(615) 645-6837

Become a customer
Hágase cliente

KOS Distribution, LLC · Buyer app and Sales app

Mobile App Privacy Policy

Effective date: October 12, 2026. This version replaces the policy last updated July 28, 2025.

This policy covers the KOS Distribution mobile apps:

  • the Buyer app for iOS and Android, used by employees of our customer companies;
  • the Sales app, used by KOS employees and sales representatives on iOS, Android, Windows desktop, and rugged handheld devices.

It is a companion to our main Privacy Policy, which covers our websites and web store and the statements that apply to all KOS services. Where this policy and the main Privacy Policy overlap, they are intended to be read together.

KOS Distribution, LLC (“KOS”, “we”, “us”) provides business-to-business wholesale food distribution. The apps are business tools intended for people acting for a company, not for consumers in a personal capacity.

Questions about this policy: privacy@kosdistribution.com · KOS Distribution, LLC, 3864 Logistics Way Ste 101, Antioch, TN 37013 · phone 615-645-6837.

1. The Buyer app (iOS and Android)

The Buyer app lets employees of customer companies browse the catalog, place and manage orders, and view invoices and order activity while online or offline.

Account and sign-in. You sign in with a KOS account (email address and password) issued for your company. Passwords are never stored on your device in plain form. After sign-in, the app keeps a session token on the device so you stay signed in, and remembers which company account you are working with. The currently selected company appears in analytics and service logs as an internal customer ID, never as a company name.

Order, catalog and business data. The app is offline-first: a copy of the data you need to work — product catalog and images, your company’s prices, shopping carts, orders and their statuses, invoices and payables, order history — is stored in an app database on your device and synchronized with KOS servers when you are online. Orders you submit are exported to our ERP (NetSuite) for fulfillment and invoicing. Invoice and transaction documents you open are downloaded for viewing. No payment card or consumer billing details are entered in or stored by the app.

Push notifications. To deliver notifications (for example about order status or synchronization results), the app registers with Firebase Cloud Messaging and stores the push token, your device platform, and whether you granted the notification permission — under a randomly generated anonymous identifier, not your account. If you disable notifications, we store that fact to stop sending you messages. The apps send service notifications only, not marketing.

Crash reports and logs. Crash reports and non-fatal errors are sent to Firebase Crashlytics; they contain technical information (app version, device model, operating system, stack traces, recent log lines) and are keyed by a random anonymous identifier — not by your name or email. The app also keeps service logs used in troubleshooting; when uploaded to KOS (via our backend to AWS CloudWatch Logs), a log line can include the signed-in user’s email address, the selected company, and device/app information. Error summaries may additionally be posted to internal KOS operational channels (Google Chat) accessible to authorized staff only.

Usage analytics. We use Google Analytics 4 (via Firebase) to understand how the app is used. Events include: screens you open and buttons you press; catalog searches, including the search text you type, result counts, and filters; cart and order events with product identifiers (SKU), quantities and monetary values; order-submission outcomes (success/failure and the technical reason); barcode-scan outcomes; language selection and sign-in events. Every event is tagged with the platform (Android or iOS). The analytics user ID is your company’s internal customer ID — never your email or name. Cart and order events do not include customer names, addresses, emails, or the barcodes you scan. Firebase also collects identifiers and device attributes automatically (app-instance ID and locale). Analytics reports are used in aggregate and do not identify you by name.

Camera. Camera access is used only to scan product barcodes. The camera feed is processed on the device; scanned values are looked up in the local catalog and are not included in analytics events.

What the Buyer app does not collect: precise or approximate device location (the permission is never requested), your contacts, microphone audio, or photos from your photo library.

2. The Sales app (KOS staff and sales representatives)

The Sales app works like the Buyer app — same offline business data, push, crash reporting, service logs, and analytics described above (with platform values covering iOS, Android, desktop, and handheld scanners) — with these additions:

Google Sign-In. KOS staff sign in with Google. When they do, we receive from Google the account email address (and the name on the Google profile, if present) to find and authenticate the KOS employee account. We use this information only to sign users in and administer accounts. We do not publish anything to Google accounts and do not use Google account data for any unrelated purpose (Google API Services Limited Use).

Location. When a sales representative submits an order, the app records the device’s GPS coordinates (if location permission is granted) and stores them with that order, so KOS can attribute and verify field activity. If precise location is unavailable, an approximate position may be derived from the network. The “show me on the map” features use device location only while the map is open. Location permission can be refused or revoked at any time; order submission keeps working without coordinates.

Photos and files. Staff can attach photos or files to memos, order guides, and related records. The file stays on the device until synchronization uploads it to KOS servers, where it becomes part of that business record.

3. How we use information

We use the information described above to:

  1. authenticate users and provide access to the company’s prices and order history;
  2. operate the offline catalog, cart, ordering and order-management features, and sync them with KOS systems;
  3. fulfill and invoice orders, and keep the records required for a wholesale/trade relationship;
  4. send service notifications about orders and account activity;
  5. diagnose errors, maintain performance and secure the apps;
  6. understand feature usage in aggregate so we can improve the apps;
  7. meet legal, accounting and record-keeping obligations.

We do not use personal information for targeted advertising, profiling, or automated decision-making about individuals, and we do not sell or rent it.

4. Where data is stored and processed

  • On your device: the offline database, session token and local logs. This data stays until app reset or uninstall.
  • KOS servers and cloud services: the web store backend (Magento-based), the synchronization service (commerce bridge), our ERP (NetSuite), and AWS CloudWatch Logs for diagnostics. Processing and storage are located primarily in the United States.
  • Google Firebase: Analytics (GA4), Crashlytics, Cloud Messaging, and the Realtime Database entry that links push tokens to anonymous identifiers. Google processes this data under the Google Firebase Terms and its privacy policy: https://policies.google.com/privacy

If you use the apps from outside the United States, you understand that your information is transferred to and processed in the United States.

5. Data sharing

We share personal information only with:

  • service providers processing data on our behalf under contractual obligations: Google (Firebase), Amazon Web Services (CloudWatch Logs), and our ERP provider (NetSuite). They may use it only to provide us their services;
  • your company: app accounts are issued by your employer (customer company), and activity of individual user accounts may be visible to that company’s administrative users and to KOS sales staff serving it;
  • authorities, where disclosure is required by law, regulation, or valid legal process.

We do not sell personal information, share it for third-party advertising, or disclose it to data brokers.

6. Retention

  • Offline app data on your device: until app reset or uninstall.
  • Session token: until sign-out, token expiry, or uninstall.
  • Business records (orders, invoices, attachments): kept as long as necessary for the commercial relationship and as required by tax, accounting and commercial law.
  • Crashlytics reports: up to approximately 90 days (Firebase default).
  • GA4 analytics events: 14 months (the retention setting of our Google Analytics property); aggregate reports are kept longer.
  • Push token record: until replaced by a new token or removed on uninstall.
  • Diagnostic logs in CloudWatch: 1 month, then deleted automatically.

7. Security

Information in transit uses TLS. Data stored on your device lives inside the app’s own storage. Access to KOS servers and logs is restricted to authorized personnel. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your choices and rights

Permissions. Camera, notifications, and (Sales app) location permissions can be refused or revoked at any time in your device settings; the apps keep working with reduced functionality.

Analytics and diagnostics cannot be switched off in-app today; if you want them minimized, contact us and we will advise what is possible.

Access, correction, deletion. You may request access to, correction of, or deletion of your personal information by contacting us at the email above or through your KOS account manager. We will respond within a reasonable period. We may retain certain information (for example order and invoice records) where required by law or legitimate business needs, and we will inform you when we cannot delete something and why.

Account deletion. A company administrator or the account owner can request deletion of a user account and its associated data by emailing privacy@kosdistribution.com. Deleting an app from your device removes all locally stored data immediately.

California residents (CCPA/CPRA). We do not sell or share personal information as defined by the California Consumer Privacy Act. You have the right to know, access, correct, and delete personal information we hold, and to not be discriminated against for exercising these rights. To exercise them, contact us as described above.

9. Children

The apps are business tools intended for users acting for a company. They are not directed to children under 13 (or under 16 where applicable), and we do not knowingly collect personal information from children.

10. Changes to this policy

We may update this policy as the apps evolve. The current version is always published at https://kosdistribution.com/mobile-app-privacy-policy/ with its effective date. General statements that apply to all KOS services are maintained in the main Privacy Policy at https://kosdistribution.com/privacy-policy/.

11. Contact

KOS Distribution, LLC
3864 Logistics Way Ste 101, Antioch, TN 37013
Phone: 615-645-6837
Privacy questions: privacy@kosdistribution.com
Last updated: October 12, 2026