DRAFT — not legal advice. Last updated 30 August 2026.
Privacy
ApeXhit LLC (apexhit.org), Florida, United States, operates MerchMan at https://merchman.apexhit.org.
What we store
- Tenant and store profile: business name, merchant id, plan, status, feature gates, PayMongo or other processor references.
- Staff: name, email, role, gates, password hashes, optional PIN/2FA flags.
- Catalog and inventory; generated product QR payloads.
- Customers and loyalty members: name, email, phone, points, spend, visits, referral links, reward claims, hashed portal password.
- Transactions, receipts, voids, test-sale flags, emailed receipt logs.
- Shifts, breaks, opening/closing cash, support audit rows.
Rows are scoped by merchant_id in Supabase. Hosting is on Vercel. Email may be sent with Resend. Subscription billing, when enabled, will be processed by Lemon Squeezy or a successor merchant of record (their privacy policy applies to cardholder billing data).
What we do not store
Full card PAN/CVV. Wallet one-time credentials. Those stay with PayMongo, Stripe, GCash, Maya, or the QR network the store uses.
Why we use it
Operate the POS, loyalty portal, referrals, rewards shop, support, security audit, and (later) paid plan entitlements. Session cookies are HttpOnly. Loyalty portal sessions are separate from staff sessions.
Who can see it
Store owner and staff see their tenant only, limited by role gates. Founder and gated platform agents see a tenant during support and leave an audit trail. Processors see payment payloads they require. We do not sell loyalty lists.
Retention
Data stays while the tenant is active. Owner/manager may delete test rows. Founder may delete selected or mass records when gated. Archived or trashed tenants may be retained until emptied. Export before you ask us to wipe a month of history.
Your choices
Loyalty members can ask the store to correct or close an account. Store owners can export products, shifts, and transactions from the app. Contact apexhit.org for platform-level requests. These pages are not a GDPR/CCPA certification.