AONAX
SoftPos DEMO
Aonax SoftPos DEMO — Privacy Policy
Effective Date: September 2, 2026
This Privacy Policy describes how Aonax SoftPos "DEMO" ("the software," "we," "us," or "our") handles personal information when you use our demonstration application for Android (SoftPos), an EMV contactless payment demonstration in a controlled test environment. This evaluation/demo version is for demonstration and testing only, and does not provide payment services in real use.
1. Information We Handle
We handle only the information necessary to demonstrate the SoftPos acceptance capability (device activation and contactless EMV acceptance flow).
1.1 Information You Provide (Device & Activation)
- Registration details: name, email, company, and region/country (selected from a list) that you fill in on the activation portal to receive a 6-digit, time-limited activation code (valid for 5 minutes).
- Device Instance ID: an automatically generated device identifier shown in the app, submitted together with the registration and used to bind the activation code to your device.
1.2 Information Automatically Handled (Device & Transaction)
- Device information: device Instance ID, basic Android system/device information, and NFC capability status.
- Transaction data: amount and currency, transaction time, transaction serial number (txId), card brand identification (e.g. Mastercard/Visa/UnionPay), masked card number (first 6 / last 4 digits only), and merchant/terminal numbers allocated by the acquiring bank for the demo.
- Network status: connectivity state used to keep the demo reachable.
1.3 Card Data — Important Notice
We do not collect real card data. The card data used in this demo (card number, expiry, Track 2, and PIN) are test card data provided for the demonstration only. They are processed solely in memory to complete the EMV acceptance flow and are not collected, stored, sold, or shared as personal information in any form.
Any stored transaction records contain only masked card information (first 6 / last 4 digits). Please do not use a real bank card in this demo. If real card data is accidentally used, stop the transaction and contact support@aonax.com.
2. Permissions We Request
The demo requests only the permissions needed for contactless acceptance, and these can be managed in your device settings at any time:
| Permission | Purpose |
|---|
| INTERNET | Process demo transactions and communicate with the demo backend. |
| ACCESS_NETWORK_STATE | Verify network connectivity for successful demo transactions. |
| NFC (android.hardware.nfc) | Enable contactless NFC card reading for the EMV demo. |
3. How We Use Your Information
- Issue and validate the time-limited activation code for device activation.
- Demonstrate the complete EMV acceptance flow (tap card → encrypted submission → acquirer decision).
- Diagnose issues, improve the demo experience, and assess acceptance capabilities.
- Comply with applicable legal or regulatory requirements.
We do not sell, rent, or share your personal information with third parties for marketing purposes. Data is shared only with the demo acquiring host strictly for processing the demonstrated transaction, and with trusted service providers under written protection commitments.
4. Data Security
- All network communications are protected by TLS.
- Transaction payloads use a double-layer envelope: AES-GCM transport encryption plus an ISO 9564 Format 4 PINBLOCK (card data and PIN are never transmitted in plaintext).
- DUKPT one-time-key (KSN advances per transaction) for payment-key rotation.
- Log hygiene: plaintext card numbers and PINs are never written to logs; records are masked.
- All keys in this demo are test keys used in the evaluation environment only.
5. Data Retention
- Activation registrations are retained to manage demo devices and activation codes.
- Transaction logs are retained for demo auditing.
- The app provides a "Sign out / Deactivate" action that immediately deletes all local data and deletes the server-side transaction records associated with the device.
- Since real card data is never collected, there is nothing to retain.
6. Your Rights
- Know what data is handled and review this policy.
- Correct your registration details through the activation portal.
- Delete local and deactivated server data at any time using the in-app "Sign out" (注销) action.
- Revoke permissions at any time in your device settings (may limit demo functionality).
- Contact us with any privacy request.
7. Updates to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be indicated through the app or the demo portal. Your continued use of the demo after updates constitutes acceptance of the revised policy.