Privacy Policy

Information you provide directly:

• Account data — Tenant code, business name, owner name, and email address provided at registration
• Transaction data — Financial records you manually enter into the App (amounts, service types, fees, notes)
• Support submissions — Your name, email, and message when you submit a bug report, feature request, or inquiry

Information received from third-party login providers (Google / Facebook):

• Name — Used to pre-fill your business display name on first sign-in
• Email address — Used as your account identifier and for account-linking if an account with the same email already exists
• Provider user ID — A unique identifier from Google or Facebook, stored to link your account and prevent duplicate registrations

We request only the email and public_profile scopes from Google and Facebook. We do not access your contacts, friends list, posts, or any other social data.

Information collected automatically:

• Device and Network Data — Your IP address, browser type (User-Agent), and approximate location (city/country derived from IP headers) to help secure your account and detect unauthorized access
• Session data — A secure session token stored in your browser to keep you logged in
• Device IDs — A unique cookie identifier to remember your trusted devices
• Usage timestamps — Dates and times of transactions, shift starts/ends, and other recorded events

We do not collect payment card numbers, government IDs, or any information from third-party payment platforms (GCash, Maribank, Maya). All wallet balances and amounts in the App are figures you enter manually.

We use the information collected to:

• Create and manage your tenant account
• Send email verification links and activate your account
• Send verification codes (One-Time Passwords) when you log in from an unrecognized device
• Deliver automated shift summary reports to your registered email
• Respond to your support requests and bug reports
• Improve the App based on usage patterns and feedback
• Detect and prevent fraudulent or unauthorized activity
• Comply with legal obligations

We will never sell, rent, or trade your personal information to third-party advertisers or data brokers.

By registering, you will receive:

• Security emails (mandatory) — password reset links, and login OTPs when a new device is detected
• Transactional emails (mandatory) — email verification links, shift summary reports
• Support responses — replies to tickets you submit through the in-app support form

We do not send promotional or marketing emails. All emails are sent via Resend (resend.com), a third-party email delivery service. By using KahaVendra, you acknowledge that your email address will be processed by Resend solely for the purpose of delivering the above emails.

• Your data is stored in a managed PostgreSQL database hosted on Neon (neon.tech), a secure cloud database provider.
• Passwords are hashed using bcrypt and are never stored in plain text.
• Session tokens are stored as secure hashes and expire automatically.
• All data in transit is encrypted via HTTPS/TLS.

While we implement industry-standard security measures, no system is 100% immune to security breaches. We encourage you to use a strong, unique password and to log out when using shared devices.

KahaVendra uses the following third-party services that may process your data as part of operating the App:

• Neon (neon.tech) — Database hosting. Your business and transaction data is stored on their infrastructure.
• Resend (resend.com) — Email delivery. Your email address and email content are transmitted to Resend when we send you an email.
• Vercel — Application hosting and serving.
• IP-API (ip-api.com) — Geolocation lookups. Your IP address may be verified against their service to estimate your login city and country for security alerts.
• Google (accounts.google.com) — Optional sign-in provider. If you choose to sign in with Google, your name and email are shared with us by Google under Google's Privacy Policy.
• Meta / Facebook (facebook.com) — Optional sign-in provider. If you choose to sign in with Facebook, your name and email are shared with us by Meta under Meta's Data Policy. We store your Facebook User ID solely to link your account. You may revoke access at any time via your Facebook App Settings.

These providers are contractually obligated to handle your data securely and may not use it for their own purposes beyond providing their services to us.

• Account data is retained for as long as your account is active.
• Transaction and shift records are retained indefinitely to support your business history and audit needs.
• OAuth provider IDs (Google / Facebook user IDs) are retained for as long as your account is active and deleted along with your account upon request.
• Device recognition data (Trusted Devices) is linked to your account and remains so you don't receive repetitive OTP challenges.
• One-Time Password (OTP) codes expire after 10 minutes and are deleted permanently once used.
• Email verification tokens expire after 24 hours and are deleted automatically.
• Session tokens expire after their configured duration.
• Support tickets are retained to track issue resolution history.

If you wish to have your account and associated data deleted, you may:

• Contact us at kahavendra@siklabtech.org — we will process your request within 30 days.
• If you signed in via Facebook, submit a deletion request directly through your Facebook App Settings or our Data Deletion page. This will immediately and permanently delete your account and all associated data.

Depending on your jurisdiction (including under the Philippine Data Privacy Act of 2012 — Republic Act 10173), you may have the following rights:

• Right to Access — Request a copy of the personal data we hold about you
• Right to Rectification — Update inaccurate or incomplete data via your Tenant Profile settings
• Right to Erasure — Request deletion of your account and personal data
• Right to Object — Object to how we process your data in certain circumstances
• Right to Data Portability — Request your data in a structured, machine-readable format

To exercise any of these rights, contact us at kahavendra@siklabtech.org.

KahaVendra is intended for business use by adults (18+). We do not knowingly collect personal information from individuals under 18. If you believe a minor has registered, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via an in-app notice. Continued use of the App after the effective date of the updated Policy constitutes your acceptance.

For any privacy-related questions, data requests, or concerns, contact our Data Privacy Officer at:

📧 kahavendra@siklabtech.org

SikLab Technology
Philippines