Privacy Policy — TAF Mobile POS

App: TAF Mobile POS (com.cybex.mobilepos)
Effective date: 31 August 2026
Last updated: 31 August 2026

This Privacy Policy describes how Total Application Fiji (TAF) ("we", "us", "our") handles information in the TAF Mobile POS Android app (the "App"). The App is a point-of-sale tool for staff of businesses that use the TAF ERP system — it is not a consumer app. You use it because your employer issued you an account. Your employer's organisation decides what data is entered into the App and how long it is kept; we operate the software and the servers on their behalf.

We do not sell your personal data. The App contains no advertising, analytics, or tracking software. The camera is used only when you tap to scan a product barcode, and no photographs are taken or uploaded.

1. Information the App Collects

1.1 Your account

When you log in, the App sends your email address and password to your organisation's TAF server. It then stores on your device: your email address, your name, your user ID, your organisation's ID and name, an access token, and a one-way SHA-256 hash of your password. The hash allows you to log in again without a network connection for up to 7 days; your actual password is never written to the device.

1.2 Sales and business data

Sales you complete are saved on the device and then sent to your organisation's TAF server. This includes line items, quantities, prices, tax amounts, payment methods and amounts, the cashier and organisation the sale belongs to, timestamps, and — where your organisation uses tax-authority fiscalisation — the fiscal invoice details returned for that sale. Product and category data is downloaded from the server and cached on the device so the App keeps working offline.

1.3 Customer records

If your organisation uses customer accounts, customer name, email address, phone number, tax identification number (TIN) and account balance may be downloaded to the device as part of the catalogue sync. This is your organisation's own customer data, entered by your organisation.

1.4 Camera

The App requests camera access for one purpose: scanning a product barcode when you add a product. Barcodes are decoded on the device and only the resulting barcode number is used. No images are recorded, stored, or transmitted. You can decline the permission and type the barcode by hand.

1.5 What the App does not collect

The App contains no analytics, advertising, crash-reporting or tracking components. It does not collect your contacts, calendar, photos, files, messages, or advertising identifiers, and it does not build a profile of you or track you across other apps or websites.

2. Permissions

Permission	Why it is declared	Used in this version?
INTERNET ACCESS_NETWORK_STATE	To reach your organisation's TAF server, and to detect when connectivity returns so queued sales can upload.	Yes
CAMERA	Barcode scanning in the Add Product screen only. Requested the first time you tap Scan.	Yes, on request
ACCESS_FINE_LOCATION ACCESS_COARSE_LOCATION	Reserved for a planned delivery-tracking feature.	No — this version contains no code that reads your location and never prompts for it.
BLUETOOTH BLUETOOTH_CONNECT BLUETOOTH_SCAN	Reserved for planned receipt-printer support.	No — this version does not connect to Bluetooth devices.

If the location or printing features ship in a future version, this policy will be updated before that version collects anything.

3. Where the Data Goes

The App communicates with a single destination: your organisation's TAF server (by default https://pos.cybexpte.com, which your administrator can change to a different address in the App's Settings screen). Where your organisation uses tax-authority fiscalisation, that server forwards the required invoice details to the tax authority your organisation is registered with.

Data is never sold, rented, or shared with advertisers or data brokers. It is not shared with anyone outside your organisation, its TAF server, and — for fiscalised sales — the relevant tax authority.

4. Storage and Security

Login credentials, the access token, and the offline password hash are held in Android EncryptedSharedPreferences (AES-256), protected by the Android Keystore.
Both the credential store and the local sales database are excluded from Android's automatic cloud backup, so they are not copied off the device by Google Backup.
Requests to the default server use encrypted transport (HTTPS/TLS). If your administrator configures a custom server address, the security of that connection depends on that server.
Sales completed while offline are queued on the device and uploaded automatically once connectivity returns.
On the server side we use role-based access control and audit logging. No method of transmission or storage is 100% secure; we work continuously to maintain appropriate protections.

5. Your Choices and Controls

You can decline the camera permission when prompted, or revoke it later via Settings → Apps → TAF Mobile POS → Permissions → Camera. Barcode scanning will be unavailable; everything else, including manual barcode entry, continues to work.
Logging out of the App clears your stored credentials and access token from the device.
To remove all locally cached data, clear the App's storage in Android Settings or uninstall the App.
To access, correct, or delete records held on the server, contact your organisation's administrator, who controls that data, or use the contact details below.

6. Data Retention

Sales, product and customer data is cached on the device so the App works offline; the authoritative copy lives on your organisation's TAF server. Records there are retained for as long as your organisation requires them and for as long as tax and accounting record-keeping law requires — sales and fiscal invoice records in particular are typically subject to statutory retention periods. When no longer needed, records are deleted or de-identified in accordance with our retention schedule and applicable law.

7. Children's Privacy

The App is a workplace tool intended for use by employees. It is not directed at children, and we do not knowingly collect personal information from children under 13.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you in the app or by email. Continued use of the App after an update constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy or about how the TAF Mobile POS app handles data, please contact:

Total Application Fiji (TAF)
Email: privacy@taf.com.fj
Postal: TAF, Suva, Fiji

For questions about your own organisation's data — access, correction, or deletion — please contact your employer, who is the controller of that data.