Privacy Policy
Effective September 19, 2026 · Updated October 23, 2026
CStoreNexus is software a store owner uses to run their own business. Almost everything in it is your business data — your registers' files, your invoices, your price book. We hold it so the software can show it back to you. We do not sell it, we do not advertise against it, and we do not use it to train anything.
1. Who we are
CStoreNexus is operated by CStoreNexus LLC, Memphis, Tennessee, United States. If you have a question about anything on this page, write to support@cstorenexus.com.
2. What this policy covers
The CStoreNexus web application at app.cstorenexus.com, the CStoreNexus mobile app for iPhone and Android, the collector software that runs on a store's office PC, and this website. It does not cover anything your register manufacturer, fuel supplier or card processor does with your data under their own agreements with you.
3. What we collect
Account information
- Your name and email address.
- Your role (Owner, Admin, Supervisor, Manager or Employee) and the list of locations you may see.
- A password, which is held by Google Firebase Authentication and is never visible to us in readable form.
Your business data
The whole point of the product. This is created by your own equipment and your own staff:
- Register files. Transaction journals and day-close movement documents written by your Gilbarco Passport or Verifone Commander, collected from the register's own network share.
- Sales, shift and fuel data derived from those files — department totals, hourly sales, tenders, lottery, gallons by grade, tank readings.
- Invoices you or your staff upload, including the photographs and PDFs themselves, and everything read out of them: vendor, item numbers, costs, quantities.
- Your price book — items, costs, retails, categories, vendors, promotions and the price changes you queue to your registers.
- Records of what people did in the software: who accepted a shift, who accepted an invoice, who changed a price and when.
Register journal files may contain payment details in the truncated, masked form the register itself writes — typically a card type and the last four digits. We store the register's file as it was written. We never collect, and the register never gives us, a full payment card number, PIN or magnetic stripe data. We do not process payments.
Time clock and payroll
If your account uses the time clock: each employee's name, clock number, department, home store and pay rate; every punch (the time, the clock and the store); the corrections made to a timecard, with who made them and why; and the weeks approved. A clock also reports the card number and keypad PIN it holds for each person, so the clock and CStoreNexus stay in step.
Fingerprints never leave the clock. A fingerprint is enrolled and matched on the time clock itself. CStoreNexus receives the punch and the fact that a person has a fingerprint enrolled — never the fingerprint or any template made from it.
HR forms
If your account uses HR forms (for example a job application), the answers a person gives on the form and any files they attach, such as a résumé or a certificate. The form's owner decides what it asks; the answers are visible only to the people on your account who may see that store.
Support, the AI support chat and Nexus Assistant
- Support tickets — what you write, the photos and screen recordings you attach, and the emails we send you about the ticket.
- The AI support chat — the conversation, so it can be emailed to you or turned into a ticket.
- Nexus Assistant — the questions you ask. The figures in an answer are worked out from your own records; to decide what to show, and to write a few lines about an answer, the question and a short summary of the tables are sent to the AI provider named in section 7.
Photographs and files you upload
Invoice photographs, PDFs and spreadsheets you send from the web app or the phone. These are stored against the location they belong to. Invoice uploads are capped at 15 MB and limited to images, PDFs, CSV and Excel files. Attachments to a support ticket or an HR form are kept with that ticket or form.
What the mobile app asks for, and why
| Permission | Why | What leaves the phone |
|---|---|---|
| Camera | Photograph an invoice; scan a barcode for a price check. | An invoice photo you choose to send. Barcode scanning happens on the phone — no image from a scan is uploaded. |
| Photos / Files | Attach an invoice you already photographed or received as a PDF, or a photo or screen recording to a support ticket. | Only the file you pick. The app cannot browse your library on its own. |
| Face ID / Touch ID / fingerprint | Unlock the app after your first sign-in. | Nothing. Your device tells the app yes or no. No biometric data is ever sent to us or stored by us. |
| Notifications | Tell you something is waiting for you to accept. | A device token, so a notification can reach that phone. |
Technical data
Server logs of requests to the service (time, IP address, which function ran, whether it succeeded), and error reports when something breaks. When a screen in the phone app fails, the app sends a crash report: what went wrong and on which screen, the last screens visited, the app version, the phone's model and operating system, the account, who was signed in and the station in hand. Kept so the service can be operated and debugged, and never used for advertising or tracking.
If you ask for a walkthrough on this website
The form asks for your name, email address, company, number of stores, register type and an optional note. Only your name and email are required. We use them for one thing: to reply and arrange the walkthrough. You get one confirmation email at the address you gave, and we write to you about the walkthrough; we do not add you to a mailing list.
- To make sure we can reply, we look up whether your email domain accepts mail. Nothing is sent to check it.
- To stop the form being abused, we count requests from the same network for one hour, using a one-way code rather than the address itself. Apart from ordinary server logs, we do not store your IP address or browser details with your request.
- We keep a request while we are in touch about it. Ask and we will delete it.
4. What we do not do
- We do not sell, rent or share your data with data brokers or advertisers.
- We do not show ads, and we run no advertising or cross-site tracking code.
- We do not use your invoices, price book or sales data to train machine-learning models of our own.
- This website sets no cookies and runs no third-party analytics. Signing in to the application does store a session on your device, because that is what keeps you signed in. See Cookies and similar storage.
5. Cookies and similar storage
This website (cstorenexus.com) sets no cookies and stores nothing in your browser. It has no analytics, advertising or tracking code and no embedded content from other companies, and its fonts are served from our own domain.
The web app (app.cstorenexus.com) uses your browser's storage for two things, both needed for it to work the way you set it up:
- Your signed-in session, kept by Google Firebase Authentication, so you stay signed in.
- A few preferences on that device: table columns, page size, and your favourite and recent reports.
The phone app keeps your sign-in and settings on the phone in the same way. None of this is used to track you or shared with anyone. Signing out ends the session; clearing your browser's data for the site removes the rest.
Because nothing optional is stored, there is no cookie banner to accept. If that ever changes, we will ask you first.
6. How we use what we collect
- To run the software: read your register files, build your reports, read your invoices, hold your price book.
- To decide who may see and do what, using your role and your location list.
- To notify you when something needs your attention.
- To run the time clock and produce the payroll register your account asks for.
- To answer your questions in Nexus Assistant and the AI support chat.
- To support you when you ask for help, and to find and fix defects.
- To bill you, and to keep the records a business is required to keep.
- To comply with the law where we must.
7. Who else touches it
We use a small number of service providers. They act on our instructions and may not use your data for their own purposes.
| Provider | What it does | Where |
|---|---|---|
| Google (Firebase, Gmail) | Hosting, sign-in, database, file storage and the scheduled jobs that build your reports. Walkthrough requests also arrive in our team's Gmail inbox. | United States |
| OpenRouter, and the model provider it routes to (currently Google Gemini) | Reads the text off an invoice photograph you upload; answers questions in the AI support chat; and, for Nexus Assistant, decides what to show and writes a few lines about an answer. Only what each task needs is sent — the invoice image, the chat conversation, or the question and a summary of the answer's tables — and for that purpose only. | United States |
| Apple, Google | Deliver push notifications to your phone, and distribute the mobile app. | United States |
| ZKTeco cloud time clocks (if you use them) | The clocks at your stores send each punch to CStoreNexus. The clock is your equipment; fingerprints stay on it. | At your stores |
| Expo (650 Industries) | Passes push notifications on to Apple and Google, and delivers updates to the phone app. | United States |
| Hostinger | Email: our support@cstorenexus.com mailbox, and the messages sent when you ask for a walkthrough. | Hostinger's mail servers, which may be outside the United States |
We will also disclose data if the law requires it, and we will tell you unless we are forbidden to. If the business is ever sold, your data moves with it and you will be told before anything changes.
8. Where it lives, and for how long
In Google Cloud data centres in the United States. We keep your business data for as long as your account is open, because a back office with a deleted history is not a back office. Server logs are kept for up to 90 days.
Backups. Backups run every hour into separate, access-restricted Google Cloud storage in the United States: a full copy of the database every day (kept 35 days), a monthly copy (kept about 13 months), and an archive of your register files (kept while your account is open). A restore is tested every week.
Your register's own files never leave your store on our account. The collector copies them up; it never deletes the originals from the store PC. Whatever happens to us, the files on that machine are still yours and still there.
9. Security
- Everything travels over HTTPS/TLS and is encrypted at rest by Google Cloud.
- Access is enforced on the server by rules tied to your account and your location list — not by hiding buttons in the interface.
- Read-only roles (Manager, Employee) cannot accept a shift, accept an invoice, send a price to a register, or add a user, and the server refuses those writes regardless of what a client asks for.
- No system is perfectly secure. If a breach affects your data we will tell you promptly and say what we know.
10. Your choices and your rights
You may ask us to show you what we hold, correct it, export it, or delete it. Write to support@cstorenexus.com from the address on the account and we will answer within 30 days. Depending on where you live you may have rights under laws such as the California Consumer Privacy Act or the GDPR; we apply the rights described here to everyone regardless.
11. Deleting your account and your data
You can have your account and its data deleted in either of two ways:
- Ask the Owner on your account to remove you in Users & Access. That revokes your access immediately.
- Email support@cstorenexus.com from your account address with the subject Delete my account.
Your sign-in record and personal details are deleted within 30 days. Business records that the account owner must keep — accepted shift reports, accepted invoices, the audit trail of who changed a price — are retained for up to 7 years where tax or accounting law requires it, or deleted sooner on the account owner's written instruction. Deleted data rolls off the daily backups within 35 days and the monthly copies within about 13 months; your register-file archive is deleted with the account.
12. Children
CStoreNexus is business software and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has an account, write to us and we will remove it.
13. Changes to this policy
If we change something that matters, we will change the date at the top and tell account owners by email before it takes effect. The current version always lives at cstorenexus.com/privacy.
14. Contact
CStoreNexus LLC · Memphis, Tennessee, United States
support@cstorenexus.com