and is read together with the Terms of Use.