Privacy Policy
Version 2026-10-08 · DRAFT — to be reviewed by a Philippine lawyer / Data Protection Officer and all [bracketed] details filled in before launch.
This Privacy Policy explains how [Legal business name] ("Deskless Books", "we", "us") collects, uses, shares, stores and protects your personal information when you use the Deskless Books app and website, in line with the Data Privacy Act of 2012 (Republic Act No. 10173) and the rules of the National Privacy Commission (NPC).
1. What we collect
| Information | Examples | Why we need it |
|---|---|---|
| Account details | Email, password (stored only in scrambled form), language, nickname | To create and secure your account |
| Business details | Your name, business name, TIN, RDO code, address, mobile number, business type | To set up your books and apply the right tax rules |
| Identity check | A photo of one government ID and three live selfies | To confirm you are who you say you are |
| Your records | Income, expenses, categories, customers, vendors, inventory, fixed assets, bank and card accounts, reconciliations | The bookkeeping you use the app for |
| Receipts and voice notes | Photos of receipts; voice notes and messages you send to Libro | To read and record transactions for you |
| Withholding records | Tax your clients or platforms withheld from you (BIR Form 2307 details and any scans you attach); on Advance and Business, tax you withhold from suppliers and the payee's name, TIN and address shown on prepared 2307s | To track tax credits, fill in your tax-form worksheets and prepare 2307s for your payees |
| Imported statements (when available) | Bank and e-wallet statement files you upload for import (CSV, Excel or PDF) | To turn statement lines into transactions you review before saving |
| Collaborator details | Name, email, mobile number and (optional) PRC/CPA license number, TIN and firm name of accountants and bookkeepers | So owners know who is helping with their books |
| Activity records | Who opened a business and who added, changed or deleted what, and when | The owner's audit log, for accountability |
| Support conversations | Messages you send us and our replies | To help you |
| Billing | Your plan, payment status and payment reference (card details stay with our payment partner) | To bill you correctly |
| Technical data | App version, device type, error logs | To keep the Service working |
Phone notifications. In the Android and iPhone app, deadline reminders are scheduled on your phone by the app itself. We do not collect a push token or device ID for them. You can turn them off in your phone's settings.
Your government ID is sensitive personal information under the Data Privacy Act. We process it only with your consent and only for identity verification.
2. How we use it
- To provide the Service: your books, reports, reminders and tax-form worksheets.
- To verify identities at registration and when a collaborator joins a business.
- To read receipts, voice notes, chat messages and (when available) statements you upload, so they can become transactions.
- To answer support messages.
- To bill you and manage your plan.
- To keep the Service secure, prevent misuse (including daily limits on AI features) and fix problems.
- To meet our legal obligations.
We do not sell your information, and we do not use your records for advertising.
3. Automated processing
- Identity check: an AI system compares your ID with your selfies and with the name you entered. If it does not match, registration does not go through; you can try again or contact support.
- Receipt reading, statement import (when available) and Libro: AI suggests transaction details. You always review them before anything is saved.
- Tax comparison: the app calculates which tax option may cost less based on your records. It is a suggestion for you to check, not a decision.
4. Who can see your information
- You, and the collaborators you invite, according to the position you give them (and, if you have more than one business, only the businesses you let them access).
- Owners you help (if you are a collaborator) can see your name, email, mobile number, Account ID and the optional details you add to your profile, and your actions in their audit log.
- Our support team sees your name, email, Account ID, business name and plan when you message us. Support does not look at your books.
- Service providers who process data for us under contract, only to run the Service:
- Supabase — database, file storage and sign-in (servers in [region]);
- Google (Gemini API) — reading receipts, voice notes, ID photos and (when available) uploaded statements, and Libro's replies;
- [PayMongo] — payments;
- [email provider] — sign-in codes and notices.
- Government authorities, only when the law requires it.
Some providers process data outside the Philippines. We use providers that protect data at least as well as the Data Privacy Act requires.
5. How long we keep it
- Your account and records: for as long as your account is active. When you delete your account, there is a 30-day grace period; after that your records, receipt photos, ID photo and other files are permanently erased.
- Selfies from the identity check: used once for the check and never stored.
- ID photo: stored only if the check passes, and erased with your account.
- Voice notes and receipt photos: kept with your records and erased with your account.
- Withholding certificate scans (2307): kept with your records and erased with your account.
- Statement files uploaded for import (when available): [confirm before launch: kept with your records and erased with your account, or deleted once the import is done].
- Billing records and anything we must keep by law: kept for as long as the law requires, even after deletion.
The BIR may require you to keep your books for several years. That duty is yours — please export a copy before deleting your account.
6. How we protect it
Data is encrypted while it travels and while it is stored. Database rules make sure each person can reach only their own records and the businesses they were invited to. Logins need a password and an emailed one-time code. Our staff's access is limited to what they need to support you. No system is perfectly secure, so please keep your password private.
7. Your rights
Under the Data Privacy Act you have the right to be informed, to access your data, to object, to have wrong data corrected, to have your data erased or blocked, to data portability, to be compensated for damages, and to file a complaint. Many of these you can do in the app (edit your details, export your data, delete your account). For anything else, contact our Data Protection Officer below. You may also complain to the National Privacy Commission at privacy.gov.ph.
8. Children
Deskless Books is only for people aged 18 and over. We do not knowingly collect information from minors.
9. Data breaches
If a breach puts your information at real risk, we will notify the National Privacy Commission and the people affected within the time the law requires (72 hours from discovery).
10. Changes to this policy
We may update this policy. For an important change we will tell you in the app or by email at least [15] days before it takes effect and ask you to agree again. The version date is shown at the top.
11. Contact us
[Legal business name] · [Registered business address]
Data Protection Officer: [Name] · [DPO email]
You can also message us any time from the bell icon (Alerts) in the app.