NegosyoKlaro · by EM Labs

Privacy Policy

Effective date: October 24, 2026

The short version

NegosyoKlaro is a point-of-sale and inventory app for small Philippine businesses. Your business records — sales, inventory, customers, utang, cash — are kept in the app on your phone. We keep a small cloud account (your sign-in identity and subscription status) so you can sign in and use paid features. Two things you choose to do send your records off the phone: Cloud Backup, an optional Pro feature that copies your store records to our cloud service so you can restore them on a new phone (section B2), and Smart Resibo, which sends one receipt photo for text extraction (section D). Your sales, inventory, customer, utang and cash records leave your phone only when you start one of these yourself. If you send us feedback from Settings (from version 0.1.7), only the words you type, basic app details (app version and build, iPhone or Android, and the time) and technical codes that stop duplicates and misuse are sent, and they are not linked to your account (section F). From version 0.1.7 the app also checks for new versions and, only if you turn notifications on, registers this phone for new-version notifications (section G). We do not run ads, we include no tracking or crash-reporting software, and we do not sell data. Two pieces of software inside the app send information that is used for statistics: Google's ML Kit barcode scanner, on Android only, sends Google diagnostic and usage information about the scanner; and RevenueCat, which manages your subscription status, keeps a record for each signed-in account and for anyone who opens the upgrade screens, and gives us statistics built from it (see the Camera, photos, and barcodes section, and section C).

A. Information kept on your device

Everything you record while running your store is saved in a local database inside the app on your phone:

Products, categories, prices, barcodes, and stock levels
Sales, receipts, and cash movements
Stock purchases, suppliers, and price history
Capital and business-year records
Customer (suki) names, phone numbers and utang balances that you enter — these stay on your phone, and reach our cloud only inside a Cloud Backup you choose to make (section B2)
Product photos you take. They are re-encoded by the app before being saved, which removes camera metadata such as location
Your GCash / QR Ph payment image, if you add one. It is re-encoded the same way and is shown to your customers by you, on your phone — we never receive it
Your Owner Lock PIN, stored as a one-way derived value in your phone's secure keychain. We never see it and there is no recovery bypass

Because these records live on your device, deleting the app deletes them from that phone. If you have made a Cloud Backup (section B2), you can restore that copy onto a new or reset phone; if you have not, we cannot recover them for you. Nothing is backed up unless you use Cloud Backup.

B. Information in your account (our cloud)

Sign-in and subscriptions are powered by Supabase, our cloud database provider. Your account holds account-level records only:

Your email address. Signing in works by a six-digit code we email you, so shop-owner accounts have no password: we never ask you for one and never store one. The app's only password sign-in is the Reviewer access screen, used only by test accounts EM Labs creates for app-store reviewers. Authentication itself is operated by Supabase, and the emails that carry your sign-in and email-verification codes are sent for us by Resend, an email delivery service
A Philippine mobile number, only on accounts created before mid-August 2026 that verified one at the time. It is kept as historical contact information and can no longer be used to sign in; accounts created since then have none
An optional recovery email, if you choose to add one
Your profile name
A record that your store is claimed by your account, together with a random per-installation identifier, used to stop someone else claiming the same store
Subscription and trial status, including a mirror of your subscription state as reported by the app store you bought through
Smart Resibo scan records, described in section D
If you signed up through a sales partner and entered a referral code, the record linking your store to that partner

We use this to sign you in, to let you get back to your account on a new phone, to enforce plan limits fairly, and to operate the paid subscription. We do not use it for advertising or profiling.

Sales partners. If you enter a sales partner's referral code — typed, or from the partner's link or QR code — the app first checks the code with our server as you enter it. Checking a code alone does not assign a sales partner to your store. The app sends the code to be recorded once you are signed in and your store is linked to your account, or later from Settings or just before a Pro purchase if it was not recorded yet. Our server keeps a log of these attempts and their outcome — accepted, or refused and why — which partners cannot see. When our server accepts the code, it records which partner referred your store, with the code and campaign, how the code reached the app, when you confirmed it on your phone, and when it was recorded. From then on, the partner who referred your store can see in our partner tools:

Your store's internal identifier, and when your store was linked to your account
That referral record
Your Pro subscription's plan and status, its purchase and expiry dates, whether it will renew, any billing problem or grace period, and when it last changed
For a commission your subscription earns them: its amount, stage and status, the purchase and 90-day dates, when it is paid out or clawed back, and the reason it was paid, withheld or reversed — which can show that your subscription was cancelled, expired, refunded or transferred to another account, or that we disqualified the commission (for example as a duplicate store or for suspected fraud)

If the referral is later moved to another partner, the earlier partner sees that it was moved and when. If you delete your account, the partner keeps seeing the commission records already made for your store, and an earlier partner keeps seeing that the referral was moved and when (see Retention and deletion). The partner is not given your email address, your phone number, or your store's sales, stock, customer, utang or cash records. This supports referral attribution and commission administration: crediting your store to the right partner, and working out, paying and correcting what we owe them.

Keeping the partner programme fair. To stop a sales partner from earning commission on their own store, our server compares email addresses. When your store is linked to a sales partner, and each time a commission for your store is worked out, it checks whether the email address you sign in with is the same as the address on that partner's approved application or the address that partner signs in with. When you change the email address you sign in with, it also compares both your old and your new address with the addresses of all our sales partners. Stores already linked to a partner are checked once when this starts.

Before comparing, both addresses are written in one standard form. Capital letters count as small letters. Anything between a "+" and the @ is ignored. A dot at the very end is ignored. For Gmail addresses, dots before the @ are ignored and googlemail.com counts as gmail.com. Nothing else counts as a match: we do not guess from addresses that merely look similar, from names, or from any other detail.

If two addresses are the same, we keep a record that they matched, linked to your account and to that partner. A match only matters if your store is, or later becomes, linked to that partner: then that partner's commission on your store is held until we review it. A match never stops you from using a referral code, is never shown to you as a refusal, and never changes what you pay.

The record does not hold a copy of your address. Because the partner's address is on file, though, it does show which address matched at the time. We delete the record when you delete your account. Our review decision is kept, without your name or address, as part of our partner and audit records.

If you are a sales partner, your addresses are compared in the same way. When you change the email address you sign in with, your old and your new address are compared with the sign-in addresses of store owners, and any match is recorded against you as the partner. A review decision may name you as the partner involved.

B2. Cloud Backup and Cloud Restore (optional, Pro)

What it is. Cloud Backup is an optional feature of the paid Pro plan. Nothing is backed up automatically: a backup is made only when you tap Back Up Now in Settings → Data backup. Cloud Restore copies your most recent backup onto a phone that has no store records yet — a new phone, or one that was reset — for the account and store that made it.

What is copied. The records you keep in the app for your store: your store profile and settings (store name, business type, the barangay, city and province you entered, your GCash name and number if you added them, and your starting capital), products, prices, stock and suppliers, sales and cash movements, capital and business-year records, and your customers' names, phone numbers and utang ledger. Your display name is included so the restored store shows it. Your sign-in email, any phone number on your account, and your Owner Lock PIN are never included.

What is not copied. Product photos and your GCash QR image stay on your phone and are not part of Cloud Backup, so they do not come back with a restore. Receipt photos are never stored by us (section D). Your subscription, referral and account records are not part of the backup; they live in your account (section B).

Operational records. To run the service we also keep a small amount of information about each backup: which phone made it, when, how many records it holds, and verification values that let us check the copy is complete. These describe the backup, not your business.

Where it is kept and who can reach it. The copy is stored in our cloud database, operated for us by Supabase in Singapore — the same provider that holds your account (section B). RevenueCat, which handles your subscription status (section C), does not receive your backup or anything in it. Access is tied to your account and your store: only the account that owns the store can back it up or restore it, and only while a Pro plan is active. We use this copy for one purpose — to give it back to you when you restore. We do not read, analyse, sell or share it, and it is not used for advertising.

One backup phone. Backups for a store are made from one phone at a time. When you restore onto a new phone and choose to back up from it, the old phone stops backing up; the records on the old phone stay there.

If Pro ends. Your records stay on your phone and keep working. You can still see that a backup exists and when it was made. Your cloud backup may remain stored after your Pro access ends. Active Pro access is required to create a new backup or restore a backup.

How long we keep it. Your cloud backup may remain stored after your Pro plan ends. We have not set a fixed retention period, and we do not promise that a backup will stay available indefinitely; if we adopt a retention schedule, this page will describe it before it takes effect. Deleting the app from your phone does not delete your cloud backup. Deleting your NegosyoKlaro account removes it, together with the rest of your account (see Retention and deletion).

Security, honestly stated. Your backup travels over encrypted connections and is stored on our provider's infrastructure behind server-side access controls. We do not claim end-to-end encryption: this is transport encryption plus access control, and we do not claim to be technically unable to read the stored copy.

C. Subscriptions and payment

Paid plans are purchased through the app store you installed from — Apple's App Store on iPhone, Google Play on Android. That store processes the payment; we never receive your card details.

We use RevenueCat to manage subscription state, on both platforms. The app does not send RevenueCat your name, email address or phone number, and we have verified that against our own source code. What RevenueCat receives is:

A subscription account identifier — a random internal code, not your email or phone. If you have not created a cloud account, RevenueCat generates its own anonymous identifier instead
Your purchase and subscription status, including the receipt or purchase token the store issues, which RevenueCat validates on our behalf
Technical information its software attaches to its own requests automatically — your device model, operating-system and app version, language settings, store country, on iPhone Apple's per-app device identifier (the identifier for vendor, which is not an advertising identifier), and network information such as your IP address. We do not control this; it is part of how the service operates. RevenueCat uses this information to run the service. It works out an approximate country from your IP address and keeps that country in the record it holds under your subscription account identifier, together with when the app last contacted RevenueCat, your app and operating-system version, and your language setting. We can see that record, and RevenueCat also uses this information in statistics about subscriptions that it gives us. RevenueCat says it does not keep the IP address itself once it has worked out the country
No advertising identifier, and no per-device advertising code on either platform. The app never asks RevenueCat to collect Apple's advertising identifier, and never asks it to collect Android's advertising ID — its advertising-attribution features are not enabled

This traffic happens each time you open the app while signed in to your account, so the app can check whether your Pro plan is active and whether a free trial can be offered. It also happens right after you sign in, link the app to an account (if you had already opened the upgrade screens), or (if you are signed in) finish setting up your store. Whether or not you are signed in, it happens when you open the subscription or upgrade screens and when you make or restore a purchase. RevenueCat's software may also check again when you return to the app. This traffic never includes your sales, stock, customer, utang or cash records. Apple and Google keep their own transaction records under their own privacy policies. RevenueCat keeps what it receives for us, as our service provider, Its terms also let it analyse that information to improve its own services, during and after our contract with it, and share it with others only in aggregate or de-identified form.

D. Smart Resibo (receipt scanning)

This is the one place where a photo leaves your phone, and it only happens when you ask for it. When you tap to scan a supplier receipt, the app sends that photo to our own server endpoint, which passes it to an AI text-extraction provider — currently Mistral AI — to read the items on it.

The photo is sent only when you tap to scan. Never automatically. Before it is sent, the app saves it again as a new JPEG image (shrinking it first if it is large), which removes camera metadata such as location.
Our endpoint does not attach your name, number, or account identity to the image it sends to the provider.
We do not keep the receipt image. It is not written to any of our databases and not uploaded to any file or object storage. It exists on our server only in memory for the seconds the extraction takes, and our own code writes no log entry containing the image or anything read from it.
We do not keep the provider's response either. It is used to pull out the fields you then review — shop name, date, and each item's name, price and quantity — and is released as soon as that finishes. Nothing from the scan is written to your phone unless you choose to save the purchase, and then only the purchase itself is saved, locally, like your other records.
What we do keep is a scan record. For each scan we store a SHA-256 fingerprint — a one-way hash that cannot be turned back into the picture — together with your account and store identifiers, the time, and the outcome. We keep it to count your plan's scan allowance, to avoid charging you twice for the same receipt, and to detect abuse. It contains no receipt text and no image.
Your plan decides your allowance: free accounts have no provider scans, and a paid Pro plan includes 30 per calendar month (Philippine time, with no carryover). A small number of older accounts hold a one-off Pro Preview allowance of a single scan; that plan is no longer offered.
Mistral AI handles the photo partly under its own terms. Mistral says it keeps the photo and the text it reads from it for 30 days after reading it, to check for misuse of its service. We have switched off the setting that lets Mistral use our requests to train its AI models, so your receipt photos and the text read from them are not used for that.

Temporary copies on your phone. Your phone makes working copies of the picture while you scan: one created by the system photo picker, and one resized copy the app prepares to send. The app deletes the copies it owns when the scan finishes, when you replace or remove the image, when you cancel the review, and when you leave the scan screen. Two honest limits: while an extraction error is on screen offering Retry, the copy is deliberately kept so you do not have to photograph the receipt again; and if the app is force-quit or shut down by the system mid-scan, a copy can be left for the operating system to clear on its own schedule. These files are written to the app's own private storage, never to your shared photo gallery or Downloads folder — they never leave your device and are removed when you delete the app.

E. Your phone's own backup is not our cloud

If your iPhone's own backup is switched on, it can include the app's local database, your product photos and your QR image — the same as for other apps:

On iPhoneiCloud Backup, or an encrypted computer backup, under your Apple account and Apple's privacy policy.
On AndroidThe app switches off Android Auto Backup (what you see as Backup by Google One), so Google's backup does not include the app's records, product photos or QR image. When you set up a new phone by copying directly from the old one, Android may copy a few app settings files — never your records, photos, QR image or Owner Lock credential.

Either way that is your backup, held by Apple or Google, not by us. It is not a NegosyoKlaro cloud sync, we cannot read it, and it does not give us a copy of your business records. Your Owner Lock credential is deliberately excluded from device backups.

We mention it because it is the honest answer to “where else could my records be?” — and because, if you do not use Cloud Backup, an iPhone backup is your only protection against a lost or broken phone. On Android, Cloud Backup is the only way to protect your records against a lost or broken phone.

F. Feedback

From version 0.1.7, you can tell us about a problem or share a suggestion from Settings → Send feedback. You do not need an account or a paid plan.

What is sent. The message you type, your app version and build, whether your phone is an iPhone or Android, and the time you tapped Send. The form tells you this in one line. So that a message is recorded only once and the form cannot be misused, the app also sends a random code for the message and the random identifier for this app installation (section B), which our server keeps with your feedback only as a one-way code, and our server keeps a one-way code made from your internet address. Both codes are made with a secret key kept only on our server, so they cannot be turned back into the identifier or the address without it. We use these only to stop duplicates and to limit how many messages can be sent, never to find out who sent a message.

Not linked to your account. Feedback is sent the same way whether or not you are signed in. It does not carry your account, name, email address or phone number, and we do not use it to find out who sent it.

What is never sent. No photos or screenshots, no contact details, no logs or technical diagnostics, and none of your sales, stock, customer, utang, cash or other business records. Of what you write, only the text you type is sent, so please do not type customer names, phone numbers or other private details into your message.

When it is sent. Only when you tap Send. The app says it was sent, with a reference number, only after our server has accepted it while the form is still open. If you are offline, or our server cannot take it right away, the app keeps the message on your phone, shows it as Queued, and sends it by itself when you are back online, without showing a reference number. A message still waiting to be sent is removed if you delete the app.

Who sees it and why. Feedback is stored in our cloud database, operated for us by Supabase in Singapore (sections B and B2). Only EM Labs staff who review feedback can read it. Sales partners cannot see it. We use it only to look into the problems and suggestions you send and to fix and improve the app. We do not use it for advertising and we do not sell it.

How long we keep it. We delete feedback about two years after we receive it. Because it is not linked to your account, deleting your account does not delete it. To have a message deleted sooner, email support@emlabscorp.com with its reference number or, if you did not get one, roughly when you sent it and what it said.

G. Update notices and notifications

These are part of the app from version 0.1.7.

Update notice. When the app is online it asks our server which is the newest published version for your kind of phone. That request carries no account or store information. If a newer version is available on the App Store or Google Play, the app shows a notice you can dismiss. After an update, the app shows what changed, once.

Notifications are off unless you turn them on. If you turn on notifications about new versions, your phone gives the app a notification token. The app sends that token to our server together with the random installation identifier (section B), which our server keeps with this registration only as a one-way code, whether the phone is an iPhone or Android, the app version and build, whether it is a test build, and the app's language, so we can tell you about a new version in your language. To limit how often a phone can register, our server also keeps one-way codes made from the installation identifier and your internet address in its rate-limit counters. We use the registration only for announcements about new versions of NegosyoKlaro. Notifications never contain your business records or anything about your customers.

Not linked to your account. The app's request to our server carries no sign-in session, name, email address, phone number or anything about your store, and because our server keeps the installation identifier only as that one-way code, we do not link the registration to your account. While notifications are on, the app sends the same details again whenever any of them changes, for example after an app update or when the token changes, and otherwise about once a month when you open your store.

Who delivers them. We send notifications through Expo's push notification service, which passes them to Apple (iPhone) or Google's Firebase Cloud Messaging (Android) for delivery. These services receive the token and the text of the notification. On Android, when you turn notifications on, the Firebase software in the app also contacts Google to create the token, which gives Google an identifier for this installation of the app.

What Expo receives. When you turn notifications on, Expo also receives your phone's own push token, an identifier Expo creates for the app on this phone, and details about our app: identifiers for the app itself (not for you or your phone) and whether it is a test build. While they stay on, the notification software in the app also sends the token, the identifier Expo creates and these details to Expo by itself: once after you turn them on (usually the next time the app starts), whenever the token changes, and when the app starts if a week has passed since it last did. On iPhone, if you delete the app while notifications are on and later install it again, these automatic updates can start before you turn notifications on again, because iPhone can keep the notification software's own record after an app is deleted.

Turning them off. When you switch them off in Settings → App updates, the app switches off the automatic updates to Expo and tells our server, which then deletes the token it holds. If the app cannot reach our server, for example because your phone is offline or our server cannot accept the request at that moment, it keeps your choice and tries again each time you open your store in the app, or come back to it, while online, until our server has it; it does not try again just because your phone comes back online, and the app does not wake up in the background to do this. It cannot try again while you are signed out or once you remove the app, so if you plan to delete your account or remove the app, switch notifications off first, while your phone is online.

In your phone's settings. If you turn off all notifications for NegosyoKlaro there instead, the app switches them off in the same way the next time you open your store. On Android, turning off only the App updates category hides the notifications but does not tell the app, so switch them off in the app too.

Until our server has your choice. Our server may still have the token until then, even if the app had not finished turning notifications on, so a notification about a new version that we send in the meantime can still reach you. If the app never gets through, our server keeps the token, and may send to it, until it learns that the token no longer works or the registration expires, and then deletes it as described in How long we keep a registration; on iPhone, an app you remove and install again may keep getting those notifications until you switch notifications on in it, let the app finish turning them on while your phone is online, and then switch them off again.

Notifications already on their way. Once our server has your choice, it starts no new notifications to your phone, but one it is already sending at that moment may still go out, and it cannot call back one it has sent: Expo, Apple or Google may still deliver it after you switch notifications off, for example when your phone next comes online.

How long we keep a registration. Once our server has your choice to switch notifications off, it deletes the token at once and the rest of the registration within about two months. If our delivery service tells us a token no longer works, we stop using it and delete it within about two months. We also delete a registration that the app has not renewed for 400 days.

What Expo, Apple and Google keep. Our server deleting your token does not erase what Expo, Apple or Google already received: neither the app nor our server asks them to delete your phone's push token or their records about it, and any records they keep are covered by their own terms and privacy policies. An update to Expo that has already started when notifications go off, for example one that starts as the app opens, may still go out. In rare cases, for example if you switch them off before the app has finished turning them on, one more automatic update to Expo may go out after that; the app switches these updates off again by itself, normally the next time you open your store.

Camera, photos, and barcodes

Barcode scanning uses your camera on the device. Only the barcode number is saved, to your local product record. The barcode is read on the phone itself, and the camera image used for barcode scanning never leaves your phone. On iPhone, the app reads barcodes with Apple's built-in reader and open-source code that runs on the phone. On Android, it uses Google's ML Kit barcode scanner, which sends Google diagnostic and usage information about the scanner: your phone's make, model and Android version, and the machine-learning hardware it has available; the app's package name and version; scanner settings such as image format and resolution; the scanner's version and the size of what it reads and returns; what the scanner did, such as starting up or reading a barcode; how long that took and any error codes; and identifiers for the app installation and, in some cases, for the device. It does not send Google the image or the barcode number. Google says it uses this information, as described in its own privacy policy, to measure and improve ML Kit, fix problems and detect misuse, and that it does not share it with third parties. We do not receive this information and cannot delete it, and the app does not attach your NegosyoKlaro account to it. Google's scanner code starts when the app opens, so some of this information may be sent even if you never open the scanner.
Product photos (camera or photo library) are saved inside the app on your phone and are not uploaded.
Biometric unlock, if you turn on Owner Lock, is checked by your phone — Face ID or Touch ID on iPhone, your device's own fingerprint or face unlock on Android. The app only receives a yes-or-no answer; your biometric data never reaches us or the app.

What we do not do

No advertising and no advertising SDKs
No tracking, attribution or crash-reporting SDK. Two parts of the app send information that is used for statistics: Google's ML Kit barcode scanner on Android (see Camera, photos, and barcodes), and RevenueCat, which keeps a record for each signed-in account and for anyone who opens the upgrade screens, and gives us statistics built from it (see section C). We do not use Apple's App Tracking Transparency framework, we never request Apple's advertising identifier or Android's advertising ID, and we do not track you across other companies' apps or websites
No selling or renting of data
No marketing notifications. From version 0.1.7, the app can tell you when a new version is available, by a notice inside the app and, only if you turn it on, by a notification (section G).
No access to your phone's location, contacts list or microphone. The app never asks for these permissions. The customer and supplier details you type in yourself are covered in sections A and B2, and the approximate country RevenueCat works out from your IP address is covered in section C
No upload of your sales, inventory, customer or utang records unless you start it yourself — by tapping Back Up Now (section B2) or by scanning a receipt (section D). There is no automatic sync

Retention and deletion

Account records are kept while your account exists. The records on your phone are yours and stay until you delete them or the app.

Account deletion is built into the app: Settings → Delete account. Because deletion is permanent, the app deletes your account on our servers first and only wipes the phone once that has succeeded — if it cannot reach us, nothing is deleted and you can try again.

You can also ask us to delete it without opening the app — useful if you changed phones or have already uninstalled it. See how to request account deletion, which also explains what we ask for and how we check the request really comes from the account owner.

Deleting your account removes, from our servers:

Your sign-in account and your profile
Your store record and the claim linking that store to you
The referral attribution and referral-claim records tied to that store, if you entered a sales partner's code
Any first-year referral discount benefit and offer-code allocation recorded for that store
Your current subscription and trial status held on our servers
Your Smart Resibo scan records — the counters and fingerprints from section D
Your Cloud Backup — every backup copy of your store's records and the operational records about it (section B2)

Feedback you sent from the app is not linked to your account, so it is not removed with it. We delete it about two years after we receive it, or sooner if you ask us by email (section F). A notification registration (section G) is not linked to your account either, so deleting your account does not remove it: before you delete your account, switch notifications off in Settings → App updates while your phone is online, and once our server has your choice (section G explains when the app sends it and what happens if it cannot), we delete our copy of its token at once and the rest of the registration within about two months.

Deleting from inside the app also wipes the business records, product photos and QR image from the app on that phone, and clears your Owner Lock credential. If you delete by asking us instead, remove the app from your phone to clear those.

Deleting the app from your phone does not delete your cloud backup; deleting your account does.

We cannot promise that every historical record about an account disappears. A limited set is deliberately kept, because deleting it would erase money owed to someone else, or would let a closed account be used to claim a one-time benefit twice:

Partner-programme accounting. If a sales partner introduced your store, the record of what we owe or paid that partner survives, along with the record that a purchase qualified for it
Subscription and billing event evidence. The store notifications behind a purchase, renewal or refund — the evidence behind money that moved
One-time-benefit, cohort and anti-abuse markers. Records that a launch or trial benefit was already used. These hold one-way values or opaque identifiers, never readable contact details
Partner and audit records, where keeping them remains necessary
Billing records held by Apple and Google under their own policies, which we cannot delete on your behalf

What those retained records still contain is the internal identifiers they were created with — an account id, a store id, a purchase reference — which stop resolving to anything once the account is gone. They hold no name, email address, phone number or password.

We do not state a fixed retention period for them, because we have not set one. Publishing a number we do not actually enforce would be worse than saying so plainly. If we adopt a retention schedule, this page will describe it before it takes effect.

Your record at RevenueCat. RevenueCat, which manages subscription status for us (section C), keeps a customer record for signed-in accounts, including ones that never subscribe. The record is filed under your subscription account identifier, and usually also under any anonymous identifier RevenueCat created before you signed in. It holds your purchase and subscription history, if any, and the details described in section C, including an approximate country. The app and our servers never send RevenueCat your name, email address or phone number. Deleting your NegosyoKlaro account does not currently remove that record automatically. If you want it removed, ask for it in an emailed deletion request (see how to request account deletion) and we will delete it from RevenueCat once your account is gone. Ask for this instead of deleting in the app, because once the account is deleted in the app we may not be able to find that record. Remove the app from your phone as well: a copy that is still installed and signed in can create a new RevenueCat record when it is opened.

Deleting your NegosyoKlaro account does not cancel a paid subscription. Cancel that with the store you bought through: on iPhone in Settings → your name → Subscriptions; on Android in the Google Play Store under Payments & subscriptions → Subscriptions.

Security — honestly stated

Traffic to our servers uses encrypted connections. Secret provider keys, such as the AI provider's key, are kept on our servers and never inside the app; the app contains only the public keys that Supabase, RevenueCat and, on Android, Firebase (for notifications, section G) are designed to have inside apps. We do not claim end-to-end encryption: this is transport encryption plus server-side access control.
Owner Lock (PIN / Face ID) protects the app's owner-only screens on a shared phone. It is an app-level lock: it does not encrypt the database file, so your phone's own passcode remains the strongest protection for your data.
Your business data is stored on your device. A lost or broken phone can mean lost records unless you have a backup — your phone's own backup (section E) or a NegosyoKlaro Cloud Backup (section B2, Pro).

Information about other people

When you record a customer's name and their utang balance, you are recording information about someone else. Those entries stay on your phone, and reach our servers only inside a Cloud Backup you choose to make, where we keep them solely to restore them to you — but you are the one responsible for what you record about your customers and for handling it fairly, including if a customer asks you about it.

Children's privacy

NegosyoKlaro is a business tool intended for adults running a store. It is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

If we change how the app handles data — for example, if we add a new feature that sends data off your phone — we will update this page and its effective date before the change reaches you in an app update.

Contact

EM Labs
Email: support@emlabscorp.com