Privacy Policy

ALLI Recon is operated by Ian Bautista, doing business as ALLI Management Consultancy Services, who is the data controller for the personal data described in this policy.

Under the Data Privacy Act of 2012, Ian Bautista acts as the personal information controller for the data described here.

We collect the following categories of information:

• Account information. Your name, email address, and a securely hashed password, managed through our authentication provider.
• Organization and workspace details. The organizations and client workspaces you create, and the team members you invite.
• Financial and operational data. The marketplace payouts, payout line items, COD remittances, expected orders, classifications, and journal entries that you connect or upload, and that ALLI Recon generates for you.
• Integration access tokens. OAuth access and refresh tokens for Xero and connected marketplaces, stored encrypted at rest (see section 6).
• Technical and usage data. Log data, device and browser information, product analytics, and error diagnostics, used to operate and improve the service.
• Cookies. Strictly necessary cookies that keep you signed in. We do not use advertising cookies.

We use your information to provide reconciliation, to post journals you approve to your Xero organization, to secure and operate the service, to provide support, and to improve the product. We do not use your financial data to train advertising profiles, and we do not sell it.

We process personal data on the bases recognized by the Data Privacy Act: the performance of our contract with you, your consent (for example, when you connect Xero or a marketplace), and our legitimate interests in securing and improving the service, balanced against your rights.

We rely on a small set of processors that handle data on our behalf, each under its own data processing terms:

• Supabase for database, authentication, and storage.
• Vercel for application hosting.
• Xero for the accounting integration you authorize.
• Resend for transactional email.
• Sentry for error monitoring.
• PostHog for product analytics.

Some of these providers may process data outside the Philippines. Where they do, we rely on their contractual safeguards (see section 12).

When you connect Xero or a marketplace, we store the resulting access tokens encrypted at rest. These tokens are used only to sync data and to post journals on your behalf. They are never sold, never shared for marketing, and never returned to your browser. You can revoke them at any time by disconnecting the integration.

We do not sell personal data. We share it only with the service providers listed in section 5, and where we are required to by law or valid legal process.

We retain your data while your account is active. When you close your account, or ask us to delete your data, we delete or anonymize your personal data within 60 days of closure. We keep specific financial, transaction, and reconciliation records for longer only where a legal, tax, or audit obligation under Philippine law requires it; those records are retained for the period that obligation specifies and then purged. Records are first soft-deleted and then purged on this schedule.

We encrypt sensitive integration tokens at rest and run all traffic over HTTPS. Each organization's data is isolated at the database using row-level security, not only in the application. Access to production data is restricted and logged.

Subject to the Act, you have the right to be informed; the right to access; the right to object; the right to erasure or blocking; the right to rectification; the right to data portability; the right to damages; and the right to lodge a complaint with the National Privacy Commission (NPC).

To exercise any of these rights, contact us at hello@allirecon.com.

ALLI Recon is a business tool and is not directed to anyone under 18. We do not knowingly collect data from children.

Some of our service providers operate outside the Philippines, so your data may be stored or processed abroad. Our infrastructure sub-processors (for example, our database, hosting, and email providers) may process data outside the Philippines under appropriate contractual and security safeguards, consistent with the Data Privacy Act of 2012.

We may update this policy as the product and our legal structure evolve. When we do, we will revise the date above and, for material changes, take reasonable steps to notify you.

For any privacy question or data request, contact hello@allirecon.com. You may also raise concerns with the National Privacy Commission.