Privacy Policy

SUSIBooks is a bookkeeping and invoicing service for Philippine businesses. The operator of SUSIBooks is the personal information controller for the data described in this policy: it decides what personal data is collected and why.

Our registered business name, business address and Data Protection Officer are set out in your service agreement and on the invoice issued to you, and are available on request at support@merqato.digital.

This policy applies to the hosted SUSIBooks service. If you self-host the software, you are the personal information controller for your own instance and are responsible for your own privacy notice.

We collect only what the service needs to work. In practice that means:

• Account data · name, email address, password or single-sign-on identity, and organization membership.
• Business and BIR data · registered business name, TIN, branch code, RDO and PSIC codes, tax type, registered address, and the BIR Form 2303 (Certificate of Registration) you upload.
• Transaction data · invoices, bills, contacts, payments and the accounting entries produced from them — which may include personal data about your own customers and suppliers.
• Usage and technical data · pages visited, features used, device and browser type, and IP address, kept in application and audit logs.
• Support correspondence · messages you send us.
• Payment data · handled by our payment processor. We store a subscription reference and billing address, not full card details.

We process personal data for these purposes:

• Creating and administering your account.
• Producing the books, invoices and BIR reports you ask the system to produce.
• Processing subscription payments.
• Keeping the security, integrity and audit trail of the service, including the records Philippine tax law requires us to keep.
• Responding to support requests and service notices.
• Improving the product using aggregated, non-identifying data.

Our legal bases under Section 12 and Section 13 of RA 10173 are: performance of a contract with you; compliance with a legal obligation (tax, accounting and anti-fraud requirements); your consent where we ask for it; and our legitimate interests in operating and securing the service, balanced against your rights.

We share personal data only with service providers that help us run SUSIBooks, and only as needed:

• Hosting and storage · servers, databases and object storage that hold your data.
• Payment processing · subscription billing. The payment processor handles card data under its own obligations.
• Email delivery · transactional mail such as invoices you send and password resets.

These providers process data on our instructions or as independent controllers, and are bound by their own agreements with us.

We may also disclose data where Philippine law requires it — for example in response to a lawful order from the Bureau of Internal Revenue, a court, or the National Privacy Commission.

We do not sell personal data.

Account data is kept while your account is active, then for the period needed to close out the relationship.

Accounting records, invoices and BIR documents are kept for as long as Philippine tax law requires them to be preserved, which can be up to ten years from the relevant taxable year. Deleting your account does not shorten a statutory retention period.

Audit and security logs are kept for a limited period and then deleted or anonymised.

We apply organisational, physical and technical safeguards, including:

• Encryption in transit for all connections to the service.
• Access controls so staff see only what their role requires.
• Access logging on financial documents, because an accounting system without an audit trail cannot be trusted.
• Regular review of dependencies and access rights.

No system is perfectly secure. If you believe your data has been compromised, tell us immediately at support@merqato.digital.

Under RA 10173 you have the right to:

To exercise any of these rights, write to support@merqato.digital. We will respond within fifteen (15) working days as required by the NPC, and tell you if a longer period is genuinely needed.

Some rights are limited: we cannot delete records that tax law requires us to preserve, and we cannot correct a TIN that belongs to someone else's registered business.

If our answer does not resolve your concern, you may complain to the National Privacy Commission:

National Privacy Commission
3rd Floor, Delegation Building, PICC Complex
Roxas Boulevard, Pasay City 1307, Philippines
Email: complaints@privacy.gov.ph
Website: privacy.gov.ph

We would rather hear from you first, so please write to us as well.

We use cookies and similar storage for three things: keeping you signed in (strictly necessary), remembering interface preferences, and counting page views so we know what is used. We do not use advertising or cross-site tracking cookies.

You can block cookies in your browser. Blocking the strictly necessary ones will stop you signing in.

SUSIBooks is a business tool and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you think a child has given us personal data, write to us and we will delete it.

We may update this policy when the service or the law changes. Material changes will be announced in the app or by email at least fifteen (15) days before they take effect. The date below is always the version in force.

Questions about this policy, or a data subject request, go to support@merqato.digital.