Privacy Notice
For business owners and staff who use Selyo · Effective 1 December 2026
Who we are
Selyo is run by James Grimaldo, an individual software developer based in Mandaluyong City, Metro Manila, Philippines ("we"). Selyo and Likom are his apps, not separate companies. He is the controller of the personal information in this notice. We follow the Philippine Data Privacy Act of 2012 (RA 10173) and respect the extra rights your own country's law may give you.
Data Protection Officer: James Grimaldo, [email protected]. Our full postal address is available on request by email.
This notice is about you as an owner or staff member. Your customers' information is covered by the Likom Privacy Notice and section 6 of the Selyo Terms of Service, where your business is its controller.
What we collect
| What | Details |
|---|---|
| Your login | Email and/or mobile, a hashed password, @username; your Google account ID and email if you sign in with Google. |
| Your profile | Name, display name, city, notification choices. |
| Your business role | Which businesses and branches you belong to, your role and permissions, join requests and invitations. |
| What you do in Selyo | An audit trail of changes and Counter actions (who, what, when, from which IP address), approvals you ask for or give, sign-in times and devices. |
| Business details | Business and branch names, addresses, map pins, contact details, logos and photos. Mostly about the business, but may include your name or number. |
Why we use it
- To provide Selyo (our agreement): sign you in, show the businesses you belong to, apply your permissions.
- To keep businesses and customers safe (legitimate interest and legal duties): the audit trail, fraud checks, sign-in limits, investigating misuse.
- To contact you: sign-in codes, approvals, alerts and service notices; product news only if you agree.
- Because the law requires it.
Other owners and staff of your business see your name, role, branch and the actions you take there. Customers see your business's public details, not your personal ones, unless you put them there. We don't sell personal information.
Providers and other countries
Neon (database, Singapore), Railway (servers), Cloudflare (websites and images), Resend (email) and Google (Sign-In, notifications) process data for us under contracts that limit them to our instructions. Some process it outside the Philippines, including in the United States; we stay responsible for it and use providers bound to protect it to a comparable standard. If you're in the EU or UK (GDPR), Singapore (PDPA), California (CCPA) or elsewhere with its own privacy law, you may have extra rights, which we'll honour where they apply.
How long we keep it
- Your login and profile: while you have an account.
- Audit trail entries naming you: for as long as the business keeps its records, up to 10 years, because they show who changed balances and money.
- Statistics that can't identify you may be kept longer, to run and improve Selyo.
- When you leave a business, your access ends at once; its audit trail keeps your past actions.
Your rights
You can ask to be informed about, access, correct, object to, block, delete or get a copy of your personal information, and complain to the National Privacy Commission. Email [email protected]; we'll answer within 15 days. Some audit records can't be deleted while a business still needs them.
Security
We use measures suited to the risk (encryption in transit, hashed passwords, per-business access, sign-in limits, an audit trail) and keep them current. No system is perfectly secure: if a breach is likely to put you at risk, we'll tell you and the National Privacy Commission within the time the law requires.