Draft · Not approved for public launch

Privacy Policy

Requires owner and legal review before public launch. This editable draft describes implemented functions; it is not a finalized privacy notice.

Information handled by the application

Account information includes names, email addresses and password hashes. Business workspaces may contain contact details, transactions, inventory, money accounts and uploaded files. Session information supports authentication. Operational logs support troubleshooting.

Use and access

The application uses this information to provide workspace features, enforce permissions and maintain transaction history. Business records are scoped to authorized workspace members. Platform billing administration has separate permissions. Files are served through authorized routes.

Payments and service providers

If enabled, hosted payment processing uses Xendit. The application retains subscription and payment references and does not collect card details directly. The owner must identify the actual hosting, email and payment providers, their processing locations and applicable disclosures before launch.

Cookies and aggregate usage analytics

Essential session and security cookies support sign-in and CSRF protection. GrowNegosyo records daily totals for general page categories and payment-processing outcomes in its own database. Usage analytics does not store IP addresses, browser details, user identities, cookies, session identifiers, raw URLs, customer records or financial amounts. There are no individual browsing histories or third-party analytics requests. Authorized platform administrators can view aggregate reports. Counters are retained for 365 days and removed by the daily scheduler. Verified payment totals are derived from existing financial records, whose retention is separate.

The former Google Analytics integration and its consent interface are disabled. Previously stored consent and delivery records are inactive and preserved pending a separately reviewed retention and deletion decision; they are no longer sent to Google. Essential security, account and financial records remain separate. Removing analytics cookies does not remove the operator’s privacy obligations.

Owner decisions required

• Identify the operating legal entity and privacy contact.
• Document applicable lawful grounds, retention periods, backup retention and deletion procedures.
• Define request, correction, export and deletion channels, response procedures and incident handling.
• Review international transfers and local privacy obligations with qualified counsel.

Contact details and request procedures are not configured. See the contact page for current availability.