Privacy Notice

This notice applies to the NegosyoTracker website and authenticated business-management workspace. NegosyoTracker acts as a personal information controller for account administration, authentication coordination, service security, and direct communications with its users.

When a business user records information about customers, staff, suppliers, or other individuals, that business decides why and how the information is used. For that processing, the business is generally the personal information controller and NegosyoTracker acts as its personal information processor, subject to the Data Processing Addendum.

• Account data: owner or business name, email address, Clerk user identifier, authentication status, and legal-acceptance time. Passwords and Google credentials are handled by Clerk and are not made available to NegosyoTracker.
• Business records: customer names and optional contact details, customer types, notes, products, suppliers, product images, stock levels, orders, order items, sales, and expenses.
• Technical data: authentication tokens, security and request logs, device or browser details, IP-derived security information, and essential cookies used to operate and protect the service.
• Support data: information a user includes when asking for technical, privacy, or account assistance.

Users must avoid entering sensitive personal information unless it is necessary, lawful, and appropriate for their business purpose.

• To create and secure accounts and provide the requested service.
• To store, organize, retrieve, and calculate the user's business records.
• To prevent abuse, investigate failures, maintain availability, and protect accounts.
• To answer support and data-subject requests.
• To comply with Philippine legal obligations and enforce the Terms of Service.
• To provide AI-supported insights only when that feature is introduced and the related processing has been disclosed.

Processing is based on performance of the service contract, legitimate business and security interests, compliance with law, or consent where consent is specifically required. Optional marketing will require separate permission.

NegosyoTracker uses service providers only as needed to operate the service. Current provider categories include:

• Clerk for authentication, account management, and legal-acceptance records.
• Application hosting and network providers that deliver the frontend and API.
• PostgreSQL infrastructure for business records and Redis infrastructure for short-lived application caching.
• Supabase Storage for product images uploaded by users.
• Email infrastructure when the service sends account or operational messages.

Information may also be disclosed when required by law, to protect users or the service, during a lawful business transfer, or on the documented instruction of the business that supplied the information. NegosyoTracker does not sell personal data.

Some providers may process or store information outside the Philippines. NegosyoTracker will use contractual and organizational safeguards appropriate to the processing and will remain accountable for providers processing personal data on its behalf.

Account and business data are retained while the account is active and afterward only for a period reasonably needed for recovery, security, legal compliance, dispute handling, or the operator's documented retention schedule. Backups may retain deleted information for a limited recovery cycle before being overwritten.

Clerk provides authentication-account deletion. Business records and uploaded images are stored in separate systems, so deleting only the Clerk identity does not by itself confirm deletion from every NegosyoTracker system. Before closing an account, users should export needed records and submit a deletion request through the contact in this notice so removal can be confirmed across the API, database, cache, backups, and storage, subject to lawful retention requirements.

Subject to the Data Privacy Act and applicable exceptions, individuals may request:

• Information about and access to their personal data.
• Correction of inaccurate or incomplete information.
• Objection to or restriction of certain processing.
• Erasure or blocking when the legal conditions are met.
• A portable copy of eligible data in a commonly used format.
• Withdrawal of consent without affecting earlier lawful processing.

Individuals may also lodge a complaint with the Philippine National Privacy Commission. When NegosyoTracker processes an individual's information for a business user, the request should normally be directed first to that business; NegosyoTracker will assist the business as required.

NegosyoTracker uses account authentication, owner-scoped API access, transport encryption, access controls, validation, backups, and monitoring appropriate to the service. No online system can guarantee absolute security. Qualifying personal data breaches will be assessed and reported to the National Privacy Commission and affected individuals within the periods required by Philippine law.

NegosyoTracker is intended for people at least 18 years old who can enter into a business agreement. It is not designed to collect information directly from children. Business users are responsible for having a lawful basis before entering any minor's information in their records.

Material changes will be identified by a new version and effective date. Where a change materially affects the purpose, scope, method, or extent of processing, users will receive appropriate notice and a new consent request when consent is required.