DRAFT, NOT YET REVIEWED BY A LAWYER. This text is a placeholder so the product can be built and tested. It must be reviewed and completed by a Philippine lawyer before Sandbox POS is offered to other businesses.

Privacy Policy

Draft version 0.1, 18 October 2026. Written with the Data Privacy Act of 2012 (Republic Act No. 10173) in mind. [Lawyer to review, including whether NPC registration is required.]

1. Two kinds of personal data

  • Account data: your name, email, password (stored only as a hash), and how you use the Back Office. For this, Sandbox POS is the personal information controller.
  • Business data: what you put into the system about your employees and customers (names, phone numbers, addresses, credit balances, sales). For this, your business is the controller and Sandbox POS only processes it for you. See the Data Processing Terms.

2. What we use account data for

  • To run your account, sign you in, and keep it secure.
  • To bill you for your plan and send notices about it.
  • To give support when you ask for it.

We do not sell personal data and do not use your business data for advertising.

3. Who else handles it

We use service providers to host the database and the website, and (once online payment is available) a payment provider. [Lawyer/owner: list subprocessors, e.g. Supabase, Vercel, the payment provider, and where their servers are; cross-border transfer basis.]

4. How long we keep it

  • While your account or business exists.
  • After a business asks to be deleted: 30 days, then its data is deleted.
  • [Lawyer: retention of billing records for tax law; backups retention period.]

5. Your rights

You have the right to be informed, to access, to correct, to object, to erase or block, to data portability, and to file a complaint with the National Privacy Commission. Owners can download all business data from Back Office → Your data. [Owner: contact details of the Data Protection Officer.]

6. Security

Each business's data is kept apart by the database itself. Employee PINs and tablet secrets are stored only as hashes. Connections are encrypted. [Lawyer: breach notification procedure (72 hours to the NPC).]