Privacy Notice

Talaan is accounting, BIR e-invoicing and payroll software for Philippine businesses. It is operated by [registered business name and SEC/DTI registration number] (to be confirmed), with its principal office at [business address] (to be confirmed) (“Talaan”, “we”, “us”).

Our Data Protection Officer can be reached at dpo@talaan.ph (to be confirmed).

Talaan holds personal data in two different capacities.

• As personal information controller — for the people who use Talaan: account holders, team members a business invites, employees who sign in to the employee portal, and visitors to this website. We decide why and how this data is processed.
• As personal information processor — for the records a business keeps in its books on Talaan: its customers and buyers, its suppliers, and its employees’ 201 files and payroll. The business is the controller of that data. We process it only to run the service for that business and on its instructions, under our Data Processing Agreement.

If you are a customer, supplier or employee of a business that uses Talaan, please contact that business first about your data. If you write to us instead, we will pass your request to the business and help it answer you.

About you, as a user of Talaan (we are the controller)

• Account and sign-in: your email address and display name; your password, which our authentication provider stores only in hashed form; or, if you choose “Continue with Google”, the email address and name Google shares with us. One-time sign-in codes are stored only as a salted hash and expire after ten minutes.
• Your business’s registration details: registered name, TIN and branch code, business address, VAT status and similar details you enter when you set up a business. For a sole proprietor these identify a person.
• Activity and security records: an audit log of changes made in the books (who did what, and when, with the values before and after), your sign-in sessions, and — for an employee clocking in through the portal — the time, IP address and browser of each clock-in.
• Messages you send us, such as support requests.
• Billing, once billing opens: your plan and our invoices to you. Card and e-wallet details are entered on the payment provider’s page; Talaan does not store them. Billing is off during the private beta.

In a business’s books (the business is the controller)

• Customers and buyers: names, billing and delivery addresses, TINs, email addresses and phone numbers on invoices, estimates, receipts and statements, and notes the business keeps about them.
• Suppliers and payees: names, addresses, TINs and the details needed to pay them.
• Employees (the 201 file and payroll): name, sex, civil status, date and place of birth, nationality, home addresses, personal email and mobile number, emergency contact, dependents’ names, relationships and birth dates, position and employment history, pay and compensation, TIN, SSS, PhilHealth and Pag-IBIG numbers, bank name and account number, PWD and solo-parent status, documents and IDs the employer uploads, attendance and leave, loans, payslips and BIR Form 2316. For each clock-in and clock-out in the employee portal: the time, IP address and browser, and — where the employer turns clock-in location on — the location at that moment (section 4 explains the settings).
• Files and imports: receipts, bills and other attachments, marketplace order exports and bank statements a business uploads. These can show names, addresses and TINs.

Several of the employee items are sensitive personal information under Section 3(l) of RA 10173 — among them civil status, age, government-issued numbers such as TIN, SSS, PhilHealth and Pag-IBIG, tax returns and certificates, and health-related status. They are processed only for the employer, for payroll and employment records the law requires it to keep, and are visible only to the people the employer’s roles allow.

We do not sell personal data, show advertising, or use the records in a business’s books for any purpose other than running the service for that business.

• To provide Talaan — create and secure your account, keep your books, issue your documents, run payroll and send the emails the service needs (sign-in codes, invitations, documents you choose to send). Basis: the contract with you or your business (RA 10173 §12(b)).
• To keep accounts and records secure — the second sign-in step, the audit log and error monitoring. Basis: our legitimate interest in a secure, working service (§12(f)), and the business’s obligation to keep reliable records.
• To comply with the law — for example, to answer a lawful order of a court or government agency. Basis: legal obligation (§12(c)).
• Employee records, including sensitive personal information — processed for the employer under the laws that require it to keep them, such as the Labor Code, the Tax Code and the SSS, PhilHealth and Pag-IBIG laws (§13(b)).
• Clock-in location — the employer chooses one of three settings. When location is taken, it is taken only at the moment of clocking in or out, never in between. Location is personal information, not sensitive personal information.
  • Off: no location is taken.
  • Optional: the browser asks the employee each time. If the employee declines, the clock-in is still recorded and flagged for HR as having no location. Basis: the employee’s consent (§12(a)), which the employee can withdraw at any time by declining, or by turning off location for Talaan in the browser.
  • Required: the employee cannot clock in or out in the portal without sharing location. Because sharing is a condition of using the portal clock, we do not treat it as consent, and it cannot be withdrawn while the employer keeps this setting. Basis: the employer’s legitimate interest in verifying attendance (§12(f)). An employee may object to the employer, who can change the setting.
  Where the employer also sets a work location, a clock-in from farther away than its radius, or from a network the employer has not allowed, is flagged for HR, or refused if the employer chooses.
• Service messages about your account, security or changes to these terms. We do not send marketing email without your consent.

We use the service providers below to run Talaan. Each processes personal data only to provide its service to us, under a written agreement.

Supabase, Inc.

Database, file storage and sign-in (authentication). Data: All account data and all records kept in Talaan, including uploaded files. Where: Singapore (AWS ap-southeast-1).

Vercel Inc.

Hosting the Talaan web application. Data: Data passing through the application while a page or request is served. Where: Application servers in Singapore; content delivery worldwide.

Twilio Inc. (SendGrid)

Sending email: sign-in codes, invitations, and documents you choose to email. Data: Recipient email address and name, and the content of the email. Where: United States.

Resend, Inc.

Backup email delivery, used only if we switch away from SendGrid. Data: Recipient email address and name, and the content of the email. Where: United States.

Functional Software, Inc. (Sentry)

Error monitoring, so we can find and fix faults. Data: Technical details of an error: the page address, browser and the failing request. Where: United States.

Google LLC

“Continue with Google” sign-in, only if you choose it. Data: Your Google account email address and name. Where: United States.

PayMongo Philippines, Inc.

Online payments and subscription billing. Data: Payer name, email and payment details, entered on PayMongo’s own page. Where: Philippines. Not active during the private beta — only once online payments or billing are switched on.

We also share personal data:

• with the people a business invites into its books, according to the role it gives them;
• with the recipients you choose — for example, when you email an invoice or share a payment or statement link;
• when the law requires it, such as a court order or a lawful request of the BIR.

Talaan does not send anything to the BIR, SSS, PhilHealth or Pag-IBIG on your behalf today. Reports and files you download are filed by you.

Talaan’s database, file storage and application servers are in Singapore. Email delivery, error monitoring and Google sign-in are provided from the United States. Personal data is therefore transferred outside the Philippines.

We remain responsible for that data under Section 21 of RA 10173, and we use contracts and the providers’ own security commitments to make sure it is protected to a standard comparable to Philippine law.

• Account data — while your account is active, and for [period] (to be confirmed) after it is closed, unless the law requires longer.
• Records in a business’s books — for as long as the business keeps its account, then returned or deleted as the Data Processing Agreement sets out. Philippine law requires the business itself to keep e-invoice and e-receipt records for three years from the close of the taxable year (NIRC §237) and its books of accounts for ten years (RR 17-2013, as amended by RR 5-2014), and employers to keep payroll and employment records. A business that leaves can export its books first.
• Audit log — for as long as the records it describes.
• Sign-in codes — usable for ten minutes; only a hash is kept.
• Backups — deleted on our database provider’s backup schedule, within [backup retention period] (to be confirmed).

The measures in place today:

• All traffic to and from Talaan is encrypted in transit (HTTPS).
• Our database and file storage provider encrypts stored data at rest.
• Two-step sign-in: a password or Google, then a six-digit code sent by email, stored only as a salted hash, valid for ten minutes and three attempts.
• Role-based permissions: each person sees only what their role allows. Payroll detail is limited to the roles a business grants it, and a business can require a fresh code before a pay run is approved.
• Automatic sign-out after a period of inactivity, when the business turns it on.
• Each business’s records are kept separate: every request is checked against the business it belongs to.
• Uploaded files sit in private storage and are opened only through short-lived signed links.
• An audit log of changes; issued invoices cannot be edited, only corrected by a new document.
• In the employee portal, bank account and government ID numbers are shown masked.

No system is perfectly secure. If you think your account has been misused, tell us at once at dpo@talaan.ph.

Under Sections 16 to 18 of RA 10173 you have the right to:

• be informed that your personal data is being processed, and how;
• access your personal data and ask how it was obtained and to whom it was disclosed;
• object to processing, and withdraw consent where processing is based on consent;
• have inaccurate or incomplete data corrected;
• have data suspended, withdrawn, blocked, removed or destroyed where the law allows;
• obtain a copy of your data in an electronic, commonly used format (portability);
• be indemnified for damages caused by inaccurate, unlawfully obtained or misused data;
• file a complaint with the National Privacy Commission.

To exercise a right, email dpo@talaan.ph (to be confirmed) from the address on your account, or tell us how we can verify who you are. We will answer within [response period] (to be confirmed). A business can also correct its own records and export its data at any time (Settings → Export data), and employees can ask their employer to correct their details from the employee portal.

For data in a business’s books, the business decides on the request as controller; we pass it on promptly and help it answer.

If a personal data breach occurs that involves sensitive personal information or information that could enable identity fraud, and that is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the people affected within 72 hours of becoming aware of it, as NPC Circular 16-03 requires. Where the data belongs to a business’s books, we notify that business without undue delay so it can meet the same deadline.

Talaan sets only the cookies it needs to work:

• Sign-in session cookies (named sb-…-auth-token) that keep you signed in;
• active_org — which business you are working in;
• portal_employee — in the employee portal, which employee record you are using.

Your browser’s local storage keeps a few preferences on your device only: light or dark theme, table column choices, and the time of your last activity for automatic sign-out. We use no advertising or analytics cookies.

When we change this notice we update the date at the top. If a change materially affects how we use your data, we tell account holders by email or in the app before it takes effect.

Data Protection Officer: dpo@talaan.ph (to be confirmed). Postal address: [business address] (to be confirmed).

If you are not satisfied with our answer, you may complain to the National Privacy Commission at privacy.gov.ph.