InventoryOS stores business-critical inventory, sales, receipt, label and integration data. This page explains what is stored and the protections used.
InventoryOS stores operational business data such as inventory, stock locations, sales, expenses, receipts and shipping-label files, plus Manufacturing records and separate Retail shop, customer, staff and till records. This page summarises how those areas are handled.
Authorised InventoryOS admins may access account, workspace, plan, billing-status and usage information to provide support, investigate bugs, manage beta testers, apply complimentary plan overrides, handle abuse and keep the service secure.
Workspace shipping-label addresses are random and shared only with authorised workspace members. Keep the address private and forward shipping labels only. Resend receives forwarded emails; InventoryOS verifies signed webhook events before processing attachments.
The backend checks the current workspace subscription before receiving and importing labels. Free and Starter cannot use inbound import. Downgrading locks the saved address. Regenerating it disables the old address. Attachment hashes prevent repeated imports within a workspace.
Supported attachments use the existing carrier detection and cropping workflow. Temporary originals are removed after processing. Labels enter the review queue and do not automatically print or remove stock. The integration does not request mailbox permissions.
Operational records and uploaded files are kept while your account is active and for a reasonable period afterwards for recovery, audit, security, legal, support or dispute reasons. You can request deletion by contacting [email protected].
You are responsible for keeping your password secure, checking that your business records are accurate, only uploading files you are allowed to process, and exporting any records you need before deleting your account.
Retail shops have their own inventories and subscriptions, separate from reseller/manufacturing workspaces. Staff access is limited by assigned shops and permissions. Till pairing and staff number or QR plus a private PIN are used for restricted till sessions; a QR code alone is not the staff PIN. Management actions are recorded against the relevant staff and approval details.
Card payments are manually confirmed by staff after using a separate terminal. A recorded card sale is not independent verification that the terminal payment succeeded or settled.
Shop owners control staff assignments and permissions. Store customer records, loyalty cards, receipt addresses and purchase history only when needed for your business. Protect shared devices and review staff access when people leave.
The website can prepare a Windows setup file or Mac setup ZIP using the backend’s public printing certificate. Setup installs or updates the official QZ Tray package when needed, checks the download and adds the public certificate to QZ’s printing trust. The private signing key remains on the backend; it is not included in the customer download.
Administrator or operating-system approval may be required. Printer drivers, the physical connection, paper configuration and a test print remain device-specific. The app signs printing requests on the backend. Do not send private signing keys, passwords or .env files in support requests.
Customer email receipts pass the recipient address and itemised sale details to Resend for delivery. The shop display name is used as the sender display name; a verified sending email address is still required. Sending records and usage support delivery status and add-on billing. A transactional receipt is not consent to unrelated marketing.
Help requests go to the protected support administration area and the support email inbox. Permanent store deletion requires an emailed CSV backup to the verified login email. Exports can contain personal and commercially sensitive business records. Restrict access to the receiving inbox, downloaded files and any backups you keep. Passwords and staff PINs are excluded from these exports.
Prepared back-office cash sales may remain in a local queue until reconnecting; restricted staff tills require internet access. Keep the original device and browser data until successful sync. A PWA, cached page or successful local save is not confirmation that a transaction reached the server.
Internet, power, local-device, service-provider and software outages can interrupt access or delay emails, timers and imports. We do not promise uninterrupted availability or a particular recovery time on this page. Export the business records you need and verify your own recovery arrangements before relying on the service for trading.
Manufacturing records connect measured materials, recipes, source batches, finished batches, expiry and recall status, equipment usage and deadlines. Users confirm completed production and review batch picks. Timers do not automatically certify that a product is safe, cleaning is complete or a regulatory obligation has been met.
Carrier detection, label cropping, barcode lookups, supplier price checks, reorder calculations and suggested prices need user review. Check the original label or supplier source before acting on imported or suggested information.