Privacy Policy

1. Overview

Accounting Firm OS ("we", "us", "our") is committed to protecting the privacy of all individuals whose personal data we process. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with Republic Act No. 10173, also known as the Data Privacy Act of 2012 (DPA), and its Implementing Rules and Regulations.

This policy applies to all users of the Accounting Firm OS platform, including partner firms, their staff, and end clients whose data is managed through the platform.

2. Data We Collect

We collect the following categories of personal data:

• Partner firm data: Firm name, TIN, address, contact persons, email addresses, and phone numbers.
• End client data: Legal name, TIN, RDO code, entity type, contact information, and compliance-related financial data entered by partner firms.
• Platform usage data: Login activity, feature usage, and audit logs for security and compliance purposes.
• Communication data: Messages sent through the platform's Communication Hub, including Messenger and email integrations.
• Document data: Files uploaded to the Document Vault by partner firms or their clients.

3. How We Use Your Data

We use collected data for the following purposes:

• Providing and operating the Accounting Firm OS platform
• Generating and maintaining BIR compliance calendars for end clients
• Sending automated deadline reminders and notifications
• Processing payments and managing billing records
• Improving platform features and performance
• Complying with legal and regulatory obligations

We do not sell, rent, or trade personal data to third parties for marketing purposes.

4. Data Storage and Security

All data is stored on enterprise-grade cloud infrastructure with the following protections:

• Documents are encrypted at rest using AES-256 encryption and in transit using TLS 1.3.
• Database records are protected with row-level security, ensuring each partner firm's data is isolated.
• Access controls and audit logs are maintained for all data access events.
• Daily backups are performed and retained for a minimum of 30 days.

For partner firms who deploy on their own cloud or on-premise infrastructure, data storage security is the responsibility of the partner firm within their chosen environment.

5. Third-Party Services

We use the following third-party services to operate the platform:

• Anthropic (Claude): AI-powered document extraction, compliance Q&A, and message drafting. Data submitted to Claude is processed under Anthropic's enterprise data processing terms.
• Meta (Messenger): Client communication via Facebook Messenger. Messages are processed under Meta's platform policies.
• PayMongo: Payment processing for billing features. Financial data is handled under PayMongo's PCI-DSS compliant infrastructure.
• Cloudflare R2: Document storage. Files are stored under Cloudflare's data processing agreement.

We ensure all third-party processors maintain appropriate data protection standards consistent with the DPA.

6. Data Subject Rights

Under the Data Privacy Act of 2012, you have the following rights:

• Right to be informed: You have the right to know how your personal data is being processed.
• Right to access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete data.
• Right to erasure: You may request deletion of your personal data, subject to legal retention requirements.
• Right to data portability: You may request your data in a structured, machine-readable format.
• Right to object: You may object to processing of your personal data in certain circumstances.

7. Data Retention

We retain personal data for as long as necessary to provide the platform services and comply with legal obligations. Partner firm data is retained for the duration of the partnership agreement and for a period of five (5) years thereafter, in accordance with Philippine tax and corporate record-keeping requirements. Upon written request for deletion, we will remove data not subject to legal retention obligations within 30 days.

8. Contact for Privacy Concerns

For any privacy-related concerns, requests to exercise your data subject rights, or questions about this policy, please contact our Data Protection Officer at:

We will respond to all privacy requests within fifteen (15) business days in accordance with the DPA.