Privacy Policy

Quonivo processes: owner account information (name, email, authentication data); business profile and branding details; customer contact details entered by the business (name, phone, email); quotations, jobs, invoices, and recorded payments; uploaded logos; and technical information such as IP address and device/browser data needed to secure and operate the service.

Do not enter full card numbers, e-wallet credentials, passwords, one-time passcodes, or other authentication credentials into Quonivo records. Hosted payment screens are designed to keep those credentials with our payment provider, not with Quonivo.

Quonivo processes personal data under the Data Privacy Act of 2012 (Republic Act No. 10173) on the basis of contract performance (to provide the service you signed up for), legitimate interest (to secure the service and prevent abuse), and legal obligation (for tax and accounting records where applicable). Information is used to authenticate owners, provide the quote-to-payment workflow, generate business documents, maintain tenant isolation between workspaces, support customers, prevent fraud and abuse, diagnose failures, and administer subscriptions.

Quonivo shares only the information needed to operate the service with: Supabase (database, authentication, and file storage), our hosting provider (application delivery), PayMongo (subscription payment processing, once enabled), and Resend (transactional email delivery). These providers process data on Quonivo's behalf under their own security commitments and are not authorized to use workspace data for their own purposes. Quonivo does not sell personal data, and does not share customer records across business workspaces.

Some service providers process data outside the Philippines, including in data center regions in East Asia and elsewhere. Where this occurs, Quonivo relies on providers with contractual and technical security commitments consistent with the Data Privacy Act's requirements for outsourcing and cross-border transfer.

Under the Data Privacy Act, you may request access to, correction of, or erasure of your personal data, object to certain processing, and request a copy of your data in a portable format. Business owners can correct business and customer records directly in the application. For any other request, use the contact on the Support page; Quonivo will verify your identity and workspace ownership before acting on the request and will respond within the timeframe required by law. You may also lodge a complaint with the National Privacy Commission if you believe your rights have been violated.

Quonivo retains workspace data for as long as the workspace is active, and for a limited period afterward to allow reactivation, satisfy accounting and tax retention obligations, resolve disputes, and enforce these policies. On a verified deletion request, Quonivo will delete or anonymize personal data except where retention is required by law (for example, financial records subject to Bureau of Internal Revenue retention rules).

Quonivo uses authenticated sessions, tenant-scoped database queries, row-level security policies, and scoped storage access to protect workspace data. No online service can guarantee absolute security. If Quonivo becomes aware of a breach affecting your personal data, it will notify affected workspace owners and, where required, the National Privacy Commission, without undue delay and in line with the Data Privacy Act's breach-notification rules.

Quonivo is intended for business use by adults and is not directed at children. Quonivo does not knowingly collect personal data from individuals under 18.

Quonivo may update this policy as the service evolves. Material changes will be posted here with an updated effective date and, where reasonably practicable, notified to workspace owners by email.

Privacy questions, access requests, and complaints can be sent through the contact published on the Support page.