Privacy Policy

ALLI Recon is operated by ALLI Recon OPC, a one person corporation organized under Philippine law with registered office at 21st Floor, Unit 2116, Park Triangle Corporate Plaza North Tower, 32nd Street corner 11th Avenue, Bonifacio Global City, Fort Bonifacio, Taguig City 1635. ALLI Recon OPC is the data controller for the personal data described in this policy.

Under the Data Privacy Act of 2012, ALLI Recon OPC is the personal information controller for the data described here.

This policy covers two kinds of people: account holders who use the product, and visitors to our public pages who may never create an account. Almost everything below concerns account holders. What we collect about a visitor is limited to two things: what you enter on our contact page if you send it or book a call, which we hold only as long as section 8 describes, and the marketing conversion events described in section 2. Section 4 gives the basis for each, section 5 who receives them, and section 10 the limits.

We collect the following categories of information:

• Account information. Your name, email address, and a securely hashed password, managed through our authentication provider, and the mobile number you give us at signup or in your account settings.
• Organization and workspace details. The organizations and client workspaces you create, and the team members you invite.
• Financial and operational data. The marketplace payouts, payout line items, marketplace orders, COD remittances, expected orders, classifications, and journal entries that you connect or upload, and that ALLI Recon generates for you. This includes a copy of the chart of accounts from the ledger you connect, so its accounts can be offered for mapping by name. For a workspace whose books ALLI Recon keeps, the journals are kept in ALLI Recon's own ledger, in our database, rather than in an accounting system of yours: the workspace's standard chart of accounts and every journal recorded in it, with each line, date and amount. That ledger holds only what ALLI Recon already processes for the workspace: payouts from your marketplaces and website, sales recorded on delivery, courier COD remittances, cost of goods and ad spend. Nothing in it comes from your bank, because ALLI Recon does not connect to your bank account. A marketplace order is kept with its products, amounts and dates, and, for orders pulled from 07 Oct 2026, the courier and the parcel tracking numbers the marketplace names. We keep the courier and tracking number only to match a parcel to its order. We do not keep the buyer's name, address or phone number.
• Shipment documents. If you ask us to read the documents for a shipment, the files you upload for it: packing lists, supplier invoices, forwarders' and brokers' bills and customs entries, as PDFs, photos or spreadsheets. These documents can name people, such as a supplier's contact, a customs broker or the person who signed, and can show tax identification numbers and addresses. We use them only to fill in the shipment you are entering.
• Integration access tokens. OAuth access and refresh tokens for Xero, QuickBooks Online, Google and connected marketplaces, stored encrypted at rest (see section 6).
• Technical and usage data. Log data, device and browser information, and error diagnostics, used to operate and improve the service.
• Contact page details. If you use our contact page to book a call or tell us about your business, what you enter there: your name, email address, phone number and business name, the answers you choose, and the time you book. With it we keep, until your request has reached GoHighLevel, the IP address and browser user agent your request carried and, if you arrived from a Meta advertisement, the click identifier Meta attached to the link you followed. To stop automated and repeated requests, we also keep for 24 hours a one way code made from your IP address and one made from your email address; neither can be turned back into the address it came from. We pass the details to GoHighLevel, our contact provider (section 5), send Meta the contact form and booking events described below, and then clear them from our database, as section 8 describes.
• Marketing conversion events. When you create an account or send the contact form, we send Meta Platforms one event from our server recording which of those two actions happened, the time it happened, and the page it happened on, and, for the account signup, the IP address and browser user agent your request carried, together with which of the two organization types you chose at signup, accounting firm or direct seller. So that Meta can tell which of its advertisements led to a signup, the account signup event also carries your email address, your first name and your last name, each converted to a SHA-256 hash before it leaves our server, a hashed identifier for your new account, and, if you arrived from a Meta advertisement, the click identifier Meta attached to the link you followed. Meta receives the hashes rather than the plain text, but a hash of your email address is still a way to recognise you, and Meta matches it against the accounts it holds. The click identifier is read from the address of the page you landed on and held until you register; it is not a cookie and it is never read by Meta from your browser. After you sign up, we send Meta up to four more events about your organization, each once, the first time it happens: when it creates its first workspace, when it first connects a Lazada or TikTok Shop store (with which of the two it was), when its first journal is posted (with where its books are kept: ALLI Recon books, Xero, QuickBooks or a spreadsheet), and when it makes its first subscription payment (with the amount of that payment before VAT, in pesos). Each of these events carries the time it happened and the same hashed email address, first name, last name and account identifier as the signup event, taken from the person who signed the organization up, so that Meta can tell which of its advertisements led to people who went on to use ALLI Recon. They carry no click identifier, no IP address and no browser user agent: we never keep the click identifier after your signup to send later. When you book a call on our contact page, we send Meta one more event recording the booking, the time you booked it and the page you booked it on. So that Meta can tell which of its advertisements led to the booking, it carries your email address, your first name and your last name, each converted to a SHA-256 hash before it leaves our server, the IP address and browser user agent your request carried, and, if you arrived from a Meta advertisement, the click identifier Meta attached to the link you followed. It carries no account identifier, because a booking is not an account. No event ever carries your mobile number. The contact form event is named Lead when you book a call, and SelfServe when you are a seller we point to our software instead of a call. It carries the same identifiers as the booking event: your email address, first name and last name, each converted to a SHA-256 hash, the IP address and browser user agent your request carried, and the click identifier when you arrived from a Meta advertisement. No tracking script runs in your browser for this and no advertising cookie is set. Section 5 names the recipient, section 4 the basis, and section 10 what this means for your rights.
• Cookies. Strictly necessary cookies that keep you signed in. We do not use advertising cookies. The map on our contact page is not loaded until you press Show map. If you do, Google may set its own cookies (see section 5).

We use your information to provide reconciliation, to post journals you approve, or that a posting schedule you switched on approves, to the ledger you connected for that workspace, your Xero organization or your QuickBooks Online company, or to record them in ALLI Recon's own ledger for a workspace whose books we keep, to secure and operate the service, to provide support, and to improve the product. We do not use your financial data to train advertising profiles, and we do not sell it.

When you ask us to read shipment documents, we send each document to Anthropic, whose AI model reads it, and we get back the figures it found and where on the page it found each one. Nothing from a document reaches your books until you have checked the figures and saved the shipment yourself.

We use your mobile number only to contact you about setting up and using your account, for example to help you connect your store. We may call you, or message you on Viber or WhatsApp, for that purpose and no other, and we do not use it for marketing. We never use it for advertising or give it to any platform, Meta included, for advertising. If we message you on Viber or WhatsApp, that service carries the message under its own privacy policy. You can change or remove your number at any time in your account settings.

We process personal data on the bases recognized by the Data Privacy Act: the performance of our contract with you, your consent (for example, when you connect a ledger or a marketplace), and our legitimate interests in securing and improving the service, balanced against your rights.

For the marketing conversion events described in section 2, the basis is our legitimate interest in measuring whether our advertising works, balanced against your rights. The identifiers the signup event and the four later events carry serve the same interest: measuring whether advertising works means telling the advertising platform which signups its advertisements produced, and which of those went on to use the service. Section 10 explains what those events can and cannot reveal about a person.

For what you enter on our contact page, the basis is taking the steps you ask for before any contract: arranging the call you book, or answering your enquiry. The contact form event and the booking event serve the same interest in measuring our advertising as the signup event: telling the advertising platform which requests and bookings its advertisements produced.

We rely on a small set of processors that handle data on our behalf, each under its own data processing terms:

• Supabase for database, authentication, and storage.
• Vercel for application hosting.
• Inngest for background job processing. A running job carries reconciliation and settlement data as its job state.
• Postmark for transactional email.
• Sentry for error monitoring. Reports are scrubbed of personal data and access tokens before they are sent.
• PayMongo for subscription payments. You pay an invoice on PayMongo's own page, and what you enter there goes to PayMongo, not to us: your card number, expiry date and security code, or the e-wallet or bank app you pay from, and, where the page asks for them, your name, email address, phone number and billing address. From us, PayMongo receives the amount, a description naming the billing period, and our reference numbers for the invoice, the payment and your organization, and nothing from your books. We never see or store a card number. PayMongo tells us whether the payment went through and the fee it charged, and we keep its notice of each payment with the payment record: the method used, for a card its brand, the country that issued it and its last four digits, and the name, email address, phone number and billing address you gave on its page, where it asked for them.
• Anthropic for reading the shipment documents you upload, and for nothing else. A document is sent to Anthropic only when you ask for it to be read. Anthropic does not use it to train its models. Anthropic deletes it within 30 days, except where it is flagged under Anthropic's usage policies, when Anthropic may keep it for up to two years, or where the law requires it to be kept.
• Meta for advertising measurement. We send it the marketing conversion events described in section 2, and nothing else about a visitor or an account. This is a separate relationship from the advertising spend integration listed below, which only reads data and only exists for an ad account you connect.
• GoHighLevel, which we use through Jenius, as our contact provider and booking calendar. What you enter on our contact page is sent to it from our server and kept as a contact record so we can reply and hold the call you book: your name, email address, phone number and business name, the answers you choose, and the time you book. Our contact page loads nothing from GoHighLevel in your browser. If you book from a link in one of our emails, the calendar you see is GoHighLevel's own, and it loads a script from Meta Platforms. We have not set it up to track anyone and nothing is sent to Meta's tracking service, but your browser does contact Meta to fetch the script, which shows Meta your IP address and browser details.
• ALLI Accounting, the bookkeeping business run by the accountant who built ALLI Recon, whose team calls or messages new accounts on our behalf to help with setup. It receives your name, business name, email address and mobile number for that purpose only.

Our contact page can show our office on a Google map. Nothing is requested from Google until you press Show map. When you do, your browser connects to Google directly, and Google receives your IP address and browser details and may set cookies, under Google's own privacy policy. We receive nothing from the map.

Separately, these are the services you connect yourself. We exchange data with them on your instruction, and only for the workspace you connected them to:

• Xero and Intuit QuickBooks for the accounting integration you authorize. We read your chart of accounts, so you can choose which account each figure posts to by name. We write journal entries, and nothing else: we do not create or change customers, suppliers, invoices, bills or payments. We read back the journals we posted, and we ask which of them changed since we last looked, so an edit or a deletion on your side does not go unnoticed.
• Lazada and TikTok Shop for the marketplace integrations you authorize. We read finance and order data only.
• Google for the spreadsheet export you authorize. We write to the one spreadsheet you pick.
• Meta for advertising spend, if you connect an ad account. We read the daily spend total only.

Some of these providers may process data outside the Philippines. Where they do, we rely on their contractual safeguards (see section 12).

When you connect a ledger or a marketplace, we store the resulting access tokens encrypted at rest. These tokens are used only to sync data and to post journals on your behalf. They are never sold and never shared for marketing. They are not returned to your browser, with one exception: when you pick a Google spreadsheet, Google's file picker runs in your browser and needs a short lived Google access token to do it, so that one token is passed to the page while the picker is open. The long lived refresh token never leaves our servers. You can revoke any of them at any time by disconnecting the integration.

We do not sell personal data. We share it only with the service providers listed in section 5, and where we are required to by law or valid legal process.

We retain your data while your account is active.

An owner can delete their own account from the account menu. It is refused while anyone else is still a member of the organization, and while an invoice is outstanding, so that a shared workspace is never emptied by one person alone. A member removed from an organization by an owner or manager keeps their account, unless that account was created from the organization's own invitation and belongs nowhere else, in which case removing them deletes it; the person removing them is told which of the two they are doing before they confirm.

Deletion is immediate and cannot be undone, and we are plain about what it leaves. Your sign in is destroyed, the name and email address on your member record are replaced with placeholders, and your mobile number is erased, so the record can no longer identify you. Three things remain. First, the audit trail: every action recorded under your name keeps your name and email address on that record, because a trail that forgot who acted would be worthless to the accountants who rely on it, which is the same reason an invoice keeps the name of the person who issued it. The trail records that you gave or changed a mobile number, but never the number itself. Second, the member record itself stays as an anonymous anchor, so that the financial records linked to it remain intact. Third, our hosting provider keeps encrypted backups for its own retention window, which we cannot reach into. Records already posted to your accounting ledger or written to your spreadsheet stay where they are, because they are your books. Books ALLI Recon keeps for a workspace stay too, in our database: deleting the account or the workspace erases neither their chart of accounts nor any journal, but nobody can open them in ALLI Recon afterwards. Before either deletion, ALLI Recon offers every journal of those books as a CSV file for you to keep.

For anything else, or if you cannot use that path, ask us and we act on the request by hand, aiming to complete it within 60 days. Other than the two cases described below, contact page details and shipment documents, nothing is deleted automatically on a schedule. We keep specific financial, transaction, and reconciliation records for longer only where a legal, tax, or audit obligation under Philippine law requires it, for the period that obligation specifies. The data deletion page explains how to make the request.

What you enter on our contact page is kept in our database only until it has been passed to GoHighLevel and the contact form and booking events have been sent to Meta, which usually takes less than a minute. Then we clear it: your name, email address, phone number, business name, answers, IP address, browser user agent and click identifier are erased from our record, and what remains is that a request was made, when, whether it became a booking, and the time booked. If passing it on fails, we keep your details and keep trying, and we never clear them before your request has reached GoHighLevel. If it has not reached GoHighLevel within 30 minutes, we tell our team so that we can arrange the call by hand, and we clear your details within 7 days of arranging it. If the time you chose was taken just before your booking, we keep your details so that you can choose another time, and clear them within 7 days if you do not. The one way codes made from your IP address and email address are cleared after 24 hours. Your contact record then stays with GoHighLevel, and you can ask us to delete it there.

Shipment documents you upload are kept for no more than 30 days, so that you can check the figures against them and have them read again if a reading fails, and are then deleted permanently by a job that runs every night. You can delete them sooner: press Discard documents before you save the shipment, or Delete the files now on a saved shipment. The figures read from them, each with its page and the few words it was read from, and the names of the files, are kept with the shipment you save, as part of your books, together with a record of which fields you changed before saving and which were read from a photo, never what they said. A reading you never save is deleted with its documents: we keep only a record that it happened, with when it happened, how many files it had, each file's size and type and what kind of document it was read as, whether each was read, and what reading them cost.

We encrypt sensitive integration tokens at rest and run all traffic over HTTPS. Each organization's data is isolated at the database using row-level security, not only in the application. Access to production data is restricted and logged.

Subject to the Act, you have the right to be informed; the right to access; the right to object; the right to erasure or blocking; the right to rectification; the right to data portability; the right to damages; and the right to lodge a complaint with the National Privacy Commission (NPC).

One limit on those rights, stated plainly. The account signup event and the four later events described in section 2 carry a hashed identifier for your account, so they are linked to you: we can tell which events were yours, and Meta can match them to a Meta account you hold. We cannot retract an event from Meta once it has been sent. Meta keeps it under its own data policy, and Meta's own account tools let you see and disconnect the activity that businesses have shared about you. Deleting your ALLI Recon account removes the identifiers from our records, as section 8 describes, but does not reach what Meta already received. Once the person who signed an organization up has deleted their account, we send no further event about that organization. If you would rather we did not send these four events about your organization, write to us at the address below and we will send no further ones. The contact form event and the booking event carry a hash of your email address and your name, so Meta can match them to a Meta account you hold, and we cannot retract them once sent. Because we clear your details once your request is handed over, we keep nothing that would let us find those events again. If you would rather no event were sent, email us to arrange the call instead. Every other category in section 2 is account data, and every right above applies to it in full.

Deleting your account is the right to erasure exercised on the account record: it removes what identifies you from that record. Section 8 names the three things that remain and why.

To exercise any of these rights, contact us at hello@allirecon.com.

ALLI Recon is a business tool and is not directed to anyone under 18. We do not knowingly collect data from children.

Some of our service providers operate outside the Philippines, so your data may be stored or processed abroad. Our infrastructure sub-processors (for example, our database, hosting, and email providers) may process data outside the Philippines under appropriate contractual and security safeguards, consistent with the Data Privacy Act of 2012. Anthropic, which reads the shipment documents you upload, processes them outside the Philippines, including in the United States.

We may update this policy as the product and our legal structure evolve. When we do, we will revise the date above and, for material changes, take reasonable steps to notify you.

For any privacy question or data request, contact hello@allirecon.com. You may also raise concerns with the National Privacy Commission.