Privacy Policy

Last updated: January 2026

At SoluitCR (operator of Soluit.app), we are committed to protecting the privacy and personal data of our users. This Privacy Policy describes how we collect, use, store, and protect your information when you use our products SmartRest Elite, SmartPOS, and any associated services.

1. Data Controller

The data controller for personal data is:

• Company: SoluitCR
• Website: soluitcr.com
• Email: info@soluit.app
• WhatsApp: +506 8830-8254
• Location: Alajuela, Costa Rica

2. Data We Collect

2.1 Data provided by the user

Category	Specific data	Purpose
Registration data	Full name, email address, phone/WhatsApp, business name, business type	Account creation and management
Billing data	Legal name, tax ID, fiscal address, payment details	Billing and tax compliance
Operational data	Products, prices, menus, categories, table configuration, business users and roles	POS system operation and management
Contact data	Delivery addresses, additional phone numbers	Service coordination

2.2 Automatically generated data

Category	Specific data	Purpose
Usage data	Transactions, orders, sales, receipts, payment methods, inventory, preparation times	System operation and analytical reporting
Technical data	IP address, browser type, device, operating system, screen resolution, session duration	Service improvement and technical support
Performance data	Load times, system errors, API latency, synchronization status	Monitoring and service optimization
Location data	Approximate location based on IP (not GPS)	Regional customization and fraud prevention

2.3 End-customer data (diners/buyers)

When businesses using our Service register data from their own customers (names, phone numbers, emails for reservations or QR orders), this data is the responsibility of the account-holding business. Soluit.app acts as a data processor on behalf of the business, in accordance with the instructions of the controller (the business).

3. Purpose of Processing

We use the collected data for the following purposes:

1. Service delivery: Operating, maintaining, and improving the features of SmartRest Elite, SmartPOS, and associated services.
2. Account management: Creating, authenticating, maintaining, and securing user accounts.
3. Billing and payments: Processing payment transactions, issuing invoices, and managing subscriptions.
4. Technical support: Responding to inquiries, resolving issues, and providing 24/7 technical assistance.
5. Service improvement: Analyzing usage patterns, identifying performance issues, and developing new features.
6. Communications: Sending operational notifications (updates, security, service changes) and informational messages (new features, usage tips).
7. Legal compliance: Fulfilling applicable tax, regulatory, and legal obligations in Costa Rica.
8. Security: Detecting, preventing, and resolving fraud, anomalies, and security incidents (forensic intelligence).

4. Legal Basis for Processing

The processing of your personal data is based on:

• Consent: By creating an account and using the Service, you provide express consent for the described processing.
• Contractual performance: Processing is necessary for the delivery of the contracted service.
• Legitimate interest: Usage analysis and service improvement serve our legitimate interest as the Service provider.
• Legal obligation: Compliance with tax and regulatory obligations requires the processing of certain data.

5. Multi-Tenant Architecture and Data Isolation

Our multi-tenant architecture ensures:

• Logical isolation: Each tenant has its own data schema, completely separate from other tenants.
• Dedicated domain: Each business operates under its exclusive subdomain (e.g., yourbusiness.soluit.app).
• Encryption: Data is encrypted both in transit (TLS/SSL) and at rest.
• Role-based access control: Granular permissions system (Admin, Cashier, Waiter, Warehouse) with PIN authentication for critical actions.

6. Data Retention

Personal data will be retained for as long as necessary to fulfill the described purposes and as required by applicable legislation:

Data type	Retention period	Criterion
Account data	Duration of subscription + 30 days	Potential post-cancellation claims
Transactional data (sales, orders)	Minimum 5 years	Costa Rican tax requirements
Billing data	Minimum 5 years	Tax legal obligation
Audit and forensic intelligence records	12 months	Security and fraud prevention
System and performance logs	90 days	Diagnostics and optimization
End-customer data	Per account-holding business policy	Processor on behalf of controller

After the retention periods have elapsed, data will be securely deleted or irreversibly anonymized.

7. Third-Party Data Sharing

Soluit.app does not sell or commercialize the personal data of its users. We only share data with third parties under the following circumstances:

• Cloud infrastructure providers: For data hosting and processing (e.g., cloud servers). These providers are subject to confidentiality and data processing agreements.
• Payment gateway providers: For processing subscription payments. Only the minimum information necessary for the transaction is shared.
• Legal requirements: When required by a competent judicial authority, in accordance with Costa Rican legislation.
• Rights protection: To investigate fraud, security breaches, or protect the rights of the Company or its users.

8. Cookies and Similar Technologies

Soluit.app uses cookies and similar technologies for:

• Essential cookies: Required for authentication, session management, and Service operation. No consent is required.
• Performance cookies: Collect anonymous data about Service performance (load times, errors). They help us improve the experience.
• Local storage (localStorage): The Service uses browser local storage for offline functionality (offline_queue), user preferences, and session data. This data is not shared with third parties.
• Service Worker (PWA): To enable installation as a native app and offline functionality. It does not collect personal data.

9. Data Subject Rights

As the owner of your personal data, you have the right to:

1. Access: Request information about the personal data we hold about you.
2. Rectification: Request the correction of inaccurate or incomplete data.
3. Erasure: Request the deletion of your personal data, in accordance with legal retention periods.
4. Objection: Object to the processing of your data for specific purposes such as commercial communications.
5. Portability: Request a copy of your data in a structured, machine-readable format.
6. Withdrawal of consent: Withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to such withdrawal.

To exercise any of these rights, contact info@soluit.app or via WhatsApp at +506 8830-8254. We will respond to your request within a maximum of 15 business days.

10. Data Security

We implement technical and organizational measures to protect your data:

• Encryption in transit: All communications between the browser and our servers use TLS/SSL (HTTPS).
• Encryption at rest: Data stored on our servers is encrypted.
• Multi-tenant isolation: Each business operates in a logically separated environment.
• Authentication and authorization: Granular role-based system with admin PIN for critical actions.
• Automatic backups: Periodic automatic backups to protect data integrity.
• Continuous monitoring: Forensic intelligence system with real-time anomaly detection.
• Access control: Restricted access to personal data only for authorized personnel who need it to perform their duties.

11. Offline Functionality and Local Data

The Service is designed to operate in offline mode as a PWA (Progressive Web App). In this context:

• Transactions made without an internet connection are stored locally on the user's device.
• Data is automatically synchronized with the server once connectivity is restored.
• The synchronization queue (offline_queue) is stored exclusively in the user's browser and is not accessible by third parties.
• The Company is not liable for data loss that has not been synchronized with the server.
• Upon logging out or uninstalling the PWA, local data is automatically deleted from the device.

12. International Transfers

Our servers may be located in data centers outside Costa Rica. In the event of international data transfers, we ensure adequate levels of protection through:

• Standard contractual clauses with cloud service providers.
• Comprehensive encryption of data in transit and at rest.
• Transfer impact assessments.

13. Children's Privacy

The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If we discover that we have collected data from a minor without parental consent, we will delete it immediately.

14. Security Notifications

In the event of a data breach affecting your personal data, we will notify you within 72 hours of discovery through:

• Email to the address registered in your account.
• Visible notice within the Service.
• Notification to the competent authorities as required by applicable legislation.

15. Changes to this Policy

We reserve the right to update this Privacy Policy. Significant changes will be notified with at least 15 days' prior notice via email or a visible notice in the Service. We recommend reviewing this policy periodically.

The date of the latest update is indicated at the beginning of this document.

16. Governing Law

This Privacy Policy is governed by the legislation of the Republic of Costa Rica, including the Personal Data Protection Law (Law No. 8968) and its Regulations, as well as applicable provisions on data protection.

17. Privacy Contact

For any inquiries, requests, or complaints related to this Privacy Policy or the processing of your personal data, you may contact us through:

• Email: info@soluit.app
• WhatsApp: +506 8830-8254
• Office hours: Monday to Friday 8:00 AM – 6:00 PM, Saturdays 9:00 AM – 1:00 PM (Costa Rica time)
• Address: Alajuela, Costa Rica