Privacy policy

Who we are

Tindro is operated from the Philippines and is the data controller for account information, and a data processor for the business records you enter. Reach us at [email protected].

What we store

• Your account: name, email address, hashed password, and which businesses you belong to.
• Your business records: products, stock, sales, refunds, customers, suppliers, expenses, employees and anything else you enter.
• Activity: an audit log of significant actions with the user, the time and the IP address, so you can see who did what.
• Technical: server logs needed to keep the service running and secure.

We do not store card numbers. Payments are handled by our payment provider and we only keep the result of a charge.

Customer details you enter

When you record a customer, you are the one deciding to collect their details, and under the Data Privacy Act you are responsible for having a lawful basis for it. We hold that data on your behalf, use it only to run the service for you, and delete it when you delete it or when your account is closed.

Why we use it

• To run the service you signed up for. There is no other purpose for your business records.
• To bill you, and to tell you about things that affect your account.
• To investigate abuse, fraud, or a technical fault.

We do not sell your data. We do not use your business records to build advertising profiles, and we do not share them with other Tindro customers.

Who else sees it

Only the suppliers we need to run the service: our hosting provider, our email provider and our payment provider. Each is bound to use the data only to provide their service to us. We will name them on request.

We will disclose data to authorities only where we are legally required to, and where we are permitted to tell you, we will.

How long we keep it

Your records stay for as long as your account exists. If you close your account we delete your business data within 30 days, except where we are required to keep transaction records for tax or legal reasons. Backups roll off within 35 days.

Your rights

Under the Data Privacy Act of 2012 you may ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Sales, products, inventory and expenses can be exported to CSV from inside the app at any time without asking us. For anything else, email [email protected] and we will respond within 15 working days.

If you are not satisfied with our answer you may complain to the National Privacy Commission.

Security

Passwords are hashed, traffic is encrypted in transit, and every record is scoped to its business at the database level so one customer cannot read another’s data. No system is perfect; if we discover a breach that affects you we will tell you and the National Privacy Commission within 72 hours of knowing.

Changes

If we change this policy in a way that matters, we will email account owners before it takes effect rather than quietly updating the date at the top.