Privacy Policy
Effective Date: 1 May 2026
Last Updated: 30 May 2026
Legal Entity: Leavestech, a sole proprietorship registered in Ontario, Canada, operating as PlusNitro
Contact: contactus@plusnitro.com
Address: Virtual Office, Ontario, Canada
1. Overview
This Privacy Policy explains how PlusNitro collects, uses, discloses, stores, and protects information in connection with the PlusNitro software platform, including NitroFlow, NitroClub, APIs, dashboards, integrations, automation tools, analytics, artificial intelligence features, support, and related services (collectively, the “Service”).
NitroFlow is merchant operations software that may support order workflows, inventory synchronization, customer data workflows, reporting, POS integrations, payment-related workflows, delivery workflows, accounting integrations, and operational automation. NitroClub is customer loyalty and engagement software that may support rewards, offers, promotions, wallet passes, customer retention workflows, loyalty dashboards, and merchant-directed communications.
2. Roles Under Privacy Laws
For End Customer Data processed through the Service, Merchant is generally the data controller, business, or organization responsible for the customer relationship, privacy notices, lawful basis, and consent. PlusNitro acts as a service provider or processor when processing End Customer Data on Merchant’s behalf.
For Merchant account data, billing data, website visitor data, support data, and platform operational data, PlusNitro may act as an independent controller or business.
3. Information We Collect
3.1 Merchant Data
We may collect business name, owner or authorized user information, email address, phone number, account credentials, store locations, billing information, subscription information, configuration settings, integration credentials or tokens, support requests, and related account information.
3.2 End Customer Data
When Merchants use the Service, we may process End Customer Data on their behalf, including name, email address, phone number, customer identifiers, loyalty profile information, order or transaction references, reward activity, redemption activity, wallet pass data, and optional demographic information where provided by the Merchant or End Customer.
3.3 Integrated System Data
Merchant-authorized systems, including POS, e-commerce, messaging, payment, wallet, accounting, delivery, analytics, or operational platforms, may send data to PlusNitro. This may include merchant identifiers, location identifiers, order data, transaction data, product catalog data, inventory data, customer records, loyalty events, refund references, staff or operational metadata, and system status events.
PlusNitro does not intentionally collect or store full card numbers, CVV, full PAN, or payment instrument credentials. Payment-related information handled by the Service is limited to data made available by integrated providers and necessary to support merchant workflows.
3.4 Website and Technical Data
When users visit plusnitro.com or related domains, or use the Service, we may collect IP address, browser type, device identifiers, session data, pages viewed, referral data, API request logs, authentication logs, security logs, error logs, diagnostic data, and usage telemetry.
4. How We Use Information
PlusNitro uses information to provide, secure, maintain, support, troubleshoot, and improve the Service.
4.1 Merchant Operations
We use Merchant Data to create and manage accounts, authenticate users, configure integrations, deliver dashboards and reporting, process billing, provide support, send service notices, maintain security, prevent fraud, investigate incidents, and comply with legal obligations.
4.2 Processing End Customer Data on Merchant Behalf
We process End Customer Data to perform merchant-directed workflows, including loyalty program execution, reward tracking, redemption processing, customer profile management, order and transaction association, operational analytics, fraud prevention, digital wallet support, and merchant-directed communications.
4.3 Aggregated, De-Identified, and AI Uses
PlusNitro may use anonymized, aggregated, de-identified, and statistical data derived from Service usage for analytics, benchmarking, fraud prevention, security monitoring, product improvement, machine learning, artificial intelligence development, forecasting, recommendations, and system optimization. Such data does not reasonably identify an individual End Customer or Merchant.
5. Legal Basis for Processing
Under Canadian privacy laws, processing may be based on contract performance, legitimate business interests, consent where required, legal obligations, security, fraud prevention, and service delivery. Under United States privacy frameworks such as CCPA/CPRA, PlusNitro acts as a service provider for End Customer Data processed on behalf of Merchants and does not sell or share personal information as those terms are used for cross-context behavioral advertising.
6. Information We Share
We do not sell personal information. We may disclose information only as described below.
6.1 Subprocessors and Service Providers
We may share information with infrastructure, hosting, database, logging, monitoring, messaging, security, analytics, support, AI infrastructure, and operational service providers that help operate the Service.
6.2 Merchant-Authorized Integrations
We may exchange information with third-party systems configured or authorized by Merchant, including POS systems such as Clover, SMS providers such as Twilio or equivalents, wallet providers, payment-related systems, e-commerce systems, accounting systems, analytics systems, and future operational integrations.
6.3 Legal Requirements
We may disclose information where required by law, subpoena, court order, regulator, law enforcement request, legal process, or to protect rights, safety, security, and the integrity of the Service.
6.4 Business Transfers
Information may be transferred in connection with a merger, acquisition, incorporation, financing, restructuring, sale of assets, bankruptcy, or transfer of the PlusNitro business to a successor entity. Notice will be provided where legally required.
7. Communications
PlusNitro does not independently send marketing communications to End Customers on its own behalf. Communications through the Service are initiated, configured, or controlled by Merchants. Merchant is responsible for obtaining legally required consent and honoring opt-out obligations under CASL, TCPA, and other applicable communications laws.
Where PlusNitro sends service communications to Merchants, such communications may include onboarding, account, billing, security, legal, support, or operational notices.
8. Data Retention
| Data Category | Retention Period |
|---|---|
| Merchant account and billing data | Active term plus up to 7 years |
| End Customer loyalty/profile data | Active use plus up to 3 years, unless deletion is requested and legally permitted |
| Transaction, order, loyalty ledger, and redemption records | Up to 7 years |
| API, operational, and diagnostic logs | Generally 90 days, with extended retention for security, fraud, dispute, or compliance events |
| Fraud, abuse, security, audit, and opt-out records | Up to 7 years where reasonably necessary |
| Deleted account data | 90-day recovery window, then deletion unless legal retention applies |
9. Deletion and Recovery
Upon termination or verified deletion request, eligible data may enter a 90-day recovery window. After that period, data may be permanently deleted, except where retention is necessary for legal, tax, accounting, audit, security, fraud prevention, dispute resolution, or compliance purposes.
10. Merchant Responsibilities
Merchants are responsible for providing privacy notices to End Customers, obtaining required consents, maintaining lawful bases for processing, configuring communications properly, responding to End Customer requests where Merchant is the controller, and ensuring that data provided to PlusNitro may lawfully be processed through the Service.
11. User Rights
Depending on location, individuals may have rights to access, correct, delete, restrict, or obtain information about personal data, and to withdraw consent where processing is consent-based. Requests may be submitted to contactus@plusnitro.com. We may verify identity before responding.
If an End Customer contacts PlusNitro regarding data processed on behalf of a Merchant, PlusNitro may forward or direct the request to the relevant Merchant and assist the Merchant as required by applicable law and contract.
12. Canadian Residents
Canadian residents may request access to or correction of personal information and may withdraw consent where consent is the legal basis, subject to legal and contractual limits. Complaints may be directed to the Office of the Privacy Commissioner of Canada.
13. California Residents
California residents may have rights to know, access, correct, delete, and limit certain uses of personal information. PlusNitro does not sell or share personal information for cross-context behavioral advertising. For End Customer Data, PlusNitro generally acts as a service provider and will assist the relevant Merchant with applicable requests.
14. Children’s Privacy
The Service is not directed to children under 13. PlusNitro does not knowingly collect personal information from children under 13. If we learn that such information has been collected without required consent, we will delete it where legally required.
15. Security
PlusNitro uses commercially reasonable safeguards, including encryption in transit, encryption at rest where applicable, access controls, least privilege, monitoring, audit logging, vulnerability management, secure development practices, backup and recovery processes, and incident response procedures. No system is completely secure, and electronic transmission and storage carry inherent risk.
16. International Transfers
Data may be processed in Canada, the United States, and other jurisdictions where PlusNitro or its subprocessors operate. By using the Service, Merchant acknowledges that information may be transferred across borders and processed under laws that may differ from those in Merchant’s jurisdiction.
17. Subprocessors
PlusNitro uses subprocessors for infrastructure, communications, integrations, analytics, monitoring, security, support, and AI-related infrastructure. A Subprocessor Schedule is available upon request and may be updated from time to time.
18. Changes to This Policy
PlusNitro may update this Privacy Policy periodically. Material updates will be posted on the website or communicated through reasonable means where required. Continued use of the Service after the effective date of updates constitutes acceptance where permitted by law.
19. Governing Law
This Privacy Policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to conflict of law principles.
20. Contact
PlusNitro Legal
contactus@plusnitro.com
Virtual Office, Ontario, Canada