KitaNatin is a point-of-sale and business app for small shops. This policy explains what personal information KitaNatin collects, why, who it is shared with, how long it is kept, and the choices and rights you have. We wrote it in plain words on purpose. If anything is unclear, write to us at privacy@kitanatin.com.
The short version:
- Your shop's records are yours. We use them only to run KitaNatin for you.
- We do not sell personal information, and we do not show ads.
- We do not use outside analytics or tracking companies.
- KitaNatin never holds your customers' money or card details.
- Receipt pictures are read on your phone. The picture is not sent anywhere to be read.
1. Who we are
KitaNatin is operated by Jose Alberto Rivera, Atimonan, Quezon, Philippines ("KitaNatin", "we", "us"). Our Data Protection Officer is Jose Alberto Rivera, reachable at privacy@kitanatin.com.
2. Your shop's data and your customers' data
There are two kinds of personal information in KitaNatin:
- About you and your team (the owner and staff who sign in). For this, KitaNatin decides how it is used and is responsible for it.
- About your shop's customers, suppliers and lenders that you choose to type in (for example a customer's name and phone for utang or customer credit). For this, your shop is responsible: you decide what to record and why. KitaNatin keeps and processes it only on your instructions, to run the app for you. Under the Philippine Data Privacy Act your shop is the personal information controller and KitaNatin the processor; under the GDPR, the controller and processor.
If you record your customers' details, please tell them, and record only what you need.
3. What we collect
When you sign up and sign in
- Your mobile number or email address, and a password; or your Google account's name and email if you sign in with Google.
- Your name, your business's name, type and address, and the answers to the short sign-up questions (such as how many people work there).
- If you add them: your business registration details (such as DTI/SEC number, VAT status and tax office).
- Your PIN, security answer and backup code are kept only in a scrambled form (a "hash") that cannot be turned back into the PIN.
- Fingerprint and face unlock are handled by your phone. KitaNatin never sees or keeps your fingerprint or face, only whether you turned the unlock on.
When you use the app
- Your shop's records: products, sales, receipts, refunds, cash drawer counts, expenses, bills, wallets, utang and customer credit, stock counts, bookings, tasks and reports.
- People you add: customers (name, phone, email, notes, discounts), suppliers and lenders.
- Activity log: who did what and when in your business (for example who rang up or voided a sale, or signed in), so the owner can see it.
- Team chat and announcements: the messages and files your team sends, and whether a message was delivered and read.
- Feedback and support requests: what you write, your rating, any pictures you attach, and, for a support request you agree to send, your business, name, contact details and your phone's model, app version and last sync time, so we can help.
Pictures
- Receipt pictures stay on your phone. They are copied to the cloud only if your business has the receipt cloud copy feature.
- Payment proof pictures (for example a screenshot of a GCash payment), feedback pictures, calendar pictures and chat files are kept in private cloud storage.
- Wallet card pictures: only the finished card picture is kept, with its bottom half blurred, so the card number, name and expiry are never stored. The original photo is not kept.
- Text on receipts is read on your phone (Google's ML Kit on Android, Apple's Vision on iPhone). The picture is not sent to anyone to be read.
About your devices
- A random number KitaNatin makes for each phone or tablet, its model, system and app version, and when it last synced, so your shop can see and manage its devices.
- On Android, a scrambled form of the phone's own ID, so a reinstall on the same phone is not counted as a new device. The real ID never leaves the phone.
- A notification token, so the app can send you alerts.
- Usage counts made by KitaNatin itself (which screens and features are used), tied to a random number for the app install, not to your name.
Location
- If you allow it, the weather card uses your phone's location; otherwise the shop location you saved in Store settings. Only the map position (latitude and longitude) is sent to the weather service, never your name. You can say no to location; the app works without it.
4. Why we use it
- To run KitaNatin for you: record sales, keep your devices in sync, back up your records to the cloud, print receipts and reports, and let your team work together.
- To keep your account safe: sign-in, PINs, recovery codes, and the activity log.
- To send what you asked for: alerts, reminders, recovery codes and emails.
- To support you and improve the app: answer feedback and support requests, and use the usage counts (shown to us only as totals across many shops) to see what to fix.
- To meet legal duties, such as tax record rules.
For people in the UK and Europe, the legal grounds are: to provide the service you signed up for (contract); our legitimate interest in keeping it secure and working well; your consent for location and notifications (which you can take back any time); and legal obligations.
5. Who we share it with
We do not sell personal information or share it for advertising. We share it only with the services that run KitaNatin, and with outside services you choose to connect:
| Service | What it gets | Why |
|---|---|---|
| Supabase (cloud database and storage) | Your account and your shop's records | Stores and syncs your data |
| Google Firebase | Notification token and the alert text | Delivers notifications |
| Resend | Email address, subject and message | Sends emails such as recovery codes |
| Open-Meteo | Map position only | Weather on Home |
| OpenStreetMap (web version only) | Map position only | Shows the place name for the weather |
| UPCitemdb | A barcode number only | Looks up a product name you scanned |
| Google (if you sign in with Google) | Sign-in request | Signs you in |
| Google Calendar (if you connect it) | Your bookings and events | Puts them in your own calendar |
| Intuit QuickBooks (if you connect it) | Daily sales totals, refunds, credit paid back, and expenses with their pictures | Your bookkeeping |
| Square Point of Sale (shops abroad, if you switch it on) | The amount to charge | Takes the card payment in your own Square app |
Each connected service also has its own privacy policy. We may also share information if the law requires it, to protect people's safety, or if KitaNatin is ever sold or merged (you would be told first).
Payments: KitaNatin never holds your customers' money or card details. Payments by GCash, Maya, QR, bank transfer or card go straight from your customer to your own account with that provider.
6. Where it is stored
Your records are kept on your phone or tablet, so the app works without internet, and in our cloud database in Singapore. Some of the services above work from other countries, such as the United States. When information leaves your country, we use providers that protect it with security and contract terms, as the law requires.
7. How long we keep it
We keep your account and shop records while your account is open, so your history, reports and tax records stay complete. Some things are removed sooner, automatically:
| What | Removed |
|---|---|
| Payment proof pictures | 90 days after the sale (the sale keeps a note that a proof was attached) |
| Feedback pictures | 30 days after the feedback is closed |
| Calendar pictures | 180 days after the booking or event |
| Support request replies | 60 days |
| Emails waiting to be sent | 7 days |
| Usage counts (single events) | 90 days, after being added into totals |
| Expense details in the cloud | After 1 year, unless your business keeps a longer history (the amount, date, type and how it was paid stay) |
| Receipt pictures in the cloud | After 1 or 5 years, depending on your business's plan |
Records on your phone stay there until you erase them, erase the phone in KitaNatin, or uninstall the app.
8. How we protect it
- Data travels between your phone and the cloud encrypted (HTTPS).
- Each business can see only its own records; each person sees only what their role allows.
- Pictures are kept in private storage, not on public links.
- PINs and recovery codes are kept only in scrambled form; sign-in keys sit in your phone's secure storage.
- Keys for connected services (Google Calendar, QuickBooks) are locked in the cloud, and disconnecting removes them.
The records on your phone are as safe as the phone. Please use a screen lock and KitaNatin's own app lock, and erase a phone in KitaNatin if it is lost. If a breach ever puts your personal information at risk, we will tell you and the National Privacy Commission (or your country's regulator) within 72 hours of finding out, as the law requires.
9. Your choices, and closing your account
- See and correct your details in the app (Settings), or ask us.
- Download your records any time as spreadsheets, PDFs and files for your accountant, from Reports.
- Location and notifications: turn them off in your phone's settings.
- Disconnect Google Calendar or QuickBooks in the app at any time.
- Close your account: write to privacy@kitanatin.com from the email or mobile number on the account. We will confirm it is you, then delete your business's data from our cloud within 30 days, except records the law requires us to keep, which we keep only for as long as it requires. Download what you need first.
10. Your rights, by country
Wherever you are, you can ask us what we hold about you, ask us to correct or delete it, or object to how we use it. We answer within 30 days, free of charge. Write to privacy@kitanatin.com. If your shop recorded you as a customer, please ask the shop first; we will help them answer.
Philippines
Under the Data Privacy Act of 2012 (Republic Act 10173) you have the right to be informed, to access, to object, to correct, to have your data erased or blocked, to data portability, and to damages. You can complain to the National Privacy Commission.
United Kingdom and Ireland
Under the UK GDPR and the EU GDPR you can also ask us to restrict how we use your data, take your data with you, and withdraw consent. You can complain to the Information Commissioner's Office (UK) or the Data Protection Commission (Ireland).
United States (including California)
We do not sell personal information or share it for advertising. California residents can ask to know, delete and correct their personal information, and we will not treat you differently for asking.
Canada
Under PIPEDA you can access and correct your information. You can complain to the Office of the Privacy Commissioner of Canada.
Australia
Under the Privacy Act 1988 you can access and correct your information. You can complain to the Office of the Australian Information Commissioner.
New Zealand
Under the Privacy Act 2020 you can access and correct your information. You can complain to the Privacy Commissioner.
Singapore
Under the Personal Data Protection Act you can access and correct your data and withdraw consent. You can complain to the Personal Data Protection Commission.
11. Children
KitaNatin is for businesses and is not meant for anyone under 18. If a shop records a customer who is a minor, the shop is responsible for having the right to do so.
12. Changes to this policy
If we change this policy, we will update the date at the top. For important changes we will tell you in the app at least 30 days before they apply.
13. Contact us
KitaNatin, Jose Alberto Rivera, Atimonan, Quezon, Philippines
Email: privacy@kitanatin.com