Privacy policy
BSRSoft Inventory. Last updated: October 14, 2026
BSRSoft Inventory is an inventory and point-of-sale app for vendors who sell at craft fairs and markets. It is run by Brian Rizzo, under the name BSRSoft. This policy says what the app and its server keep, why, who else handles it, how long it is kept, and how to have it deleted.
Who this covers
The app is used by a business and the people that business invites (its owners and staff). It is not meant for children. It does not record anything about the people who buy from the business.
What is kept on your device
The app keeps the business's records in an encrypted database on each device that is signed in:
- items, prices, stock and stock changes;
- shows (name, dates, place and sales tax rates);
- sales, voids and the payment method used (cash, card and so on, but never card numbers);
- the business's name, logo and settings;
- for every change, which user and which device made it and when.
Each device also keeps its own settings that are never sent anywhere: a scrambled form of your PIN (never the PIN itself), whether fingerprint or face unlock is turned on (the unlock is done by your phone or computer; the app never sees your fingerprint or face), and the current show. Files you export are saved where you choose and are not encrypted by the app.
What is kept on the server
When a device syncs, the server keeps a copy of the business's records so every device of the business has the same ones:
- the records above, with which user and device made each change;
- the business's logo;
- each member's email address, role, and whether they are active or removed;
- changes from removed users that are held for an owner to review, with who reviewed them and when;
- email sent to the privacy address: who sent it and what it says.
The sign-in service keeps your email address and your password (only in a form that cannot be read back). If you sign in with Google, it keeps your Google account's ID and email address, and Google tells it whether that email address is verified; nothing else from your Google account is kept. Each business's records are kept apart from every other business's, and only its own members can reach them.
What is never collected
- Names, emails, phone numbers or card details of the people who buy from you.
- Your location, contacts, photos or anything else on your device outside the app.
- Analytics, advertising IDs, tracking or crash reports. The app and this site set no cookies; the sign-in page sets only the ones it needs to sign you in.
Logs
The server writes a log entry when it hits an error or refuses a request, describing what went wrong, so it can be fixed. These logs are kept for one month and then deleted. The server is not set up to log your password, your sign-in tokens or your IP address.
Who else handles your data
- Amazon Web Services, in the United States, hosts the server, sign-in and email (invitations, and mail sent to the privacy address). Amazon handles the data only to provide these services.
- Google, if you choose to sign in with your Google account, and for email sent to the privacy address, which is forwarded to the operator's Gmail inbox.
What we never do with your data
- We never sell, rent or trade your data.
- We never share it with anyone except the providers named above, who handle it only to run the service, or when the law requires us to.
- We never use it for advertising or to build profiles of you.
- We never use it to train artificial intelligence or machine-learning models, and never give it to anyone to do so.
How it is protected
Everything sent between the app and the server is encrypted (HTTPS). The device database is encrypted with a key held by your device's own secure storage. The server's database and files are encrypted when stored.
How long it is kept
- Business records are kept while the business uses the app, so its history and tax records stay complete.
- Server error logs are kept for one month.
- Email sent to the privacy address is kept on the server for 30 days, then deleted; the copy forwarded to the operator's inbox is kept until your request is handled, then deleted.
- The server's database can be restored to any moment in the last 35 days, so a mistake can be undone.
- A sign-in lasts up to a year on a device before you must sign in again.
- When a business removes a member, that person can no longer sign in to the business, but the records they made stay with the business.
Your choices
You can ask for a copy of your data, or for your account or your business's data to be deleted, by emailing privacy@bsrsoft.net. We act on every request within 30 days, and usually much sooner. Records that a business must keep for its taxes are the business's to keep; we will tell you if any of your request cannot be met and why.
Email that our filters mark as spam, as carrying a virus, or as not coming from the sender's own mail service is dropped without a reply. If you hear nothing back, please write again from another address.
Changes to this policy
If the app starts keeping new kinds of data (for example, when card payments through Square are added), this page will be updated first and the date above changed.