Privacy Policy

This Privacy Policy explains what personal data FlexiBill ("FlexiBill," "we," "us") collects through the FlexiBill platform, why we collect it, and how it's handled. It applies to seller accounts, invited assistant accounts, and the buyer information sellers enter while using the platform.

Account data — when you create a seller or assistant account: your name, email address, phone number, contact handle (e.g. Messenger, Viber, WhatsApp), profile photo, and (for sellers) business name.

Buyer data entered by sellers— sellers use FlexiBill to record their own customers' name, address, and contact details while taking orders during a live-selling session. This data is entered and controlled by the seller, not collected by FlexiBill directly from buyers — see "Sellers' responsibility for buyer data" below.

Order and transaction data — items, prices, shipping and courier details, bill numbers, and payment-proof images sellers upload to record how an order was paid. These images frequently contain visible bank or e-wallet (e.g. GCash) account numbers.

Support requests — the content of any support ticket you submit, and an optional screenshot attachment.

Activity logs — a record of actions taken on your account (who did what, and when), kept for account security and accountability, especially where multiple people (a seller and their assistants) share access to one account.

To operate the platform: managing inventory, live order-taking, billing, payment tracking, and fulfillment. To secure accounts (detecting suspicious activity, enforcing one active session per account). To respond to support requests. We do not sell personal data, and we do not use it for advertising.

For the buyer information a seller enters into FlexiBill, FlexiBill acts primarily as a data processor — we store and secure it on the seller's behalf, but the seller is the one who collected it and decided to enter it. Sellers are responsible for having a lawful basis to collect and use their own buyers' personal data, and for handling any request from a buyer about their own information.

Data is stored using Supabase (database, authentication, and file storage). Access to seller/buyer/order data is restricted at the database level so one seller's data isn't visible to another, and assistant accounts only see what their permissions allow. Payment-proof and support-ticket screenshot images are stored in access-controlled storage, not publicly accessible.

FlexiBill does not currently have a fixed data-deletion schedule. Account, order, buyer, and payment-proof data is retained for as long as the seller account remains active, plus a reasonable period afterward. We're aware this is an area we intend to formalize, including offering account holders a way to request deletion.

We use a limited number of infrastructure providers to run FlexiBill, who process data on our behalf under their own security commitments: Supabase (database, authentication, file storage). Depending on which optional services are active, we may also use an error-monitoring provider (to detect and fix bugs), a rate-limiting provider (to prevent abuse, using IP addresses only), and an email provider (to deliver account-related emails, such as password resets). We do not use advertising or analytics trackers.

If you're in the Philippines, the Data Privacy Act gives you rights over your personal data, including the right to be informed, to access it, to correct it, to object to certain processing, to have it erased or blocked under certain conditions, to data portability, and to claim damages for violations. To exercise any of these rights, contact us using the details below.

FlexiBill has not yet completed registration with the Philippines' National Privacy Commission (NPC). We're noting this openly rather than claiming a registration that doesn't exist, and we're reviewing whether registration is required at our current scale.

We may update this policy as the platform changes. Material changes will be reflected by updating the "Last updated" date above.

For privacy questions or to exercise your data rights, contact us at [INSERT EMAIL].