Effective October 16, 2026
Privacy Policy
This policy explains how VCFY (“VCFY”, “we”) collects, uses, and protects personal information in VCFY Business Kit, in line with the Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules.
Two kinds of information
Your account information. When you create an account or workspace, we collect your name, email address, password (stored only as a secure hash), business name, and business details such as address, TIN, and VAT status. For this information, VCFY is the personal information controller.
Your customers’ information. Businesses use VCFY to record inquiries, clients, quotations, billing statements, and payments. That information belongs to the business that entered or received it. The business is the personal information controller, and VCFY processes it only on the business’s behalf and instructions, as a personal information processor.
What we use information for
- To provide the service: sign-in, workspaces, records, websites, and inquiry forms.
- To send service emails, such as sign-in links, team invitations, and new-inquiry alerts.
- To process Pro subscription payments through our payment provider.
- To keep the service secure, prevent spam and abuse, and keep audit logs.
- To provide support when you ask for it.
We do not sell personal information and do not use customer records for advertising.
Inquiry forms and websites
People who send an inquiry through a business’s VCFY website or form must agree to the collection of their details before sending. Their inquiry goes to that business only. Questions about how a business uses an inquiry should go to that business.
Service providers
We use trusted providers to run VCFY, under agreements that require them to protect the data: Supabase (database, sign-in, and file storage), Vercel (hosting), Resend (email), PayMongo (payments), and Cloudflare Turnstile (spam protection). Some of these providers may store or process data outside the Philippines.
Security
Each workspace is isolated at the database level, so one business cannot see another’s records. Data is encrypted in transit. Access is limited by role (Owner, Manager, Staff). If you ask VCFY support for help, any access to your workspace is time-limited, tied to your request, and logged.
How long we keep information
We keep account and workspace data while the account is active. A business can export its records (Pro) and ask us to delete its workspace. We keep some records longer only where the law requires it, such as payment records.
Your rights
Under the Data Privacy Act, you have the right to be informed, to access, to object, to correct, to erasure or blocking, to data portability, and to claim damages. To use these rights, email privacy@vcfyit.com. If your request is about a business’s customer records, we will help that business respond. You may also file a complaint with the National Privacy Commission.
Changes
If we change this policy in a meaningful way, we will notify account owners by email or in the app before the change takes effect.
Contact
Data protection questions: privacy@vcfyit.com