Privacy Policy

Who we are

Resiboh is a web and iPhone app that helps small sellers in the Philippines, like cafés, carinderias, home bakers and online sellers, turn customer orders into invoices and keep track of payments and sales. Resiboh is operated by [LEGAL ENTITY NAME], [BUSINESS ADDRESS] ("Resiboh", "we", "us" or "our").

This policy applies to the Resiboh web app at app.resiboh.com, the Resiboh iPhone app, and our website at resiboh.com. When we say "you", we mean the business owner or staff member who signs up for and uses Resiboh (the "seller"). We follow the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission.

Please also read our Terms of Service, which explain the rules for using Resiboh.

Your data and your customers' data

Resiboh holds two kinds of personal information, and the law treats them differently.

Your own account information

For information about you as a Resiboh user, such as your name, email address and login details, we are the personal information controller. That means we decide how it is used and we are responsible for protecting it.

Your customers' information

Your customers never use Resiboh directly. You are the one who uploads their order screenshots or types in their name, phone number, delivery address and order details. For this information, your business is the personal information controller, and Resiboh acts as a personal information processor. We process it only on your behalf and according to your instructions, which means using it to run the features you use.

Because your business is the controller of your customers' data, you are responsible for:

• having a lawful reason, or your customers' consent where needed, to collect their details and upload them to Resiboh;
• letting your customers know how you use their information; and
• answering your customers' requests to see, correct or delete their information.

We will help you with these requests. For example, we can help find and delete a customer's records if you can't do it yourself in the app.

What we collect

Everything below is stored with our database and hosting provider, Supabase, unless we say otherwise.

Account information

• Your name, email address and password. Your password is scrambled (hashed) by Supabase Auth before it is stored, so we never see it.
• Login sessions, so you can stay signed in.

Team information

• If you invite staff, the invite links you create (with an optional label like "Jomar, cashier"), who joined and when, and each member's role (owner or staff).
• Who took each order and who recorded each payment, so the owner can see a per-staff breakdown at closing. When someone leaves a team, their name stays on that business's past orders and payments.

Business information

• Business name, address, phone number, logo, invoice footer text and currency.
• Payment options you choose to show on invoices, such as GCash, Maya or bank account names and numbers, and payment QR code images.

Products

• Product names, prices, categories, nicknames or aliases (so we can recognize "1 iced latte" and "ice latte" as the same item), and optional product photos.

Orders

• Items, quantities, prices, totals, discounts and fees.
• Customer details you enter or upload: customer name, phone number, delivery address, table number and notes.
• Where the order came from (for example, a chat screenshot, an order slip photo, pasted text or manual entry), plus pre-order batch and end-of-day closing details.

Order images

• The screenshots and photos you upload to create orders, and photos of payment receipts. These are stored in private storage that only members of your business can access.

Reading records

• When Resiboh reads an image, we keep a record of the text it found, the structured result (such as the items and quantities it matched), which reader was used, and any errors. We use these records to fix problems and to make reading more accurate.

Payments you record

• Amounts, payment method (cash, GCash, Maya, bank or other), reference numbers, receipt numbers (such as AR-000001), dates, downpayments, and reasons for voiding a payment.
• Resiboh does not process payments or hold money. We only keep the payment records you enter.

Subscription

• If the business owner subscribes to Starter or Business in the iPhone app: which plan the business has, when it renews or ends, whether auto-renew is on, and whether Apple reported a billing problem. Payments are made through Apple; we never see your card or payment details.

Usage counter

• How many AI scans and orders each business has used this month, so we can apply its plan's limits.

Technical information

• Like most online services, our hosting and database providers automatically record basic technical information when you use Resiboh, such as your IP address, browser type and the time of each request. This helps keep the service running and secure.

What stays on your device

Some information is saved only on your own phone or computer (in your browser's storage, or inside the iPhone app). It is not sent to our servers:

• an unfinished order draft, so you don't lose your work if the page refreshes (this can include customer details you've typed in);
• which business you last used, if you have more than one;
• your printer preference;
• a note that you've seen the first-run practice order; and
• a temporary note used while you reset your password.

Supabase Auth also keeps your login session on your device (in your browser's local storage, or in the iPhone's Keychain) so you stay signed in. Signing out removes your session and any saved order drafts from that device, so if you share a device, sign out when you're done.

Cookies and tracking: Resiboh does not use advertising or tracking cookies, and we currently don't use any third-party analytics tools. If this ever changes, we will update this policy first.

How we read your order images

Reading orders is the heart of Resiboh, so here is exactly what happens to your images.

• Chat screenshots (Messenger and similar) are usually read on your device. In the web app we use an open-source text recognition (OCR) engine that runs inside your browser. Your browser downloads the engine's files from the jsDelivr content delivery network, but your image is not sent to jsDelivr. The iPhone app uses Apple's built-in text recognition, which also runs on your phone.
• Handwritten order slips, and in some cases other images, are read by Google's Gemini API. The image is sent through our server to Gemini, together with your product names so it can match items correctly. We use Google's paid Gemini API service, under whose terms Google does not use this content to train its models. Google processes these images on its servers, which may be outside the Philippines.
• Pasted text and orders you type in are read on your device. They aren't sent to Gemini or any other reading service; they're only saved to your account when you create the order.

Whichever way an image is read, a private copy is kept with the order in your account so you can look back at the original.

Text recognition and AI can make mistakes. That is why you always review and confirm every order before Resiboh creates an invoice.

How we use your information

We use the information described above to:

• create and manage your account and keep you signed in;
• read your order images and text, match items to your products, and create invoices you can share as an image, PDF, text or printout;
• track payments, unpaid balances, pre-order batches, end-of-day closing and sales reports;
• apply plan limits, such as the monthly AI scan limit;
• troubleshoot problems and improve how accurately Resiboh reads orders;
• send account emails, such as sign-up confirmation and password reset, and tell you about important changes to Resiboh or this policy;
• keep Resiboh secure and prevent misuse; and
• meet our legal obligations.

We process your account information to provide the service you signed up for, for our legitimate interests in keeping Resiboh secure and working well, to comply with the law, and with your consent where the law requires it. We process your customers' information only to provide Resiboh to you.

We don't sell personal data, and we don't share it for advertising.

Who we share it with

We use a small number of trusted service providers to run Resiboh. They may only use your data to provide their service to us.

We may also share information if the law requires it, for example in response to a valid court order, or to protect the rights, safety and property of our users, the public or Resiboh. If Resiboh is ever merged, sold or reorganized, your information may be transferred as part of that, and it will stay protected by this policy or one that is just as protective.

Where your data is stored

Your Resiboh data is stored with Supabase in the Singapore (ap-southeast-1) region. Because our service providers operate internationally, your data may be stored or processed outside the Philippines. When this happens, we remain responsible for it and we choose providers that protect personal data in line with the Data Privacy Act.

How long we keep it

• While your account is active, we keep your data so you can keep using it, including your order history and sales reports.
• When you ask us to delete your account, we delete it as described in Deleting or exporting your data.
• Reading records are kept for up to 12 months to help improve accuracy, then deleted automatically (sooner if your account is deleted first).
• Backups of our database are kept for 7 days and then removed automatically.

We may keep certain information longer if the law requires it.

How we protect it

We take reasonable organizational, physical and technical steps to protect your data, including:

• encrypting data as it travels between your device and our servers (HTTPS);
• database rules (row-level security) so each business can only see its own data;
• private storage for order screenshots, order slip photos and payment receipt photos; and
• hashed passwords that we can never see.

No system is 100% secure, so we can't promise that your information will never be accessed without permission. You can help by using a strong password that you don't use anywhere else and by signing out on shared devices.

If a personal data breach happens that the law requires us to report, we will notify the National Privacy Commission and the affected users as required by law.

Your privacy rights

Under the Data Privacy Act, you have the right to:

• Be informed about whether and how your personal data is processed.
• Access the personal data we hold about you.
• Object to certain processing of your personal data.
• Erasure or blocking of your personal data, for example when it is no longer needed or was processed unlawfully.
• Rectification, meaning to have wrong or incomplete data corrected.
• Data portability, meaning to get a copy of your data in a commonly used electronic format.
• Damages if you are harmed by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your personal data.
• File a complaint with the National Privacy Commission at privacy.gov.ph.

How to use your rights: email privacy@resiboh.com. We may ask you to confirm your identity first, for example by writing from the email address on your account. We aim to respond within 30 days.

You can already see and correct most of your information yourself inside the app, such as your business details, products, orders and payments.

Deleting or exporting your data

Deleting your account

You can delete your account yourself in the app: Settings → Your account → Delete account. This immediately deletes:

• your account;
• the businesses where you are the only owner; and
• their orders, payment records, products and uploaded images.

Businesses that have another owner are kept, and you are simply removed from their team. If you can't use the app, email privacy@resiboh.com from the email address you use to sign in and we will delete it for you within 30 days.

Copies in our backups are removed automatically as the backups roll off, within 7 days. Deleted data can't be recovered, so please export anything you need first.

Exporting your data

You can ask for a copy of your data by emailing privacy@resiboh.com. We will send it to you as CSV files, which you can open in Excel or Google Sheets. We plan to add an export button inside the app in the future.

If you're a seller's customer

If you ordered from a business that uses Resiboh, that business decides what information about you is entered into Resiboh and how it is used. If you want to see, correct or delete your information, please contact the business directly first.

You can also email us at privacy@resiboh.com. Tell us the name of the business you ordered from, and we will pass your request to them and help them respond.

Children

Resiboh is a tool for running a business and is not meant for anyone under 18. We don't knowingly create accounts for people under 18. If you believe a minor has signed up, please contact us and we will delete the account.

Changes to this policy

We may update this policy as Resiboh grows or as the law changes. We will post the new version on this page and update the "Last updated" date at the top. If we make a significant change, we will also let you know by email or inside the app before it takes effect.

Contact us

If you have questions about this policy or how we handle your data, we're happy to help.

• Privacy requests and our Data Protection Officer: privacy@resiboh.com
• General questions: hello@resiboh.com
• By mail: [LEGAL ENTITY NAME], [BUSINESS ADDRESS]