Tinda Tools Privacy Policy

Effective date: September 13, 2026
Last updated: September 13, 2026

1. Who we are

Tinda Tools (“Tinda Tools”, “we”, “us”) is a business management application for sellers, operated by:

Business address: Country Club Village, Baguio City, Philippines.
General contact: support@tindatool.com
DPO contact: data@tindatool.com

2. What this policy covers

This policy explains how we handle personal data when you:

• Visit tindatool.com
• Create or use a Tinda Tools account
• Are added to a Tinda Tools account by a business as an agent or team member

Two different roles. Tinda Tools is used by sellers to manage their own businesses. When a seller enters their customers’ information into the app:

• The seller is the Personal Information Controller of their customers’ data. They decide what to collect and why
• We are the Personal Information Processor. We only store and process that data on the seller’s instructions

If you are a customer of a seller who uses Tinda Tools and you want your data corrected or deleted, please contact that seller directly. We will support them in fulfilling your request, but they decide what happens to their records. You may also contact us at data@tindatool.com and we will direct your request appropriately.

3. What personal data we collect

3.1 From account holders (sellers and their team members)

• Name
• Email address
• Business name and business type
• Role within the business (admin or agent)
• Login credentials
• Payment reference numbers and, where provided, payment confirmation screenshots
• Records of your activity within the app (actions taken, timestamps)

3.2 Data you enter into the app about your own customers

• Customer names and contact details
• Delivery addresses
• Order details and history
• Payment records

You’re in control of this information. We store it for you, but you decide what customer information to put into the app and how you use it. That means you (not us) are responsible for your customers’ data. If one of your customers asks you to correct or delete their information, that request goes to you, and we’ll help you act on it.

3.3 From website visitors

• IP address, browser and device information, pages visited, and referral source, collected through Google Analytics and Meta Pixel: only with your consent via our cookie banner
• We currently use no analytics or tracking inside the app itself

3.4 Sensitive personal information

We do not intentionally collect sensitive personal information as defined under the Data Privacy Act (such as health, religion, government-issued ID numbers, or offenses). Please do not enter such information into free-text fields.

4. Why we process your data, and our legal basis

5. Where your data is stored, and international transfers

Your data is stored outside the Philippines:

Supabase — Database, storing all app data. Located in Seoul, South Korea (ap-northeast-Vercel — Application hosting. Located in the United States.
Resend — Sending service emails. Located in Tokyo (ap-northeast-1).

South Korea holds an adequacy decision from the European Commission, meaning transfers there are recognised as providing an adequate level of protection.

For transfers to the United States, we rely on our provider’s participation in the EU-US Data Privacy Framework and, where applicable, on Standard Contractual Clauses included in our agreement with them. We monitor our providers’ certification status and will update our safeguards if it changes.

We remain accountable for your data wherever it is processed, and require our providers to maintain appropriate safeguards.

6. Who else sees your data

We share personal data only with:

• Our infrastructure providers listed above, who process data on our instructions
• A successor, if the service is ever transferred, you would be notified first

We do not share your data with advertisers, data brokers, or any third party for their own purposes.

7. How long we keep your data

• Active account
  For as long as your account is open.
• You cancel your account
  60 days, then permanently deleted. You may request your data during this window.
• Free account inactive for 6 months
  We email you a warning. You then have 30 days to respond or retrieve your data. If we hear nothing, the data is deleted.
• Data export files we generate on request
  Deleted 60 days after we provide them.
• Payment screenshots
  60 days once payment is verified.
• Website analytics
  14 months for user-level and event-level data. Aggregated reports that cannot identify you are kept longer.

8. Your rights

Under the Data Privacy Act of 2012, and, where applicable, the GDPR, you have the right to:

• Be informed about how your data is processed
• Access your personal data
• Object to processing, including for marketing
• Correct inaccurate or incomplete data
• Erasure or blocking of your data in the circumstances the law allows
• Data portability. Obtain your data in a structured, commonly used format
• Damages for violations of your rights
• File a complaint with the National Privacy Commission

How to exercise them

Email data@tindatool.com. We respond within 30 days.

About data portability specifically

• All users, on any plan, can request a complete copy of their data. We provide it within 30 days at no cost.
• Paid plan users additionally get a self-service export button for data they entered themselves (products, orders, accounts, suppliers, team, transactions, wishlist).
• Data our system derives from your inputs such as compiled reports, income statements, cash flow, and sales logs, is available to everyone on request as a full JSON export.

The difference between plans is convenience and speed, not your legal right to your data.

Complaints

If you are unhappy with our response, you may contact the National Privacy Commission at privacy.gov.ph. EU-based users may also complain to their local supervisory authority.

9. How we protect your data

• Encrypted connections (HTTPS/TLS) for all data in transit
• Encryption at rest through our database provider
• Role-based access controls – agents cannot access financial data
• Passwords stored hashed, never in plain text
• Automated backups
• Access to production data limited to the Data Protection Officer

No system is perfectly secure. We do not guarantee absolute security, but we take these obligations seriously.

10. If there is a data breach

If a personal data breach occurs that is likely to put you at risk, we will:

• Notify the National Privacy Commission within 72 hours of becoming aware of it
• Notify affected users without unreasonable delay
• Tell you what happened, what data was affected, and what we are doing about it

11. Cookies

Our website uses cookies:

• Essential cookies — needed for the site to function. Always on.
• Analytics cookies (Google Analytics) — help us understand site usage. Only with your consent.
• Marketing cookies (Meta Pixel) — help us measure advertising. Only with your consent.

You can accept or decline non-essential cookies through our cookie banner, and change your mind anytime.

The app itself uses no analytics or tracking cookies.

12. Children

Tinda Tools is for users 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email data@tindatool.com and we will delete it.

13. Changes to this policy

We may update this policy. If changes are significant, we will email account holders at least 30 days before they take effect. The “last updated” date at the top always reflects the current version.

14. Contact

Email: data@tindatool.com
General enquiries: support@tindatool.com
Address: Baguio City, Philippines