Privacy Policy

• Account & identity: name, email, and login credentials (managed via Amazon Cognito).
• Business & tax details: business name, TIN, RDO code, business address, VAT-registration status.
• Marketplace & tax records: settlement data you import (orders, fees, 1% withholding), uploaded BIR Form 2307 certificates, and the invoices/worksheets the service generates.
• Billing: subscription status and plan. Card/PayPal account details are collected and processed by PayPal — we do not store full payment instrument details.
• Technical: log and usage data needed to operate and secure the service.

To provide and maintain the service (reconciliation, invoicing, filing worksheets, filing reminders), to process your subscription, to secure and improve the service, and to comply with legal and tax record-keeping obligations.

We process personal data on the bases of: performance of our contract with you (providing the service you signed up for); your consent (where requested); compliance with legal obligations; and our legitimate interests in operating and securing the service, balanced against your rights.

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate safeguards:

• Amazon Web Services (AWS) — cloud hosting and storage (region: Asia Pacific, Singapore).
• PayPal — subscription payment processing (under PayPal’s own privacy policy).
• Amazon Bedrock (Anthropic Claude) — powers the in-app AI chat assistant. Messages you send in chat are processed to generate replies and may be processed in AWS regions outside the Philippines; they are not used to train the model.

We may also disclose data where required by law or valid legal process.

Your data is stored on AWS infrastructure in Singapore (ap-southeast-1). Where personal data is transferred outside the Philippines, we apply the safeguards required by RA 10173 to ensure a comparable level of protection.

We keep account data for as long as your account is active. Because tax records must be kept under BIR rules, invoices, settlement records, and 2307-related data may be retained for up to 10 years consistent with BIR retention requirements, after which they are deleted or anonymised. You may request earlier deletion of data not subject to a legal retention obligation.

We use organisational, physical, and technical measures including encryption in transit and at rest, per-tenant data isolation, least-privilege access, and audit logging. No method of transmission or storage is perfectly secure, but we work to protect your data and will notify you and the NPC of a breach where required by law.

Under RA 10173 you have the right to:

• be informed about the processing of your personal data;
• access your personal data;
• correct (rectify) inaccurate or outdated data;
• object to processing, and to erasure or blocking in the cases allowed by law;
• data portability;
• be indemnified for damages; and
• lodge a complaint with the National Privacy Commission (privacy.gov.ph).

To exercise these rights, contact our Data Protection Officer below.

We use only essential browser storage (e.g. to keep you signed in). We do not use third-party advertising or tracking cookies.

The service is for businesses and is not directed to individuals under 18.

We may update this policy; material changes will be notified in-app or by email. The “last updated” date above reflects the current version.

For privacy questions or to exercise your rights, contact our Data Protection Officer at privacy@kitatax.com. See also our Terms of Service.