Privacy Policy

This Privacy Policy explains how Syneria Technologies OPC (“Syneria,” “we,” “us,” or “our”), with registered address at 7th Floor, Inoza Tower, 40th Street, Taguig, Metro Manila, Philippines, 1630, collects, uses, shares, and protects personal data when you use BareLedger (the “Service”) at bareledger.app.

We process personal data in accordance with the Data Privacy Act of 2012 (Republic Act No. 10173) of the Philippines, its Implementing Rules and Regulations, and issuances of the National Privacy Commission (“NPC”), and — where they apply to you — the data-protection laws of your own jurisdiction.

1. Roles

• For account holders' personal data (your profile, login activity), Syneria acts as a personal information controller.
• For personal data contained in your organization's accounting records (for example, the names and tax identification numbers of your customers, suppliers, and payees), your organization is the controller and Syneria acts as a personal information processor on its behalf.

2. Personal data we collect

2.1 Account data

• Name, email address, phone number, and job title
• Profile photo (avatar) and, where you provide one, a handwritten signature image used to sign documents
• Password (stored only as a cryptographic hash) and two-factor authentication secrets (stored encrypted)
• Record of your acceptance of the Terms of Service and email verification status

2.2 Organization data

• Legal and trade name, business type, registration numbers, and tax identification numbers (e.g., TIN and revenue-district information where applicable)
• Registered address, contact email and phone, logo, functional currency, and timezone

2.3 Usage and security data

• Login history, including email used, success or failure, IP address, and browser user agent
• Immutable audit logs of actions performed in the Service (actor, action, before/after state, IP address, and reason where provided)
• Technical logs necessary to operate and secure the Service

2.4 Billing data

Payments for paid plans are processed through hosted checkout by our payment processors — Paddle (acting as merchant of record for card and international payments) and PayMongo (Philippine local payment methods such as GCash, Maya, and QR Ph). We receive transaction status, plan, amount, and reference identifiers, but we never receive or store your full card number or payment credentials.

2.5 Marketing attribution

When you first arrive on our public website, your browser stores a small record of how you got here: campaign parameters from the link you followed (for example utm_source), the hostname only of the referring website, the page you landed on, and the time of that first visit. We do not store the full referring address.

This record is kept in your browser's local storage — not in a cookie — and is never shared with another website. It is sent to us once, if and when you create an account, so we can understand which of our guides and channels help people find us. It is cleared from your browser at that point. If you never sign up, it never leaves your device.

2.6 Sign-in via third parties

If you sign in with Google, Microsoft, or Apple, we receive basic profile information (such as your name and email address) from that provider, as authorized by you.

3. Why we process personal data

• To provide the Service — creating and administering accounts, operating your organization's books, generating documents and reports (contractual necessity).
• Security and integrity — authentication, two-factor verification, fraud and abuse prevention, audit trails (legitimate interest and legal obligation).
• Billing — processing subscriptions and payments through Paddle or PayMongo (contractual necessity).
• Communications — transactional emails such as verification, security, and billing notices (contractual necessity); product announcements you can opt out of (legitimate interest or consent).
• Understanding how people find us — aggregate website measurement and the sign-up attribution record described in section 2.5, so we can tell which guides and channels are useful (legitimate interest). You can opt out of marketing email at any time using the unsubscribe link in any such message.
• Legal compliance — record-keeping, responding to lawful requests from authorities, and enforcing our Terms (legal obligation and legitimate interest).

We do not sell personal data, and we do not use third-party advertising or cross-site tracking.

4. Cookies and similar technologies

The Service uses only essential storage needed for it to function — session and authentication state and basic preferences. We do not use advertising cookies or cross-site tracking, and we do not sell or share personal data with advertising networks.

Our public website uses Cloudflare Web Analytics to count page views. It is cookieless: it sets no identifier in your browser and cannot follow you across other websites. Together with the local-storage attribution record described in section 2.5, this is the only measurement we perform, which is why the site does not ask you to accept tracking cookies.

5. Sharing and sub-processors

We share personal data only with service providers who help us operate the Service, under contracts that restrict their use of the data:

We may also disclose personal data where required by law, regulation, or valid legal process, or to protect the rights, safety, or property of Syneria, our customers, or the public.

6. International transfers

Our service providers may store or process data in jurisdictions other than your own. Where personal data is transferred internationally, we take reasonable steps — including contractual commitments with our providers — to ensure it receives a level of protection consistent with the Data Privacy Act of 2012 and, where applicable, the data-protection law of your jurisdiction.

7. Retention

• Account data is kept for as long as your account is active and for a reasonable period afterward to handle post-closure matters.
• Financial and accounting records are subject to statutory retention periods that vary by your organization's country of registration — for example, ten (10) years under Philippine regulations, seven (7) years in New Zealand, and five (5) years in Australia. Where no specific period applies, we apply a default of ten (10) years. Records under a statutory retention period cannot be deleted before the period lapses, even upon request.
• Security logs and audit trails are retained as append-only records for the periods necessary to meet security and compliance obligations.
• The sign-up attribution record described in section 2.5 is kept for the life of the account and is deleted with it.

8. Security

• Encryption in transit (TLS) for all connections to the Service
• Passwords stored as cryptographic hashes; two-factor secrets and recovery codes stored encrypted
• Optional TOTP two-factor authentication, with sensitive actions gated behind fresh verification
• Role-based access control and strict per-organization data isolation
• Append-only audit logs that cannot be edited or deleted

No system is perfectly secure. If we become aware of a personal data breach that is likely to give rise to a real risk of serious harm, we will notify the NPC and affected data subjects within the periods required by applicable law.

9. Your rights

Under the Data Privacy Act of 2012, and subject to its conditions, you have the right to:

• be informed about how your personal data is processed;
• access the personal data we hold about you;
• correct inaccurate or outdated personal data;
• object to processing, including for direct marketing;
• request erasure or blocking of data that is unlawfully processed or no longer necessary (subject to statutory retention of financial records);
• data portability — obtain a copy of your data in a commonly used electronic format;
• lodge a complaint with the National Privacy Commission (privacy.gov.ph); and
• be indemnified for damages caused by inaccurate, incomplete, or unlawfully obtained personal data.

If you are located in a jurisdiction whose data-protection law grants you additional rights (for example, rights equivalent to those under the GDPR), we will honor those rights to the extent they apply. To exercise any right, contact us at inquiries@syneria.ph. We will respond within the period required by applicable law. Note that requests concerning personal data inside an organization's accounting records may need to be directed to, or confirmed by, that organization as the controller.

10. Children

The Service is intended for business use by adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us personal data, contact us and we will delete it.

11. Changes to this Policy

We may update this Privacy Policy from time to time. For material changes we will provide notice by email or in-app notice before the change takes effect. The “Effective date” above reflects the latest revision.

12. Contact

For privacy inquiries, requests, or complaints, contact our data protection contact at inquiries@syneria.ph, or write to Syneria Technologies OPC, 7th Floor, Inoza Tower, 40th Street, Taguig, Metro Manila, Philippines, 1630.