Privacy Policy

1. Who we are and how to reach us

Nezopo ("we", "us") operates Nezopo, a back-office tool for recording store sales and managing stock, customers and reports.

Our Data Protection Officer handles privacy questions, requests and complaints. To reach our Data Protection Officer, email support@nezopo.com.

2. Our role and the store's role

For the account and business details of people who use Nezopo, we are the personal information controller. We decide how that data is used and we're responsible for it.

Stores also use Nezopo to keep records about their own customers, such as names, contact details, purchases and loyalty points. For those records the store is the personal information controller and we are its personal information processor. We handle them only on the store's behalf, under the data processing terms in our Terms of Service. If you're a customer of a store, please contact the store first about your data. We'll help the store answer your request.

3. Personal data we collect

About owners and staff who use the service:

• your name, email address, password (we store only a scrambled form we can't read) and your role in each workspace;
• cashier PINs, stored only in scrambled form;
• records of who made a sale, refund, stock change or settings change and when, so the business has a reliable audit trail;
• sign-in times and, with each recorded action, the browser and device type, the city and country your connection comes from and your IP address, for security, with IP addresses stored only in scrambled (hashed) form;
• when you sign up, the country your connection comes from, which our hosting provider works out from your IP address. We use it to decide whether you see Philippine or international plan prices, and we keep only that result;
• when you pay for a plan by bank transfer, GCash or Maya, how you paid, the transaction reference, amount and date, and the receipt you upload, so we can confirm the payment;
• messages you send us, such as support requests.

About the business:

• business name and type, branches and addresses, registers, tax settings, receipt details, plan and billing status;
• the business's Tax Identification Number, if you enter it. For an individual owner this can be sensitive personal information, so we store it only in protected form and use it only for tax and receipt purposes.

About a store's customers, on the store's behalf:

• name, phone number and email address;
• purchases, loyalty points and rewards;
• whether the customer agreed to receive the store's marketing emails.

We don't collect card numbers. If a store takes card payments, card details go straight to its payment provider.

4. How we collect it

• from you, when you sign up, set up your business, invite staff or contact support;
• from a store and its staff, when they add customers, make sales, import product or customer lists, or change settings;
• automatically, when you use the service, through sign-in and security logs and the cookies described below;
• from our payment provider, which tells us whether a subscription payment went through.

We store and process this data electronically on the secure cloud services listed below.

5. Why we use it and our legal basis

• To provide Nezopo, including signing you in, running your register, stock, customers and reports, and handling your plan. We need this to fulfil our contract with you (Section 12(b) of the Data Privacy Act).
• To keep the service and your account secure, prevent fraud and investigate problems, which is in our legitimate interests (Section 12(f)).
• To send service messages such as invites, password reset emails, receipts a cashier sends, billing notices and maintenance notices, as part of our contract with you (Section 12(b)).
• To answer support requests, as part of our contract with you (Section 12(b)).
• To meet tax, accounting and other legal obligations, including processing a Tax Identification Number, because the law requires it (Sections 12(c) and 13(b)).
• To run the service reliably using aggregate statistics that don't identify anyone, such as uptime and error counts, which is in our legitimate interests (Section 12(f)).

Where the law requires consent, we'll ask for it clearly, and you can withdraw it at any time. We don't sell personal data, and we don't use it for advertising.

6. Automated processing

Nezopo works out some things automatically for stores, such as a customer's loyalty tier, whether a customer is new, returning or hasn't come back in a while, and which products sell best. These help a store understand its business. They don't make decisions that have legal or similarly significant effects on anyone, and a person at the store can always review them.

When you sign up, we automatically decide whether your business sees Philippine or international plan prices, as described in "Personal data we collect". If you think the result is wrong, contact support and a person will review it.

7. Marketing messages

We don't send marketing emails to Nezopo users unless you agree to receive them.

A store can send marketing emails through Nezopo only to customers it has recorded as agreeing to receive them. Every marketing email has an unsubscribe link, and unsubscribing takes effect right away.

8. Cookies

Nezopo uses only the cookies it needs to work, such as keeping you signed in and remembering your selected workspace. We don't use advertising, analytics or tracking cookies.

9. Who we share it with

Within a workspace, staff see only what their role allows. Our support team can view a store's workspace only in a support session, which is recorded in an audit log.

We use these service providers to run the service. Each one may process personal data only on our instructions and must protect it:

• Supabase, for our database, sign-in and file storage (data stored in Tokyo, Japan);
• Vercel, which hosts the web app;
• Trigger.dev, which runs background tasks such as health checks and billing updates;
• Resend, which delivers our emails;
• GitHub, which stores our encrypted database backups (in the United States; only we hold the key to open them);
• Google, whose Drive stores the payment receipts businesses upload when paying for a plan;
• Stripe, for subscription billing and, where a store sets it up, card payments.

We may also disclose personal data when the law or a lawful order requires it, to protect people's life, health, rights or safety, or as part of a merger or sale of the business, in which case we'll tell you first.

10. Transfers outside the Philippines

Some of these providers store or process personal data outside the Philippines, including in Japan and the United States. We remain responsible for that data, and we use contracts and safeguards so it gets protection comparable to what the Data Privacy Act requires.

11. How long we keep it

• We keep sales and other transaction records, and audit logs, for 7 years, because tax and accounting rules and dispute handling need them.
• We keep receipt copies and support notes for 3 years.
• We keep the history of data exports for 1 year.
• We keep account and business details for as long as the workspace is active.
• When a workspace is closed, we delete or anonymize its remaining data within 90 days of closing, except the records above that must be kept longer and data under a legal hold.

When a retention period ends, we delete or anonymize the data, unless a law, a lawful order or an ongoing dispute requires us to keep it longer.

12. How we protect it

We use encryption in transit and at rest, strict separation between businesses, role-based access, audit logs, and two-factor sign-in for our own staff. We limit who on our team can access personal data, and everyone who can is bound to keep it confidential.

If a personal data breach puts you at real risk of harm, we'll notify the National Privacy Commission and the people affected within 72 hours of learning of it, as the Commission's rules require. For breaches involving a store's customer records, we'll tell the store right away and help it meet its own notification duties.

13. Your rights

Under the Data Privacy Act, you have the right to:

• be informed about how your personal data is collected and used;
• access your personal data and learn how it has been used and shared;
• correct personal data that's wrong or out of date;
• object to processing, including marketing and automated processing, and withdraw consent you gave;
• have personal data erased or blocked when it's no longer needed, was processed unlawfully, or you withdraw consent and no other lawful basis applies;
• get a copy of your personal data in a common electronic format you can take elsewhere (data portability);
• be compensated for damages caused by inaccurate, incomplete, outdated, false or unlawfully obtained data, or unauthorized use of your data;
• file a complaint with the National Privacy Commission.

Your lawful heirs and assigns can exercise these rights on your behalf if you pass away or become unable to.

To exercise a right, email support@nezopo.com. We'll confirm your identity first, then respond within 30 days. We don't charge for reasonable requests. If you're a customer of a store, we'll pass your request to the store, which decides on it.

If you're not satisfied with our response, you can complain to the National Privacy Commission at privacy.gov.ph.

14. Children

Nezopo is a business tool for adults and isn't meant for children. We don't knowingly collect children's personal data for our own purposes.

15. Changes to this policy

We may update this policy as the service and the law change. The date at the top shows the latest version. If a change is significant, we'll tell you by email or in the app before it takes effect.

16. Contact us

Questions, requests or complaints about your privacy? Email our Data Protection Officer at support@nezopo.com.