MOLOS POS

Legal

Privacy Policy

Last updated September 22, 2026

This policy explains what personal data MOLOS POS collects, why we use it, who we share it with and the choices you have.

1. Who we are and our role

MOLOS POS provides a point of sale and business management service. For account, billing, security and website data, we decide how the data is used and act as the data controller.

When a business uses MOLOS POS to record data about its own customers, guests and employees, that business is the data controller and we process the data on its behalf and on its instructions. If you are a customer, guest or employee of a business that uses MOLOS POS, please contact that business first about your data.

2. Data we collect

  • Account data: name, email address, mobile number if given, and your password. We also keep your role and branch access, when you last signed in, whether your email address is confirmed, and your two-factor settings.
  • Google sign-in data: if you choose Sign in with Google, Google sends us your name, email address and an account identifier so we can recognise your account. We never receive your Google password or access your Gmail, contacts or files. If an account already uses that email address, you sign in with its password first and then connect Google in Security settings. If your account has a password, you can disconnect Google there at any time. Google handles the sign-in itself under its own privacy policy.
  • Business data: business name, email, phone, address, tax ID and logo, and each branch's address, phone and map coordinates, plus receipt and other settings.
  • Data you record: products, orders and payments, including the cashier who handled them; customer details such as name, phone, email, address, notes, points, visits and total spend; supplier contacts; and employee records such as identity number, contact details, address, emergency contact, bank account, salary, position, schedules, and leave requests with their reasons. An employee record is created for each user account from its name, email and phone.
  • Attendance data: clock-in and clock-out times, GPS location and its accuracy, distance from the branch and whether it was outside the allowed radius, late minutes and hours worked, when a business uses attendance.
  • Guest orders: guests who order with a table QR code may give their name, mobile number and a note. If a mobile number is given, the order is added to that business's customer list, creating a new customer if needed.
  • Billing data: subscription invoices, payment status, and the payment details our payment partner reports back, such as the method, a virtual account number or a masked card number. We never receive full card numbers or card security codes.
  • Payment provider keys: the Xendit, Midtrans or DOKU keys a business enters to accept payments.
  • Feedback: the problem reports and feature requests you send us, with your browser details.
  • Technical data: IP address, browser and device information, request logs, and audit records of important actions such as sign-ins, exports, voids, refunds and changes to settings.

3. How we use data

  • Provide and operate the Service, including sign-in, permissions and plan limits.
  • Process subscription payments and provide invoices in Settings → Subscription.
  • Send account emails, such as email address confirmation and password reset links.
  • Provide support and respond to your requests and feedback.
  • Protect accounts, detect fraud and abuse, and keep audit records, as described below.
  • Improve reliability and features using aggregated information.
  • Meet legal, tax and regulatory obligations.

We do not sell personal data, and we do not use the data you record for advertising.

4. Security checks and automated decisions

To keep accounts and the Service safe:

  • Sign-in for an email address is paused automatically for a while after repeated wrong passwords, and requests that arrive too quickly are limited. Our sign-in and sign-up pages also run a check that tells people from bots.
  • Our staff review signs of unusual activity by businesses and their users, such as sign-ins from many IP addresses, repeated wrong passwords, refused or rate-limited requests, several sign-ups from one IP address, and unusually many voids, refunds or data exports. These checks never lock an account on their own.
  • If we find misuse or a compromised account, our staff may lock a business or a user account, which signs the affected users out. Our Terms & Conditions explain when this can happen.
  • Access to the dashboard and POS pauses automatically when a trial or paid period ends.

If you think one of these decisions affected you unfairly, contact us and a person will review it.

6. Sharing

We share personal data only when it is needed:

  • Payment partners: DOKU processes subscription payments and receives the business name, billing email, plan and amount. The providers a business connects itself, such as Xendit, Midtrans or DOKU, receive the order amount and, for some payment methods, the customer's name.
  • Service providers that host the Service, store the files you upload, back up your data and deliver our account emails. They act on our instructions under confidentiality and security obligations.
  • Sign-in and security providers: Google, if you use Sign in with Google, and the service that checks our sign-in and sign-up pages for automated abuse, which receives your IP address and information about your browser.
  • Google Analytics, but only on our public pages and only if you accept analytics cookies. It receives the page you viewed, your approximate location from your IP address and basic details about your device.
  • Authorities, when required by law or a valid legal request.
  • A successor business, if MOLOS POS is merged, acquired or transferred, which must keep protecting the data under this policy.

Within a business, users see data according to the role and branches the business gives them, and the business's audit records show who did what, including their IP address.

A small number of MOLOS POS staff can see business contact details, user names, email addresses and last sign-in times, billing records, feedback and security logs, so they can provide support, billing and security. What each of them can see depends on their role, and their actions are recorded. Our admin tools show only counts of your products, customers and orders, not the records themselves.

7. Security

We protect personal data with technical and organisational measures appropriate to how sensitive it is, and we give sensitive details such as contact information, identity numbers, bank details and salaries extra protection when we store them. Access is limited by role and branch, each business is separated from the others, and important actions are recorded in an audit log. Only the staff who need it for support, billing or security can reach your data. No system is completely secure, so if a breach affects your personal data we will notify you and the relevant authority as the law requires.

8. Retention

  • Account and business data is kept while your account exists. Customers, suppliers and users that have past transactions are deactivated rather than deleted, so the business's records stay complete.
  • After a subscription ends, data is kept for at least 90 days so you can renew or export it. After that we may permanently delete it, and we delete it sooner if the account owner asks, unless the law requires us to keep it.
  • Technical logs of requests to the Service are kept for a short period, normally 7 days.
  • Audit and billing records are kept while the account exists, and invoices for as long as tax law requires.
  • Password reset and email confirmation links expire shortly after they are sent, and you are signed out again after a period without using the Service.
  • Deleted data may remain in backups for a limited time until those backups are replaced.

9. Cookies and data on your device

We use essential cookies only, to keep you signed in securely and to end your session when it expires. Your browser also stores preferences such as theme, language, selected branch and reminders you have dismissed.

So the POS can keep working when the internet drops, your browser keeps a copy of your sign-in, the product list and any sales not yet uploaded. Signing out removes the saved sign-in. Sales that have not been uploaded stay on the device until they are uploaded or discarded.

Our sign-in and sign-up pages load Google Sign-In and a bot-protection check, which may set their own cookies under their own policies.

On our public pages, such as the home page, the sign-in and sign-up pages and these policies, we ask whether you accept analytics cookies from Google Analytics, which tell us how the site is used. Nothing is loaded and no analytics cookie is set unless you accept, you can decline and still use everything, and your choice is remembered on that browser. Analytics never runs inside the dashboard, the POS, the kitchen display or the table ordering pages, so your business activity is not measured. We do not use advertising cookies and we do not track you across other websites.

10. Your rights

Under Indonesian law, you have the right to:

  • know how your personal data is used, and access and get a copy of it;
  • correct data that is inaccurate or incomplete;
  • ask us to stop processing, delete or destroy your data, subject to legal requirements;
  • withdraw consent where processing is based on consent;
  • object to decisions made only by automated processing;
  • receive your data in a commonly used format to move it elsewhere.

Users with the right permissions can view and correct most business records in the dashboard and export them as CSV. For anything else, including your own account details, a copy of your data or deleting an account, email business@moloslabs.com. We may need to verify your identity first, and we respond within the time the law requires.

11. Data location and transfers

Some of the providers we use store or process data outside Indonesia. When personal data leaves Indonesia, we make sure it receives a level of protection equal to or higher than Indonesian law requires.

12. Children

MOLOS POS is intended for businesses and is not directed at children. We do not knowingly create accounts for anyone under 18.

13. Changes to this policy

We may update this policy. For material changes, we will notify account owners by email or in the dashboard before they take effect. The date at the top shows when it was last updated.

14. Contact

Questions or requests about your personal data can be sent to business@moloslabs.com. See also our Terms & Conditions.

MOLOS POS

This browser is too old to run MOLOS POS

The app needs features your browser does not have, so the register, reports and settings cannot load safely. Nothing is wrong with your account.

We detected: your current browser

MOLOS POS works on these versions or newer:

Update your browser and open this page again. On Windows, update Chrome or Microsoft Edge. On an iPhone or iPad, update iOS in Settings, then use Safari. On Android, update Chrome from the Play Store. If the device cannot be updated, open MOLOS POS on a newer phone, tablet or computer.

Peramban ini terlalu lama untuk MOLOS POS. Perbarui peramban Anda ke salah satu versi di atas, lalu buka halaman ini lagi. Jika perangkat tidak bisa diperbarui, gunakan perangkat lain yang lebih baru.

Still stuck? Email business@moloslabs.com and include the line below.

There is no way around this page. A browser this old no longer receives security updates, and MOLOS POS handles payments and customer data, so it will not open here.