Privacy Policy

1. Introduction and Our Role

SUPPLIQ SOFTWARE DEVELOPMENT SERVICES, trading as Suppliq ("we," "our," or "us"), operates the Suppliq platform — a point-of-sale, inventory, HR, and analytics system for Philippine businesses. This Privacy Policy explains how personal information is handled, in compliance with Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

The platform involves two different kinds of personal information, and our role differs for each. The distinction matters, because it determines who is responsible for what.

By using Suppliq, you agree to the practices described in this Policy. If you do not agree, please discontinue use of the platform.

2. Information We Collect

2.1 Account Data you provide

• Full name, email address, and contact number (account registration)
• Business name, address, and TIN (for BIR-format receipts, optional)
• Payment reference numbers submitted for subscription activation
• Support correspondence and bug reports you send us

2.2 Merchant Data you enter

Processed on your behalf as described in §1.2:

• Staff profiles including names, roles, and assigned branches
• Attendance records, including clock-in and clock-out photographs, working hours, and leave
• Payroll computations, cash advances, and deductions
• Customer names, contact details, purchase history, loyalty points, and credit balances
• Supplier information, purchase orders, and transaction records
• Product inventory data, pricing, and cost information

2.3 Information collected automatically

• App usage data (pages visited, features used, session duration)
• Device identifiers and browser type
• IP address and approximate location (country/region level)
• Timestamps of all actions (sales, adjustments, logins)
• Aggregated, anonymized performance metrics — page and operation load times, error counts, and device class (memory, network type, screen size and monitor count) — collected to diagnose and fix slow features. This contains no sale, customer, payment, or item data.

2.4 Camera and photo access

Suppliq requests camera access for the following specific purposes:

• Attendance selfies — staff clock in and out by taking a photo. The photo and timestamp are stored as part of the attendance record. This is Merchant Data: the employer decides to enable it, and is responsible for informing staff and obtaining consent. It can be switched off in payroll settings.
• Barcode scanning — the camera is used to scan product barcodes during sales and inventory operations. No images are stored during barcode scanning.
• Product and delivery photos — optional photos attached to inventory items and delivery records.

Camera access is requested only when you initiate these actions. You may decline camera access; however, some features (attendance selfies, camera-based barcode scanning) will be unavailable.

2.5 Storage access

Photos captured within the app (attendance selfies, item images, delivery attachments, team logos) are uploaded and stored in our secure cloud storage (Supabase Storage). We do not access photos stored elsewhere on your device.

2.6 Push notifications

If you grant permission, Suppliq may send push notifications for operational alerts such as low stock warnings, shift reminders, new team join requests, and payment confirmations. You can revoke notification permission at any time through your device settings. Notification permission is optional and does not affect core app functionality.

2.7 Cookies, local storage, and analytics

We use two categories of browser storage, and they are treated differently.

Essential storage — always active. The Service cannot work without these, and they are not used to track you across other websites:

• Your login session (authentication tokens)
• Cached team, branch, and plan data, to reduce network requests
• Pending sales transactions stored offline, for sync when you reconnect
• Interface preferences such as dark mode, and your cookie choice itself

Analytics and advertising — only with your consent. On our public website and sign-in pages we would like to use:

• Meta Pixel (Meta Platforms, Inc.) — measures the effectiveness of our advertising and lets us understand which campaigns lead to signups. Meta may use this to show you Suppliq ads on its platforms.
• Google Analytics 4 (Google LLC) — aggregate statistics about how visitors use our website.

These load only if you accept them. When you first visit, we ask. Choose "Essential only" and no analytics or advertising script is loaded at all. You can change your mind at any time using the Cookie settings link in the footer of any public page — withdrawing consent is as easy as giving it.

These trackers operate on our public marketing and sign-in pages. They are not loaded inside the application itself, so your sales, inventory, staff, and customer data are never exposed to them.

We do not sell, rent, or trade personal information to any third party for marketing purposes.

3. How We Use Information

• Provide, operate, and improve the Suppliq platform
• Process and activate subscription payments, and send renewal and cancellation notices
• Send transactional emails (payment confirmation, renewal reminders, shift summaries) via our CRM partner
• Send push notifications for operational events you have opted into
• Generate payroll computations, attendance records, and business reports on your instruction
• Respond to support requests
• Detect and prevent fraud, unauthorized access, and abuse
• Comply with legal obligations under Philippine law
• Where you have consented, measure advertising effectiveness and website usage (see §2.7)

4. Third-Party Services and Sub-processors

We use the following third parties to operate the platform. Each has its own privacy policy. We update this list before engaging a new sub-processor that will handle Merchant Data, and notify account holders by email.

5. Data Security

• All data is encrypted in transit using TLS (Transport Layer Security)
• Database access is protected by Row-Level Security policies — users can only access data belonging to their own team
• Authentication tokens are stored locally and never transmitted in URLs
• Role-based access control restricts sensitive financial data to authorized roles
• Actions such as price overrides, discounts, stock adjustments and deleted sales are recorded in an immutable audit log
• Encryption at rest is enforced for all stored data
• Support access to a customer account is deliberate, logged, and time-limited

Despite these measures, no system is 100% secure. If you suspect unauthorized access to your account, contact us immediately at support@suppliq.app.

6. Data Retention

• Active accounts: data is retained for as long as your account is active.
• Expired subscriptions: your data is preserved when a subscription lapses. The account reverts to Free tier limits but nothing is deleted.
• Deleted accounts: all personal data is permanently removed from production servers immediately on deletion. Residual data in encrypted backups is purged within 30 days, except where retention is required by Philippine law.
• Attendance photos: photo files are automatically deleted after 90 days. Attendance records (times, hours) are retained, as required under the Labor Code.
• Delivery attachment photos: photo files automatically deleted after 30 days. The delivery record is retained for 10 years as required by BIR NIRC Sec. 235 and RR 17-2013.
• Activity logs: retained for 10 years then automatically purged, per BIR RMO 9-2021 Annex B audit-trail requirements.

7. Personal Data Breach

We maintain procedures to detect, report and investigate personal data breaches.

Where Account Data is affected and the breach meets the threshold under RA 10173 and NPC Circular 16-03, we will notify the National Privacy Commission and the affected individuals within seventy-two (72) hours of becoming aware of it.

Where Merchant Data is affected, we will notify you — the controller — without undue delay and in any event within seventy-two (72) hours, with the information you need to make your own notification. Because you are the controller of that data, the obligation to notify the NPC and the affected individuals is yours; we will provide reasonable assistance.

If you become aware of a breach affecting data held in Suppliq, tell us at privacy@suppliq.app as soon as possible.

8. Your Rights Under the Data Privacy Act of 2012

As a data subject under RA 10173, you have the following rights:

• Right to be informed — to know how your data is collected and used (this policy).
• Right to access — to request a copy of the personal data we hold about you.
• Right to rectification — to correct inaccurate or incomplete personal data.
• Right to erasure — to request deletion of your account and associated data (see §9).
• Right to data portability — to request an export of your business data in a machine-readable format.
• Right to object — to object to processing of your personal data for direct marketing.
• Right to damages — to be indemnified for damages sustained due to inaccurate, false, or unlawfully obtained personal data.
• Right to lodge a complaint — to complain to the National Privacy Commission at privacy.gov.ph.

To exercise any of these rights over Account Data, contact privacy@suppliq.app. We respond within 15 business days.

If you are an employee or customer of a business that uses Suppliq and you want to access, correct or delete data that business holds about you, please contact that business directly — they decide what is collected and are the controller of it. If you contact us instead, we will refer you to them and let them know you asked; we cannot act on their data without their instruction. See our Data Processing Agreement.

9. Account Deletion

You may delete your account and all associated data at any time:

• In-App: Settings → Account → Delete Account.
• By Email: send a deletion request to support@suppliq.app. We process within 5 business days.

Deletion is immediate and permanent. There is no grace period and we cannot recover a deleted account, so export anything you need first.

Deletion removes your profile, team data, sales history, inventory records, employee data, customer records, and uploaded files.

If you are the team Owner, deletion also removes all team member accounts associated with your team. Notify your team before proceeding. As the controller of your staff's data, consider any retention obligations you have toward them — for example under the Labor Code — before deleting.

10. Children's Privacy

Suppliq is a business management platform intended for use by individuals aged 18 and above. We do not knowingly collect personal information from children under 13 years of age. If we become aware that a child under 13 has provided personal information, we will delete it. If you believe a child has submitted information, contact us at privacy@suppliq.app.

11. International Data Transfers

Your data is stored on servers operated by the providers listed in §4, several of which are located outside the Philippines (primarily the United States). By using Suppliq, you consent to the transfer of your data to those jurisdictions. We remain accountable for personal data transferred to a sub-processor, and require each to maintain security standards equivalent to those required under the Data Privacy Act of 2012.

12. Data Protection Officer

We have designated a Data Protection Officer responsible for overseeing compliance with RA 10173 and for receiving data-privacy enquiries and complaints. The DPO can be reached directly using the details below, and messages sent to this address go to the DPO.

Data Protection Officer
SUPPLIQ SOFTWARE DEVELOPMENT SERVICES
Email: privacy@suppliq.app
Phone: +63 952 483 3994
Postal: 9th Floor, Sinocan Corporate Center, Aseana Business Park, Bay City, Tambo, Parañaque City 1701, Metro Manila, Philippines

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date and notify active users via in-app announcement. Continued use of Suppliq after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

For privacy-related concerns, data requests, or complaints:

SUPPLIQ SOFTWARE DEVELOPMENT SERVICES
9th Floor, Sinocan Corporate Center
Aseana Business Park, Bay City
Tambo, Parañaque City 1701
Metro Manila, Philippines
Phone: +63 952 483 3994
Privacy: privacy@suppliq.app
General support: support@suppliq.app
Response time: within 15 business days

You may also contact the National Privacy Commission at privacy.gov.ph.