Data Privacy Notice — Daloy Systems

DALOY SYSTEMS ("Company", "Daloy", "we", "us" or "our") is a business duly registered under the laws of the Republic of the Philippines (DTI Registration No. HMPR705119017866), engaged in developing and providing web-based point-of-sale and inventory management solutions for small pet supply stores. The Company respects your data privacy and is committed to the protection of your personal data in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and all related laws and regulations.

This Data Privacy Notice ("Notice") provides you with information on how we collect, use, store, and protect your personal data. By continuing to use or access our app or website, you agree to be bound by the terms contained herein. This Notice should be read alongside our Terms of Service and End User License Agreement (EULA), which together govern your use of the Service.

Collection and Processing of Personal Data

As a Personal Information Controller (PIC), we collect and process your personal data when you register for an account, use our services, or communicate with us. This may include but is not limited to your name, business name, email address, contact number, and business transaction data you input into the app (such as product inventory, sales records, and expense records).

We do not collect government-issued IDs, bank account details, or payment card information. Payments are processed by PayMongo — no payment card data is stored on our servers.

Purpose of Collection of Personal Data

We collect and process your personal data solely for the following legitimate purposes:

Creating and managing your Daloy account
Providing you access to the app and its features
Delivering AI-generated insights based on your store's data
Communicating with you regarding your account, support requests, and service updates
Processing license upgrades and plan changes
Improving the quality and reliability of our services

We process your personal data on the basis of performance of a contract (Section 12(b), RA 10173) — specifically, to deliver the services you signed up for. In some cases, we may also process data on the basis of legitimate interest (Section 12(f), RA 10173), such as improving service quality and preventing fraud.

Security Measures to Protect the Confidentiality of Personal Data

We implement appropriate organizational and technical measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction.

Technical Measures — Daloy is built on Supabase, hosted on AWS infrastructure, which encrypts all data at rest and in transit. Our app enforces HTTPS on all connections. User passwords are hashed using bcrypt and are never stored in plain text. Authentication is managed via JSON Web Tokens (JWT) with email confirmation required upon signup. All database tables implement Row Level Security (RLS), ensuring that each business account can only access its own data. AI insight generation is handled through a server-side Supabase Edge Function, ensuring that API keys and sensitive processing are never exposed to the client.

Application-Level Measures — Our app is built using React, which by default escapes all rendered content to prevent Cross-Site Scripting (XSS) attacks. All database queries use Supabase's parameterized query client, preventing SQL injection.

Use of Third-Party Services

To deliver our services, we work with the following third-party providers:

Supabase — database, authentication, and edge functions, hosted on AWS
OpenAI — AI Daily Insights feature; your store's sales and inventory data is processed to generate daily observations. No personally identifiable information is sent to OpenAI beyond what is necessary for insight generation.
Replit — app hosting and deployment

We only share data with these providers to the extent necessary to operate the service. We do not sell your personal data to any third party.

Risks Involved

While we implement appropriate security measures, no system is entirely immune to risk. Processing your personal data involves inherent risks, including:

Unauthorized access to data in the event of a cyberattack or security breach affecting our hosting infrastructure (Supabase/AWS)
Potential exposure of store data transmitted to third-party AI processing (OpenAI) for insight generation
Risks arising from vulnerabilities in third-party software components used to operate the service

In the event of a personal data breach likely to result in harm, Daloy Systems will notify affected users and the National Privacy Commission (NPC) in accordance with RA 10173 and NPC Circular 16-03.

Data Subject's Rights

Under the Data Privacy Act of 2012 (RA 10173), you have the following rights as a Data Subject:

Right to be Informed — You have the right to know whether your personal data is being collected, stored, and processed, and for what purpose.
Right to Access — You have the right to request a description of the personal data we hold about you and how it is being processed.
Right to Object — You have the right to object to the processing of your personal data or to withdraw consent at any time.
Right to Erasure or Blocking — You have the right to request the removal or destruction of your personal data from our systems if it is found to be incomplete, outdated, false, or unlawfully obtained.
Right to Correct or Rectify — You have the right to request correction of any inaccurate or erroneous personal data we hold about you.
Right to Data Portability — You have the right to obtain a copy of your personal data in a usable format.
Right to Damages — You have the right to be indemnified for any damages caused by inaccurate, incomplete, or unlawfully processed personal data.
Right to File a Complaint — If you believe your data privacy rights have been violated, you have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Active paid accounts — retained for the life of the account
Deleted paid accounts — purged 90 days after deletion date
Expired free trial accounts (no upgrade) — purged 60 days after trial end date
Infrastructure backups — may persist for a short additional period per our hosting provider's (Supabase/AWS) policy, after which they are permanently deleted

Upon expiry of the applicable retention period, all digital records are permanently deleted or anonymized from Supabase and AWS infrastructure, ensuring that personal data can no longer be retrieved, processed, or accessed by any party.

Changes to This Notice

The Company reserves the right to amend this Notice at any time to comply with applicable data protection laws. The "Last Updated" date at the top of this page always reflects the most recent revision. We will notify existing users of material changes via the email address on their account at least 30 days before the changes take effect.

Contact Us

If you have any questions, concerns, or requests regarding this Data Privacy Notice or your personal data, please contact our Data Protection Officer (DPO):

Name	Tyrone Sapulmo
Business	Daloy Systems
Website	daloysystems.com
App	app.daloysystems.com
Email	theweekendcanvas@gmail.com
Phone/Text	0994 181 4024