Privacy Policy
Effective Date: September 3, 2026
At Red Box International, SRL ("Red Box", "we", "us", "our"), we value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, share, and safeguard your data when you use our products and services — including our POS systems, ERP integrations, and connected platforms, as well as our mobile applications RedBox POS Terminal (com.redbox.pos_server) and RedBox POS Handheld (com.redbox.pos_handheld).
RedBox POS is a professional tool: it is licensed to businesses and used only by a business's authorised staff. The business operating the system is the controller of the customer and employee data it enters; Red Box International, SRL acts as a processor on that business's behalf. The mobile application sections below should be read under that division of responsibility.
1. Information We Collect
Information You Provide
- •
Account Information: Name, business name, email address, phone number, username, and password when you register for our services.
- •
Business Details: Company RNC, tax data, location, and contact persons required for system setup and billing.
- •
Payment Information: Billing details and payment methods when you purchase or subscribe to our services (processed securely by our payment partners).
- •
Support & Communication: Messages, inquiries, feedback, and any other content you send to us through our support channels or training programs.
Information We Collect Automatically
- •
Usage Data: How you interact with our systems (e.g., POS usage, ERP integrations, features used).
- •
Device & Technical Information: Device type, operating system, IP address, browser type, and device identifiers.
- •
Location Information: In the web console we collect an approximate, general location derived from your IP address, for security and analytics. The mobile applications collect no position at all: they query no phone location service and request no satellite positioning, and they cannot access location when closed or running in the background. Android classifies both scanning for nearby Bluetooth devices (on versions before Android 12) and reading the identifier of the Wi-Fi network the device is connected to as location permissions; the applications request those permissions for those two reasons only (see section 2).
- •
Cookies & Tracking: We use cookies and similar technologies to personalize and improve your experience.
2. Device Permissions in the Mobile Applications
The RedBox POS Terminal and RedBox POS Handheld applications request the following Android permissions, each for a specific operational purpose:
| Permission | Use |
|---|---|
| Camera | Reading barcodes and QR codes: products, handheld pairing, and online orders. Images are processed on the device and are neither stored nor transmitted. |
| Bluetooth (scan and connect) | Discovering and using thermal receipt printers. We expressly declare to Android that this scanning is never used to infer your location. |
| Approximate and precise location | Required by Android in order to scan for Bluetooth devices on versions before Android 12, and to access the identifier of the associated Wi-Fi access point for link diagnostics. No position is ever read, stored, or transmitted. |
| NFC | Reading employee identification cards or fobs, where the business uses that method. |
| Network and Wi-Fi information | Connecting the terminal to handheld terminals over the business's local network, and syncing to the RedBox cloud. |
| Foreground service and wake lock | Keeping the local point-of-sale server alive while the business is trading, so handhelds do not lose their connection. |
| Notifications | Operational alerts: incoming orders, pending prints, sync failures. |
Wi-Fi Link Diagnostics
RedBox POS Handheld records the quality of the device's Wi-Fi link — signal strength, frequency, and link rate — together with an identifier for the access point it is attached to, solely for technical support purposes.
The access point is not identified by its physical network address: that address is transformed on the device itself into an irreversible derived value, different for every account, and only that value is transmitted. The real address never leaves the device. Unlike a real physical address, which can be looked up in public network-mapping databases to infer a location, a derived value of this kind is not geolocatable.
The purpose is to let our support team see which access point a device is attached to and how strong that link is, so a fault in the venue's network can be told apart from a fault in our software. No position is derived from this data. The application works normally if the permission is refused; only this diagnostic detail is lost.
3. Where Information Is Stored
The mobile applications work offline: operations live on the device itself and data is stored encrypted in a local database.
When a connection is available, data syncs to the RedBox cloud over an encrypted connection. Communication between the terminal and handheld terminals stays inside the business's local network and does not leave it.
Diagnostic logs are retained on the device for at most 3 days.
4. How We Use Your Information
We use your information to:
- Provide, maintain, and improve our systems and integrations (POS, ERP, and e-billing).
- Process transactions, invoices, and client accounts.
- Send updates, alerts, and technical or security notices.
- Offer customer support, onboarding, and training.
- Personalize your experience across our services.
- Monitor usage trends and performance to enhance reliability.
- Detect and prevent fraud, misuse, or unauthorized activity.
- Comply with applicable financial, accounting, and data regulations.
6. Recipients of Mobile Application Data
In addition to the general categories described above, data handled by the mobile applications is shared with the following recipients and with no others:
- Dirección General de Impuestos Internos (DGII): Electronic tax receipts (e-CF) are transmitted to the Dominican tax authority through our electronic-signature provider, as Dominican tax regulation requires.
- Google Firebase Cloud Messaging: Solely to deliver push notifications to the terminal. This applies only to RedBox POS Terminal; RedBox POS Handheld does not use this service.
- Competent authorities: Where there is a legal obligation.
There are no other recipients. The applications contain no advertising, use no advertising identifier, and do not sell or share data for marketing purposes.
7. Data Security
We employ industry-standard security measures — including encryption, access controls, and monitoring — to protect your information. However, no electronic system is completely secure; users share data at their own risk, and we encourage maintaining strong passwords and secure networks.
8. Your Rights and Choices
You may:
- Access and update your account information.
- Request deletion of your account and associated data (see section 9).
- Unsubscribe from marketing communications.
- Request a copy of your personal data.
- Restrict certain types of processing.
To exercise these rights, contact us at admin@redbox.do.
9. Data Deletion Request
This section describes the mechanism for requesting deletion of an account and its associated data.
- Who may request it: The business that holds the account, through its authorised representative.
- How to request it: Write to support@redbox.do from the email address registered on the account, naming the business and its RNC.
- What is deleted: The account, its users, the catalogue, contacts, and the associated operational data held in the RedBox cloud.
- What is retained and why: Fiscal and sales records are retained for the period Dominican tax regulation requires. We cannot delete them before that period elapses, so deletion is not total while the legal obligation is in force.
- Timeframe: We acknowledge the request within 5 business days and complete it within 30 calendar days, except for data we are legally required to retain.
- Data held on the device itself: The in-app Reset device action erases the data stored locally on that device and is available at any time, without contacting us.
10. International Data Transfers
Your data may be stored or processed in locations outside your country, including by our service providers. We implement appropriate safeguards to protect it under this Privacy Policy.
11. Children’s Privacy
Our systems are designed for business use and are not intended for individuals under 18. We do not knowingly collect information from minors.
12. Third-Party Services
Our ecosystem integrates with third-party tools such as ERP, payment gateways, and delivery platforms. We are not responsible for their privacy practices — please review their policies for more information.
13. Data Retention
We retain information as long as your account is active or as needed to comply with legal and accounting requirements.
14. Updates to This Policy
We may revise this Privacy Policy periodically. Updates will be posted on our website with a new effective date.
15. Contact Us
If you have questions or concerns about this Privacy Policy or your data, please contact us at:
Red Box International, SRL — Ave. Jhon F. Kennedy No. 88, 4th floor, Santo Domingo, Dominican Republic