Pocket IMS ("Pocket IMS", "we", "us", or "our") provides a mobile inventory and point-of-sale
management application for retail and pharmacy businesses in Pakistan, along with an
administrative web panel used by our own staff and business development officers. This Privacy
Policy explains what information we collect, why we collect it, how it is used and protected,
and the choices available to you.
By registering for or using Pocket IMS, you agree to the collection and use of information as
described in this policy.
1. Information We Collect
1.1 Account & Business Information
When you register a store on Pocket IMS, we collect:
- Owner name and store name
- Phone number (used for account verification and OTP-based password recovery)
- Store category, city, and store address
- A username and a securely hashed password (we never store your password in plain text)
- Optional referral code, if you were referred by another store or a business development officer
1.2 Business Operations Data
As you use the app, we store the business data you enter in order to provide the service —
this is your business's own operational data, not personal data about your customers:
- Product catalogue, pricing, stock quantities, and batch/expiry records
- Sales transactions, refunds, and receipts you generate
- Supplier names and contact details you choose to save
- For pharmacy/medical-category stores: optional medicine details you enter, such as generic
name, manufacturer, and manufacturer batch numbers, entered voluntarily to help you manage
inventory and recalls
1.3 Subscription & Payment Information
Pocket IMS operates on a paid subscription model. We do not collect, process, or store
your card number, CVV, or full payment credentials at any point. All payment collection
is handled directly by our licensed payment processing partner,
Safepay, via a hosted
checkout page outside the Pocket IMS app. We only receive and store:
- The subscription amount charged and the plan duration purchased
- A payment status and reference/transaction ID (for support and reconciliation purposes)
- Whether a referral discount was applied
1.4 Device & Technical Information
- A device identifier, used to enforce single-device login sessions on your account for security
- Device type/OS (Android/iOS) for compatibility and support purposes
- App version, used to notify you of required updates
- Crash reports and error diagnostics, collected automatically via Sentry, to help us find and
fix bugs. These reports may include device model, OS version, and the app state at the time
of a crash — they do not include your password or payment credentials.
1.5 Referral & Affiliate Data
If you refer other stores to Pocket IMS, we track your referral code usage, the stores you
referred, and any wallet credit earned, so that referral commissions can be calculated and paid
out accurately.
2. How We Use Your Information
| Purpose | Data Used |
|---|
| Provide and operate the inventory/POS service | Account data, business operations data |
| Process subscription payments and renewals | Subscription/payment metadata (never raw card data) |
| Verify your identity and secure your account | Phone number (OTP), device identifier, hashed password |
| Send account-related SMS (OTP, alerts) | Phone number, via our SMS provider, Twilio |
| Diagnose and fix technical issues | Crash reports, device/technical information |
| Calculate and pay referral commissions | Referral & affiliate data |
| Provide customer support | Account data, communications you send us |
3. Third-Party Service Providers
We share limited data with the following service providers, solely to operate Pocket IMS:
- Safepay — processes subscription payments; receives the amount due and your
basic contact details necessary to complete a transaction. Safepay's own privacy policy
governs how they handle payment card data.
- Twilio — delivers SMS messages (OTPs, account notifications) to your
registered phone number.
- Sentry — receives automated crash and error diagnostic reports to help us
maintain app stability.
- DigitalOcean — our cloud infrastructure provider; all data is stored on
servers operated by DigitalOcean with industry-standard security controls.
We do not sell your data to third parties, and we do not share your business data with other
Pocket IMS merchants.
4. Data Security
- All data in transit is encrypted using HTTPS/TLS.
- Passwords are stored using industry-standard one-way hashing (bcrypt) — we cannot see or
recover your actual password.
- Access to your account is protected by JSON Web Token (JWT) based authentication with
configurable session expiry.
- Administrative access to merchant data is restricted to authorized Pocket IMS staff and
logged via an internal audit trail.
5. Data Retention
We retain your account and business data for as long as your account remains active, and for a
further period afterward to comply with our legal, tax, and accounting obligations, resolve
disputes, and enforce our agreements. You may request deletion of your account and associated
data at any time — see Section 7 (Account & Data Deletion) below for exactly what this
involves and how to request it.
6. Your Rights
You may, at any time:
- Request a copy of the personal data we hold about you
- Request correction of inaccurate account information
- Request deletion of your account and associated data, subject to our legal retention obligations (see Section 7)
- Withdraw consent for non-essential communications
To exercise any of these rights, contact us using the details in Section 10.
7. Account & Data Deletion
You can request deletion of your Pocket IMS account and its associated data at any time. This
applies whether you are a store owner (solo/master account), a branch or counter account, or a
BDO account.
How to request deletion:
- Email mohkhan1618@gmail.com with the subject line
"Account Deletion Request"
- Include your registered store name, username, and phone number so we can verify your
identity
- We will confirm receipt within 2 business days and complete the deletion within
30 days of verifying your identity
What gets deleted:
- Your login credentials (username and hashed password)
- Personal profile information: owner name, phone number, store address, and city
- Your product/inventory catalog and associated business records stored in the app
- Active sessions and authentication tokens
- Crash/diagnostic data associated with your account held by our error-monitoring provider
(Sentry)
What we retain, and for how long:
- Financial and transaction records (subscription payments, invoices) are retained for up to
6 years after account closure, in line with standard tax and accounting
record-keeping obligations in Pakistan. This data is retained for compliance purposes only
and is not used for any other purpose after your account is deleted.
- Where we are required to retain a minimal record to prevent abuse (e.g. a hashed identifier
to enforce our username-uniqueness policy), we keep only what is strictly necessary and
nothing that can be used to identify you personally.
If you only want specific data corrected or removed rather than closing your account entirely,
use the same contact details and we will address the request without deleting your account.
8. Children's Privacy
Pocket IMS is a business tool intended for use by store owners and staff who are 18 years of age
or older. We do not knowingly collect data from children.
9. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for
legal, operational, or regulatory reasons. We will update the "Last updated" date above when we
do. Continued use of Pocket IMS after changes take effect constitutes acceptance of the revised
policy.
10. Contact Us
