eeInvoicePH

Privacy Policy

Effective July 21, 2026

This Privacy Policy explains how eInvoicePH (“we”) collects and uses personal data. We process personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.

1. Data we collect

  • Account data: your email, business name, and login credentials (passwords are stored hashed by our authentication provider).
  • Subscription data: the plan you choose, your GCash/Maya payment reference, and the payment screenshot you upload for verification.
  • Taxpayer data: your registered name, TIN, branch code, address, VAT status and invoice series.
  • Invoicing data: customers and their contact details, products and services, invoices, collection receipts and payments received — including Senior Citizen or PWD name and OSCA/PWD ID where you enter them on an invoice.
  • Bookkeeping data: suppliers, expenses, input VAT and withholding tax details, payments out, chart of accounts, journal entries and the resulting books and ledgers.
  • Team data: the members you invite, their email and role, and invite codes.
  • Firm and client-portal data (where used): the link between a bookkeeping firm and its client businesses, document requests, filing statuses, and any files a client uploads in response.
  • Security and activity data: the audit log of actions taken in your account, sign-in records, and technical logs kept to operate and protect the Service.
  • Support and marketing data: messages you send us, the email tied to them, and — only if you opt in — your consent to receive product and BIR deadline updates.

2. How we use it

We use personal data to create and secure your account, verify and activate your subscription, provide the invoicing tool, issue receipts for your payments, respond to support requests, and comply with legal obligations. We do not sell your personal data.

3. Legal bases

We process data to perform our contract with you (providing the Service), to comply with legal obligations, and for our legitimate interests in operating and securing the Service, consistent with the Data Privacy Act.

4. Sharing and processors

We do not sell your personal data. We share it only with the service providers needed to operate the Service, and where the law requires. Our current processors are Supabase (database, authentication and file storage), Cloudflare (hosting and content delivery), Resend (delivering account and billing emails, such as subscription renewal reminders) and Google Analytics (site usage analytics), each processing data on our behalf under their own security commitments. If your account is managed by a bookkeeping firm through a Firm plan, that firm’s staff can see the data in the workspaces you have been linked to. We may disclose data where required by law or on lawful request from authorities such as the BIR or the National Privacy Commission.

Data is stored on infrastructure that may be located outside the Philippines. Where that is the case we rely on our processors’ contractual data-protection commitments.

5. Storage and security

Your data is isolated per account using database row-level security so one account cannot read another’s records. Payment screenshots are kept in private storage accessible only to you and our reviewers. We apply reasonable organizational, physical, and technical safeguards, though no system can be guaranteed perfectly secure.

6. Retention

We keep your data for as long as your account is active and as needed to meet legal, tax, and accounting requirements. You may request deletion, subject to records we are required to retain by law.

7. Your rights

Under the Data Privacy Act you have the right to be informed, to access, to object, to correct inaccurate data, to erasure or blocking, to data portability, and to lodge a complaint with the National Privacy Commission. To exercise these rights, contact us through the contact page.

8. Changes

We may update this Policy from time to time. Material changes will be posted here with a new effective date.

Questions about this Policy, or a request to access, correct, export or delete your data, can be sent through the contact page. We answer privacy requests within the periods set by the Data Privacy Act.