Privacy Policy

TAXKAYA is operated by GENETRIFY INFORMATION TECHNOLOGY SERVICES, registered with the Philippine Department of Trade and Industry under DTI Business Name Registration No. 8072131 and BIR TIN 800-066-409. Registered address: Polomolok, South Cotabato.

For the purposes of the Data Privacy Act (RA 10173), GENETRIFY INFORMATION TECHNOLOGY SERVICES is the personal information controller. Our Data Protection Officer can be reached at support@genetrify.com.

Your income, expenses, invoices, clients, tax figures, registration profile and every document reference are stored in our database, hosted on Supabase infrastructure, under the account you signed up with.

Every row is scoped to your account at the database level. Row-level security policies mean a query running as you can only ever see and touch your own data — not another customer's, and not an administrator browsing at will. See Security for how that is enforced.

The categories below are the complete set. Anything not listed here, we do not receive.

• Account credentials. An account is required to use TAXKAYA at all: the email address you sign up with, and a password we never see in plain text — Supabase Auth hashes it before it reaches any table we can query.
• Your ledger. Income, expenses, invoices, clients, products, filings, your registration profile and any document references you enter. This is the product — we cannot run a hosted bookkeeping tool without storing the books — and it is scoped to your account only, as described in §ii.
• Subscription records, if you subscribe: which plan you are on, when the period ends, and a reference identifier from the payment processor. This is the minimum needed to know that you paid and until when.
• Payment metadata, if you subscribe: amount, currency, date and status. Card numbers, CVVs and bank credentials go directly to the payment processor and never reach our servers.
• Correspondence, if you email us: your message and address, kept so we can answer and follow up.

Precise geolocation. Contact lists. Files from your device outside what you deliberately upload as a document reference. Browsing activity on other sites. Anything from a third-party account — there is no OAuth login, so we never receive data from Google, Facebook or anywhere else.

Nobody at TAXKAYA, including us, reads your ledger casually. Row-level security means our own application code cannot query across accounts, and the one credential that can bypass it is held server-side, used only by the payment webhook, and never exposed to a browser.

We do not use your data to train, fine-tune or evaluate machine-learning models, and we never sell personal data.

• To confirm an active subscription and unlock the software.
• To process payment and issue the corresponding receipt.
• To send transactional email only: receipts, renewal and expiry notices, and security or service notices. No marketing email unless you ask for it.
• To answer support requests you send us.
• To meet obligations under Philippine law.

We do not sell personal data and we do not run advertising. Where a subscription is active, the limited records described above are shared only with the providers needed to deliver it — a payment processor to take the payment and an email provider to send the receipt — each acting under written terms and only for that purpose.

The specific providers are named on this page before any subscription is sold, and this section is updated whenever one changes. We may also disclose data where Philippine law, a lawful court order, or the safety of our users requires it.

• Your ledger: kept for as long as your account exists. Deleting your account deletes it — see Your Data.
• Subscription records: kept while the subscription is active, then for as long as tax law requires us to keep the corresponding receipt.
• Payment records and official receipts: retained for five years, as the Bureau of Internal Revenue requires of us as a seller under RA 11976, which shortened the old ten-year period in January 2024.
• Correspondence: kept up to two years, then deleted.

To request deletion of what we hold, see Your Data. We confirm receipt within five business days and complete deletion within 30 days, consistent with National Privacy Commission guidance — except for records we are legally required to retain, which we will identify to you.

TAXKAYA sets two cookies, both strictly functional and both storing a single word: theme, remembering whether you chose light or dark, and sidebar, remembering whether you collapsed the navigation.

There are no analytics cookies, no advertising cookies, and no third-party trackers. Nothing here follows you to another site.

Your ledger sits in a shared database alongside every other account's, so the control that matters is keeping accounts apart at the database level rather than trusting application code to remember to filter correctly. Every table carries a row-level security policy scoped to your signed-in identity (auth.uid()): a query running as you can only return rows you own, enforced by Postgres itself rather than by our code.

Sign-in uses email and a password we never see in plain text. Traffic is encrypted in transit with TLS, and the one credential that bypasses row-level security is held server-side only, used by a single payment webhook, and never shipped to a browser. No system is perfectly secure; if we discover a personal-data breach affecting you, we will notify you and the National Privacy Commission within the timelines RA 10173 requires.

Under the Philippine Data Privacy Act you have the right to:

• Be informed about how your data is processed — this policy.
• Access the data we hold about you.
• Correct anything inaccurate or out of date.
• Object to specific processing.
• Erase or block unlawful processing.
• Request a portable copy of your data.
• Be compensated for damage caused by unlawful processing.
• Complain to the National Privacy Commission.

Exercising them

Everything in your ledger is already visible to you inside the software, and Reports and Books of accounts print any period to PDF without asking us. For a full portable export, or to access, correct or erase anything beyond what the app itself exposes, email the DPO at support@genetrify.com. We confirm receipt within five business days and act within 30, consistent with National Privacy Commission guidance.

TAXKAYA is intended for adults running a business or freelancing. We do not knowingly collect data from children under 13. If you believe a minor has subscribed, email the DPO and we will delete the record.

We may update this policy as the software evolves. Material changes are posted here at least 14 days before they take effect, and emailed to active subscribers. The date at the top always reflects the current version.

Privacy questions, data-subject requests and complaints: support@genetrify.com.

General support: support@genetrify.com.

Postal address: GENETRIFY INFORMATION TECHNOLOGY SERVICES, Polomolok, South Cotabato.