legal
privacy policy
Effective date: October 21, 2026
Harvexstack ("we", "us") is operated by HarvexStack Company, based in California, USA. This policy explains what personal data we collect through harvexstack.com and our apps (including HarvexPOS and HarvexTime, together the "Services"), why, and your rights. Contact us any time at [email protected].
1. Two roles we play
- For our website and your account, we decide how your data is used, so we are the data controller.
- For data you put into the apps (for example your sales records, or your employees' clock-ins and wages in HarvexTime), you or your business are the controller and we process it only on your instructions, under our Data Processing Agreement. If you are an employee whose employer uses HarvexTime, please contact your employer first about your data.
2. What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email, phone, business name, password (stored hashed) | You, at sign-up |
| Billing details | Plan, invoices, payment status. Card numbers are handled by our payment provider, not stored by us | You and our payment provider |
| Workspace content | Products, sales, customers, employee names, shifts, hours, wage rates | You and your team, inside the apps |
| Technical data | IP address, device and browser type, pages visited, login times, error logs | Collected automatically |
| Cookies | Login session, preferences, and analytics if you accept them | Your browser (see section 6) |
| Messages | Support emails and feedback | You |
We do not knowingly collect data from children under 13. The Services are for businesses.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Create your account and provide the Services | Performance of our contract with you |
| Take payments and keep tax and accounting records | Contract and legal obligation |
| Keep the Services secure, prevent fraud, keep traffic logs | Legitimate interest and legal obligation |
| Send service notices (billing, security, changes) | Contract |
| Send product news and offers | Your consent; you can unsubscribe any time |
| Analytics to improve the website | Your consent (cookie banner) |
We do not sell your personal data, and we do not use your workspace content for advertising.
4. Who we share it with
We share data only with service providers who help us run the Services, under contracts that require them to protect it:
- Our hosting provider: hosting and storage
- Our payment provider: payments and billing
- Our analytics provider: website analytics, only if you accept analytics cookies
- Our email provider: account and service emails
We may also disclose data when the law requires it, for example to a court or regulator, or if the business is transferred to a new owner, who must keep this policy's promises.
5. International transfers
Our servers or providers may be located outside your country. When we transfer personal data abroad, we use providers with adequate protection or contractual safeguards, as required by applicable law.
6. Cookies
- Essential cookies keep you logged in across harvexstack.com and its app subdomains and remember your settings. These are always on because the Services can't work without them.
- Analytics cookies help us understand how the website is used. We only set them if you click Accept on the cookie banner, and you can change your choice any time from the "Cookie settings" link in the footer.
We do not use advertising or cross-site tracking cookies.
7. How long we keep it
| Data | Kept for |
|---|---|
| Server and access logs | 90 days, then deleted |
| Account details | While your account is open, then up to 90 days |
| Workspace content | While your account is open; after closing you have 30 days to export it, then we delete it within 60 days, except backups which expire within 90 days |
| Billing and tax records | 5 years after the transaction, or longer if the law requires |
| Marketing list | Until you unsubscribe |
| Analytics | Up to 14 months |
8. Security
We encrypt data in transit (HTTPS) and at rest, keep each business's workspace separate, limit who can access data, and keep access logs. No system is perfectly secure; if a breach puts your data at risk, we will notify you and the relevant authorities as the law requires.
9. Your rights
Depending on where you live, you can ask to access, correct, delete, or receive a copy of your data, object to or restrict how we use it, and withdraw consent at any time. Email [email protected] and we will reply within 30 days. California residents have the right not to be discriminated against for using these rights. Customers in Cambodia can contact us at [email protected] about any concern with how we handle their data.
10. Changes
We will post any changes on this page and update the effective date. For significant changes we will email account owners at least 14 days before they take effect.
11. Contact
HarvexStack Company
California, USA
[email protected]