Ontero — Privacy Policy

1. Overview & Data Controller Identification

Welcome to Ontero ("Application", "we", "us", or "our"). Ontero is a specialized mobile Business Management and Customer Relationship Management (CRM) application created for business owners, entrepreneurs, shopkeepers, and merchant managers to manage sales transactions, customer relationship records, inventory stock, and business expense records.

We are committed to full transparency and strict compliance with the Google Play Developer Program Policies (including User Data Policy, Permissions Policy, and Account Deletion Policy), the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Children's Online Privacy Protection Act (COPPA).

2. Data We Collect & Google Play Data Safety Disclosures

We collect and process only the minimum information strictly necessary to provide the core business management functionality:

A. Account Holder Information

• Full Name and Email Address: Collected during user account registration or via Google Sign-In. Used to authenticate identity, secure account access, and synchronize business data across sessions.
• Phone Number and Business / Store Name: Provided by the user to customize order receipts, generate sales invoices, and facilitate account recovery.

B. End-Customer CRM & Commercial Records

• Customer Directory: Names, phone numbers, delivery addresses, and customer notes entered directly by the merchant.
• Product Catalog: Product names, descriptions, SKU codes, pricing, unit costs, and inventory stock quantities.
• Sales Transactions: Orders, customer assignments, line items, timestamps, order statuses, and financial totals.
• Expense Bookkeeping: Business expense titles, amounts, categories, and associated receipt images.

C. Financial & Subscription Information

• Subscription Entitlements: Premium subscription tier and renewal timestamps managed via RevenueCat and verified through the Google Play In-App Billing System.
• Zero Card Data Collection: We do not collect, process, or store credit card numbers, debit card details, CVV codes, or banking credentials. All payments are processed directly and securely by Google Play.

D. Device, Network & Diagnostics

• Network State: Connectivity state (online vs. offline) to support offline-first local caching and automatic cloud sync.
• Diagnostics: Anonymized technical error logs to diagnose app crashes and ensure operational stability.

3. Two-Tier Data Architecture: Data Controller vs. Data Processor Roles

Because Ontero is a B2B Business CRM tool, data handled in the application strictly falls into two distinct legal tiers under global data protection laws (including GDPR and CCPA):

4. Google User Data & Google API Services Limited Use Disclosure

When you choose to authenticate using Sign in with Google (Google OAuth 2.0):

• We only access standard, basic Google public profile scopes: your display name, email address, and unique Google user ID (`sub`).
• We NEVER ask for, receive, or store your Google account password.
• We do NOT access your Gmail messages, Google Drive files, Google Photos, or Google contacts.
• Google user data is used exclusively to authenticate your identity, create or link your Ontero account, and establish a secure authenticated session.
• We do not transfer or disclose Google user data to third parties, except as necessary to provide or improve the core features of the application or as required by law.

5. Prominent Disclosure: Camera & Photo Library Access

In accordance with Google Play's Sensitive Permissions and User Data Policies, we provide this explicit disclosure regarding Camera and Image access:

• Purpose of Access: The Camera and Photo Library permissions are used solely to allow you to:
  1. Capture or choose a photo of an inventory item to display in your product catalog.
  2. Photograph or attach a paper receipt image for business expense documentation.
  3. Optionally set a business/profile logo.
• Explicit User Initiation Only: The app only requests access to your camera or gallery at the exact moment you tap a visible camera or image picker icon.
• Zero Background Access: The app never accesses the camera in the background, never scans your gallery photos, and never reads images without your direct knowledge and consent.
• No Biometrics or Facial Recognition: We do not perform facial recognition, biometric analysis, or extract personal identification from captured images.
• Secure Storage: Selected images are saved locally in the app's sandboxed storage and uploaded securely over encrypted TLS/HTTPS connections to your private cloud storage account.
• Deletion: When you delete a product, an expense receipt, or your account, the associated image is permanently erased immediately.

6. Complete Android Device Permissions Table

7. Purpose of Data Processing & No-Sale Commitment

We process your data strictly under lawful bases (GDPR Art. 6: contract performance, legitimate business interest, and legal compliance):

• Delivering the core CRM and inventory management functionality.
• Enabling offline storage and cross-device cloud synchronization.
• Verifying subscription status and unlocked features through RevenueCat.
• Providing technical customer support and troubleshooting.
• Preventing security fraud, unauthorized access, and brute-force abuse via rate limiting.

8. Third-Party Service Providers & In-App Subscriptions

We partner with industry-leading infrastructure providers under strict data protection and confidentiality agreements:

• Google Sign-In (Google LLC): Facilitates secure, password-less OAuth 2.0 authentication. (Google Privacy Policy)
• Google Play In-App Billing (Google LLC): Handles all subscription billing and digital transactions in a PCI-DSS certified environment. (Google Payments Privacy)
• RevenueCat, Inc.: Manages mobile subscription lifecycle, receipt validation, and entitlement unlocking. (RevenueCat Privacy Policy)
• Encrypted Backend Server: Dedicated FastAPI backend providing encrypted database storage and synchronization over TLS/HTTPS.

9. Data Storage, Security Standards & Encryption

• Encryption in Transit: All data transmitted between the mobile application and backend servers is encrypted using modern TLS/HTTPS 1.2+ protocols.
• Hardware-Backed Token Security: User authentication JWT tokens are stored using device hardware-backed encryption (Android Keystore / flutter_secure_storage).
• Cryptographic Password Hashing: User passwords are never saved in plaintext; they are hashed with salt using the industry-standard bcrypt algorithm.
• Sandboxed Database: Local SQLite data is stored strictly within the app's sandboxed private storage and is inaccessible to other apps.

10. Account & Data Deletion Policy (Google Play Mandate)

In full accordance with the Google Play Account Deletion Policy and GDPR Article 17 ("Right to Erasure"), users have the absolute right to permanently delete their account and all associated commercial records at any time.

Three Easy Ways to Delete Your Account:

1. In-App Direct Deletion: Open Ontero → go to Profile / Settings → scroll to Account Actions → tap Delete Account Permanently. Confirm the prompt to immediately erase your account.
2. Dedicated Web Deletion Portal (If App Uninstalled): If you do not have access to the app, you can submit an instant deletion request via our public web portal:
   Go to Account & Data Deletion Web Portal →
3. Direct Email Request: Send an email from your registered account email to [email protected] with the subject line "Account Deletion Request".

Data Retention & Permanent Purge Timeline:

• Immediate Cascading Purge: When an account is deleted, your user profile, customer contacts, orders, product inventory, and expense records are immediately and permanently erased from the production database via an automated cascading deletion.
• Uploaded Images: All product and receipt image files are deleted from server storage.
• Backups: Encrypted backup snapshots are completely overwritten and purged within 30 days.
• No business data or client records are retained or repurposed following account deletion.

11. Children's Privacy (COPPA Compliance)

Ontero is a specialized business management application intended exclusively for business owners, entrepreneurs, and adults of legal age (18 years or older).

We do not knowingly market to, target, or collect personal information from children under the age of 13 (or under 16 in the European Union). If we discover that personal data of a child has been collected, we will immediately delete that information from our servers.

12. Your Legal Rights (GDPR, CCPA/CPRA, LGPD)

Under international privacy laws, you possess enforceable rights over your personal data:

• Right of Access: You can request a summary and copy of your personal data.
• Right to Rectification: You can update inaccurate business or personal information in the app profile.
• Right to Erasure ("Right to be Forgotten"): You can demand permanent deletion of your account and records.
• Right to Data Portability: You can request an export of your customer, order, and inventory data.
• Right to Non-Discrimination: We do not discriminate against users who exercise their privacy rights.

To exercise any statutory right, contact our data protection team at [email protected].

13. Contact Information & Policy Updates

We may update this Privacy Policy periodically to reflect technological improvements or regulatory updates. The "Last Revised" date at the top of this document indicates the latest modification.