1 Who we are
AutoSOA is business software for billing, accounting, payroll and operations, made by MaxMarketLink Digital Marketing Services, a sole proprietorship of Dionisio Macaraeg Untiveros Jr. (DTI Business Name No. 4301047), 2329 Antipolo Street, Guadalupe Nuevo, Makati City 1212, Philippines (“AutoSOA”, “we”, “us”).
We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules, and the issuances of the National Privacy Commission (NPC). Our Data Protection Officer is Dionisio M. Untiveros Jr., reachable at admin@autosoa.com.
2 Two different roles
Visitors and account holders. When you visit autosoa.com, contact us, or create an AutoSOA account, we decide what is collected and why. For that information we are the personal information controller.
Information your business puts into AutoSOA. When a business uses AutoSOA to bill its customers, pay its employees or keep its books, the business decides what goes in and why. For that information the business is the personal information controller, and we are its personal information processor: we hold and process it only to run AutoSOA for that business, under our agreement with it. If you are a customer, tenant or employee of a business that uses AutoSOA, please contact that business first; we will help it answer you.
3 What we collect when you visit autosoa.com
autosoa.com sets no cookies and uses no advertising or analytics trackers. When you open a page, the site sends us a short note about the visit, once per browser session:
- your IP address, and the approximate location our hosting provider derives from it (city, region, country);
- your browser and device type, language, time zone and screen size;
- the page you opened, the page that linked you to us, and any campaign tags in the link (such as
utm_source); - the date and time.
We use it to know when someone is interested in AutoSOA and where they found us. A member of our team receives it by email. If your browser sends Do Not Track or Global Privacy Control, the site sends nothing.
Our pages also load the Inter typeface from Google Fonts, so Google receives your IP address and browser details when a page loads (see Google’s privacy policy).
4 What we collect when you use AutoSOA
- Your account: name, email address, phone number if you give one, and your password, which we store only as a one-way hash.
- Your business: its name, address, TIN and the settings you choose.
- Sign-in and security records: when you signed in, from which IP address and browser, failed attempts, and two-factor settings.
- An audit trail: who created, changed or deleted which record, and when.
- Payments for your subscription: amount, date and status. Card and wallet details are entered on the payment provider’s page; we do not see or keep your full card number.
- Messages you send us by email or through the app.
5 Information your business puts into AutoSOA
Depending on the modules your business uses, this can include, about its customers, tenants, suppliers and employees:
- names, contact details, addresses and TINs;
- statements of account, invoices, payments, balances and receipts;
- for Payroll: employee details, government numbers (TIN, SSS, PhilHealth, Pag-IBIG), pay rates, attendance, leave, loans and the bank accounts pay is sent to.
Government-issued numbers are sensitive personal information under the Data Privacy Act. We process this information only to run AutoSOA for the business, and we do not use it for our own purposes.
If your business turns on an AI feature, such as reading a photographed receipt or asking the assistant a question, the text or image involved is sent to an AI provider (see section 7) to produce the answer.
6 Why we use it
| Purpose | Legal basis |
|---|---|
| Running your account and the services you subscribed to | Our contract with you |
| Billing your subscription | Our contract with you |
| Keeping accounts secure and stopping abuse (sign-in records, rate limits, audit trail) | Our legitimate interest in a safe service |
| Knowing who visits autosoa.com and how they found us | Our legitimate interest in reaching people interested in AutoSOA; you can opt out with Do Not Track or Global Privacy Control |
| Answering your messages and support requests | Your request; our legitimate interest |
| Keeping records the law requires, and answering lawful orders | Legal obligation |
| Processing your business’s data about its customers and employees | Your business’s instructions, under our agreement with it |
We do not sell personal information, and we do not use it for advertising.
7 Who helps us run AutoSOA
We use these service providers. Each processes information only for us, under its own security and data-processing terms:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, backups, email sending | Singapore |
| Vercel | Hosting AutoSOA Next and the visit-notice service | Singapore and its global network |
| Neon | Database for AutoSOA Next | Singapore |
| Fonts on autosoa.com; email delivery | Global | |
| OpenAI and Anthropic | AI assistant and receipt reading, only when those features are used | United States |
| Stripe and PayPal | Paying for a subscription online | United States |
| Google reCAPTCHA | Stopping automated sign-ups | Global |
We may also disclose information when the law requires it, for example to a court, the BIR or the NPC.
8 Where it is stored
Our main systems run in Singapore. Some providers above are based in the United States. When information leaves the Philippines we stay accountable for it, as the Data Privacy Act requires, and we only use providers that commit to protect it.
9 How long we keep it
- Website visit notes: up to 12 months, then deleted.
- Your account and your business’s data: for as long as your subscription is active. After you close your account we delete or anonymise it within 90 days, except records Philippine tax and accounting law requires us or your business to keep for longer.
- Backups of our databases are kept for up to 12 months, then deleted.
10 How we protect it
- Every connection is encrypted (HTTPS).
- Access inside AutoSOA follows roles and permissions; each business sees only its own data.
- Passwords are hashed; two-factor sign-in is available, and repeated wrong codes lock the account.
- Changes are recorded in an audit trail, and databases are backed up before every update.
If a breach puts your information at real risk, we will tell the NPC and the people affected within 72 hours of finding out, as the law requires.
11 Your rights
Under the Data Privacy Act you have the right to be informed; to access your information; to object to its processing; to have it corrected; to have it erased or blocked; to get a copy you can take elsewhere (data portability); and to be compensated for damages caused by inaccurate, unlawfully obtained or misused information.
To use any of these rights, email our Data Protection Officer at admin@autosoa.com. We will answer within 15 working days. If you are not satisfied, you may file a complaint with the National Privacy Commission at privacy.gov.ph.
12 Children
AutoSOA is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their information as account holders.
13 Changes to this notice
When we change this notice we update the date at the top. If a change matters to how we use your information, we will tell account holders by email before it takes effect.