Privacy Policy

1. What MicroBiz is

MicroBiz helps small businesses in the Philippines keep records of their sales, stock, expenses, customer credit (utang), cash and contacts.

MicroBiz records which payment method a customer used (cash, GCash, Maya, card and so on); it never processes payments, and no money moves through it. Its receipts are not BIR invoices or official receipts.

2. Whose information we handle

• Users: the owners, managers and cashiers who sign in to MicroBiz.
• People in a business's records: customers, suppliers and other contacts that a business adds to MicroBiz, by typing them in, importing a CSV file or choosing them from the phone's contacts.

For the people in a business's records, the business decides why and how their details are used, and it is responsible for having a lawful basis under the Data Privacy Act of 2012 to keep them. We process those details only on the business's behalf and only to provide MicroBiz to it.

3. What we collect

Your account

• Your name and email address.
• If you sign in with Google: your name, email address and profile picture from your Google account (section 4).
• If you sign in with email: your email address and password. The password is stored only as a one-way hash; nobody can read it, including us.
• Your business's name, type, phone number and address, and your role in it (owner, manager or cashier).

A business's records

• Products, prices, costs and stock; purchases, sales and refunds, with the payment method recorded; expenses; cash counts; and utang balances and payments.
• Contacts: name, phone number, email address, address and notes.
• An audit log of who changed what, and when.

Your phone's contacts (Android, only if you choose)

When an owner or manager taps Import from phone, MicroBiz explains why it needs the contacts permission and only then asks Android for it. It shows the phone's address book so you can pick people. Only the contacts you select are uploaded, and only each one's name, one phone number and one email address, to add them to your business's contacts. The rest of your address book is never uploaded, stored or kept. You can turn the permission off at any time in Android's settings.

Subscriptions (Android, only if you buy a plan)

The plan, the Google Play purchase token, the renewal date and the subscription state that Google reports to us. Google handles the payment; we never see or store card or bank details.

Technical information

When the apps talk to our servers, our hosting providers record technical details such as your IP address, the browser or app version, request identifiers and sign-in times. We use them to keep MicroBiz secure and working, and to answer support requests.

On your device

The apps keep you signed in and remember small settings (for example, that you hid the Getting started card). The web app stores its own program files in your browser so it opens faster. Your business's records aren't kept on the device for offline use.

MicroBiz has no advertising, analytics or crash-reporting services. It doesn't use advertising IDs, and it doesn't track you across other apps or websites.

4. Information from your Google account

If you choose Continue with Google, Google shares your name, email address and profile picture with MicroBiz (the basic "openid", "email" and "profile" permissions). MicroBiz asks for nothing else: no access to your Gmail, Google Drive, Google Contacts, calendar or any other Google data.

We use this information only to create your account, sign you in, and show your name to the other people in your business (for example in the staff list, on receipts and in the audit log). We don't sell it, use it for advertising, or use it to develop or train artificial intelligence or machine-learning models, and nobody reads it except when needed for security, to comply with the law, or with your consent.

MicroBiz's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove MicroBiz's access to your Google account at any time at myaccount.google.com/connections. To erase what we hold, delete your MicroBiz account (section 7).

5. How we use information

Only to provide MicroBiz to you and your business:

• to create and secure your account and sign you in;
• to keep the business's records, show its reports and let it export its own data;
• to show members of a business what their role allows them to see (cashiers, for example, never see costs or expected cash);
• to give the business the plan it paid for;
• to answer your questions and support requests, and to tell you about important changes to MicroBiz;
• to prevent abuse, investigate problems and meet legal obligations.

Our lawful bases under the Data Privacy Act are providing the service you asked for (the contract with you), our legitimate interest in keeping MicroBiz secure, and legal obligations. For the people in a business's records, the business decides the basis.

6. Who we share it with

We don't sell personal information, and we don't share it with advertisers or data brokers. A business's records are visible only to that business's members, according to their roles. There is no directory across businesses.

We use these service providers, which process information for us under contract and only to provide MicroBiz:

• Supabase — the database that holds the records, and sign-in. Servers in Singapore.
• Vercel — hosts the MicroBiz website and web app.
• Google — Google Sign-In; Google Play, which distributes the Android app and handles subscriptions; and Google Drive, where encrypted database backups are stored.
• GitHub — runs the daily backup job. Backups pass through it encrypted and are not kept there.
• An email delivery service — sends the codes for creating an account and resetting a password.

Some of these providers store or process information outside the Philippines, including in Singapore and the United States. We stay responsible for it under the Data Privacy Act wherever it is processed, and we choose providers that protect it to a comparable standard.

We may also disclose information when the law requires it (for example, a court order), to protect the safety, rights or property of people or of MicroBiz, or to a successor if MicroBiz is transferred, in which case this policy continues to apply and we will tell you first.

7. How long we keep it, and deleting it

We keep your account and your business's records for as long as the account is active. A business can archive contacts, or permanently delete a contact that has no utang balance and no sales.

You can delete your account at any time, in the app (Settings → Account → Delete account) or by following the steps on the Delete account page. If you can't sign in, write to alexpolo01@gmail.com from the email address of your account.

• If you own a business, the business closes at once for everyone in it, and the business and all its records (products, sales, contacts, utang, expenses, cash sessions and the audit log) are deleted for good after 30 days. Until then you can sign in and cancel. Your login is deleted with it, unless you still belong to another business.
• If you are a manager or cashier, your login is deleted at once. The business keeps the records you made, because it needs them for its own books: receipts keep your name as it was printed, and the audit log shows "Deleted user" instead of your name.
• Deleting your account doesn't cancel a Google Play subscription. Cancel it in Google Play.

Backups: we keep one database backup a day for 30 days and one a month for 12 months, to recover from mistakes and outages. Deleted information can remain in a backup until that backup expires (at most 12 months). It isn't used for anything else, and deleted data is never restored into the app.

Our hosting providers keep their technical logs for a limited period, after which they are deleted.

8. Your rights

Under the Data Privacy Act of 2012 (Republic Act No. 10173) you have the right to be informed, to access your information, to correct it, to object to its processing, to have it erased or blocked, to data portability, and to be compensated for damages. You can also file a complaint with the National Privacy Commission.

In the app you can see and correct your information, export your business's records as CSV files, and delete your account. For anything else, write to us at alexpolo01@gmail.com. We may need to confirm that the request comes from you.

If you are in a business's records (for example, as a customer), please contact that business first, because it decides how your details are used. You can also write to us and we will pass your request to the business and help it respond.

9. How we protect it

• Information travels between the apps and our servers encrypted (HTTPS).
• Every record is protected by access rules for its business and the member's role, so one business can never read another's records.
• Costs and expected cash are hidden from cashiers, and changes are written to an audit log.
• Backups are encrypted before they leave the database host, and only we hold the key.
• Only the people who run MicroBiz can reach the production systems, and only when needed to run and support it.

No system is perfectly secure. If a breach puts your information at risk, we will notify the National Privacy Commission and the people affected as the law requires.

10. Children

MicroBiz is a tool for running a business and is meant for people aged 18 and over. It isn't directed at children, and we don't knowingly collect information from them. If you believe a child has given us information, write to us and we will delete it.

11. Changes to this policy

When we change this policy we will post the new version here with a new date. If a change significantly affects how we use your information, we will tell you in the app before it applies.

12. Contact us

MicroBiz, the developer of MicroBiz, is responsible for your information as personal information controller. Our data protection officer can be reached at the same address.

Email: alexpolo01@gmail.com